NODE_ENV=development
PORT=3000

# Network interface to bind. 127.0.0.1 = only reachable via a reverse proxy on the
# same machine (recommended for a manual install behind Caddy/nginx — keeps the app
# off the public internet). Use 0.0.0.0 only if you need direct external access
# (no proxy/HTTPS — not recommended). Docker sets this to 0.0.0.0 itself.
HOST=127.0.0.1
# Secret used to sign login-session cookies. Leave EMPTY to auto-generate a strong
# one on first start (saved to storage/.session-secret, stays stable across
# restarts/updates). Or set your own: openssl rand -hex 32
SESSION_SECRET=
DATABASE_PATH=./storage/database.sqlite
MEDIA_PATH=./storage/media

# Canonical public URL of this site (scheme + host, no trailing slash), e.g.
# https://yourdomain.com . Used to build correct links in emails (password reset)
# and OAuth redirects instead of trusting request headers (anti-spoofing).
# Optional: leave empty and it falls back to the request host (fine for local/dev);
# set it for production so email/login links point at the right place.
PUBLIC_BASE_URL=

# ── Administrator ───────────────────────────────────────────────────
# The admin logs in with username + password. On first start you create your
# admin account via /auth/register; after that, registration is closed.
# Forgot your password? -> "Forgot password" (email, see SMTP below) or always:
# `npm run reset-admin` on the server.

# ── Google login for LISTENERS (optional) ───────────────────────────
# Want listeners to sign in with Google to comment? Create your OWN Google OAuth
# client (Google Cloud Console -> Credentials -> OAuth client ID -> "Web
# application") and fill it in below. Your own client = your own Google Cloud
# project; this site isn't centrally tied to anything. Not set? Then there's
# simply no Google button. Google login NEVER grants admin rights (commenting only).
# GOOGLE_REDIRECT_URI = <your domain>/auth/google/callback (set it exactly in the client)
GOOGLE_CLIENT_ID=
GOOGLE_CLIENT_SECRET=
GOOGLE_REDIRECT_URI=https://example.com/auth/google/callback

# ── Email (optional) — for "forgot password" reset links ────────────
# Not set? Then reset only works via `npm run reset-admin` on the server.
SMTP_HOST=
SMTP_PORT=587
SMTP_USER=
SMTP_PASS=
SMTP_FROM=

# ── Lite mode (optional) ────────────────────────────────────────────
# Set to "off" to disable the whole audio feature (no built-in music hosting/
# player, no ffmpeg needed). Klonkt then runs as a lightweight blog/photo/EPK
# site, even on an environment without ffmpeg. Hub and Circles keep working.
# External embeds (YouTube/SoundCloud/Spotify) keep working too.
KLONKT_AUDIO=on