# Copy this file to .env in the Unraid deployment directory
# (/mnt/tank/appdata/notizarr/.env) and fill in real values.
# Never commit a real .env.

# ---- Identity / URLs ----
PUBLIC_BASE_URL=https://notizarr.example.com
PORT_WEB=8080
PORT_INGEST=8081

# Host bind addresses used by docker/docker-compose.prod.yml.
# BIND_ADDR_INGEST defaults to 127.0.0.1 on purpose (see docs/phase1/02-threat-model.md) -
# set it to your LAN interface IP (e.g. 192.168.1.10) so LAN devices can publish,
# but never set it to 0.0.0.0 on a host with any WAN exposure.
BIND_ADDR_WEB=0.0.0.0
BIND_ADDR_INGEST=127.0.0.1

# ---- Auth ----
# oidc | proxy | disabled
AUTH_MODE=oidc
OIDC_ISSUER_URL=
OIDC_CLIENT_ID=
OIDC_CLIENT_SECRET=
OIDC_REDIRECT_URL=https://notizarr.example.com/api/v1/auth/oidc/callback
OIDC_SCOPES=openid profile email

AUTH_PROXY_USER_HEADER=
AUTH_PROXY_EMAIL_HEADER=
AUTH_PROXY_GROUPS_HEADER=
TRUSTED_PROXY_CIDRS=

# ---- Database ----
POSTGRES_USER=notizarr
POSTGRES_PASSWORD=change-me
POSTGRES_DB=notizarr

# ---- Push ----
VAPID_SUBJECT=mailto:admin@example.com

# ---- Ingestion safety ----
# Comma-separated CIDRs allowed to hit the :8081 ingestion listener,
# enforced in-app as defense in depth beyond network-level firewalling.
INGESTION_ALLOWED_CIDRS=10.0.0.0/8,172.16.0.0/12,192.168.0.0/16

# ---- Retention / rate limiting defaults (editable later in Admin > Settings) ----
RETENTION_DEFAULT_DAYS=90
RATE_LIMIT_SUSTAINED_PER_MIN=60
RATE_LIMIT_BURST_PER_10S=20

# ---- Ops ----
LOG_LEVEL=info
DOCS_ENABLED=true

# Image tag to run, if not building in place
NOTIZARR_IMAGE=notizarr:latest