.env.example

# Rungu Configuration
# Copy to .env and customize for your environment.

# ── Server ─────────────────────────────────────────────────────────────
# HTTP listen address (default: 0.0.0.0:3000)
RUNGU_LISTEN=0.0.0.0:3000

# Log level: trace, debug, info, warn, error (default: info)
RUST_LOG=rungu=info

# ── Database ──────────────────────────────────────────────────────────
# SQLite database path (default: rungu.db)
# Inside Docker, use the volume mount path:
RUNGU_DB=/data/rungu.db

# PostgreSQL support: set DATABASE_URL to override SQLite
# DATABASE_URL=postgres://rungu:password@localhost:5432/rungu

# ── Security ──────────────────────────────────────────────────────────
# Secret key for JWT session signing (generate with: openssl rand -hex 32)
APP_SECRET=change-me-to-a-random-32-char-hex-string

# Base URL for OAuth redirects (e.g., https://rungu.example.com)
APP_URL=http://localhost:3000

# Set to false for local HTTP development (no HTTPS).
# In production (HTTPS), leave as default (true).
RUNGU_SECURE_COOKIE=false

# CORS origins — comma-separated. Default: only APP_URL.
# Set to * to allow all (dev only — NOT safe for production).
RUNGU_CORS_ORIGINS=

# Rate limiting — max requests per minute per IP. 0 disables a limiter.
# API is broad (board browsing); auth is strict (OAuth login/callback abuse).
# Defaults: API 300/min, auth 30/min.
# RUNGU_RATE_LIMIT_PER_MIN=300
# RUNGU_AUTH_RATE_LIMIT_PER_MIN=30

# Trust X-Forwarded-For for rate-limit client IPs. Enable ONLY behind a
# reverse proxy that overwrites the header (nginx/Caddy/Cloudflare).
# Default: false (use the socket address).
# RUNGU_TRUST_PROXY=false

# Admin emails — comma-separated. Users with these emails get admin role on login.
# Example: ADMIN_EMAILS=admin@example.com,root@example.com
ADMIN_EMAILS=

# ── Auth Providers ───────────────────────────────────────────────────
# Leave empty/commented to disable. Fill to enable.
# Users with the same email across providers are merged into one account.
#
# OAuth Callback URLs (set these in your provider console):
#   Google:    {APP_URL}/auth/google/callback
#   GitHub:    {APP_URL}/auth/github/callback
#   Keycloak:  {APP_URL}/auth/keycloak/callback
#
# Example for localhost:
#   http://localhost:3000/auth/google/callback
#   http://localhost:3000/auth/github/callback

# Google OAuth — https://console.cloud.google.com/apis/credentials
# GOOGLE_CLIENT_ID=xxx.apps.googleusercontent.com
# GOOGLE_CLIENT_SECRET=GOCSPX-xxx

# GitHub OAuth — https://github.com/settings/developers
# GITHUB_CLIENT_ID=Ov23xxx
# GITHUB_CLIENT_SECRET=xxxx

# Keycloak OIDC — your Keycloak server
# KEYCLOAK_URL=https://auth.example.com
# KEYCLOAK_REALM=codecoradev
# KEYCLOAK_CLIENT_ID=rungu
# KEYCLOAK_CLIENT_SECRET=xxxx

# ── File Storage (attachments) ────────────────────────────────────────
# Storage driver: fs (filesystem, default) | s3 (S3-compatible, future)
# STORAGE_DRIVER=fs
#
# Filesystem driver — directory for uploaded files
# RUNGU_STORAGE_DIR=./uploads
#
# In Docker, use /data/uploads
# RUNGU_STORAGE_DIR=/data/uploads