NODE_ENV=development
PORT=3000

# Network interface to bind. 127.0.0.1 = only reachable via a reverse proxy on the
# same machine (recommended for a manual install behind Caddy/nginx — keeps the app
# off the public internet). Use 0.0.0.0 only if you need direct external access
# (no proxy/HTTPS — not recommended). Docker sets this to 0.0.0.0 itself.
HOST=127.0.0.1
# Secret used to sign login-session cookies. Leave EMPTY to auto-generate a strong
# one on first start (saved to storage/.session-secret, stays stable across
# restarts/updates). Or set your own: openssl rand -hex 32
SESSION_SECRET=
# Encrypts the stored Patreon secrets for paid posts. Same deal: leave EMPTY to
# auto-generate on first use (saved to storage/.paid-secret, kept outside the DB
# so a database dump alone stays useless). Or set your own: openssl rand -base64 32
PAID_SECRET=
# Web-push (notificaties) VAPID keys. Leave EMPTY to auto-generate on first use
# (saved to storage/.vapid). Do NOT rotate: new keys break every subscription.
VAPID_PUBLIC_KEY=
VAPID_PRIVATE_KEY=
VAPID_SUBJECT=
DATABASE_PATH=./storage/database.sqlite
MEDIA_PATH=./storage/media

# Canonical public URL of this site (scheme + host, no trailing slash), e.g.
# https://yourdomain.com . Used to build correct links in emails (password reset)
# and OAuth redirects instead of trusting request headers (anti-spoofing).
# Optional: leave empty and it falls back to the request host (fine for local/dev);
# set it for production so email/login links point at the right place.
PUBLIC_BASE_URL=

# Strict HSTS. By default Klonkt sends a plain long max-age (safe on any domain).
# Set HSTS_STRICT=1 ONLY if Klonkt owns the whole domain incl. all its subdomains:
# it adds `includeSubDomains; preload`, which forces every subdomain to HTTPS and can
# get your domain baked into browsers near-permanently. Leave unset if unsure.
# HSTS_STRICT=1

# ── Administrator ───────────────────────────────────────────────────
# The admin logs in with username + password. On first start you create your
# admin account via /auth/register; after that, registration is closed.
# Forgot your password? -> "Forgot password" (email, see SMTP below) or always:
# `npm run reset-admin` on the server.

# ── Email (optional) — for "forgot password" reset links ────────────
# Not set? Then reset only works via `npm run reset-admin` on the server.
SMTP_HOST=
SMTP_PORT=587
SMTP_USER=
SMTP_PASS=
SMTP_FROM=

# ── Lite mode (optional) ────────────────────────────────────────────
# Set to "off" to disable the whole audio feature (no built-in music hosting/
# player, no ffmpeg needed). Klonkt then runs as a lightweight blog/photo/EPK
# site, even on an environment without ffmpeg. Hub and Circles keep working.
# External embeds (YouTube/SoundCloud/Spotify) keep working too.
# Reversible: set back to "on" (or remove) and restart — no reinstall, tracks kept.
KLONKT_AUDIO=on

# ── Premium extras ──────────────────────────────────────────────────
# The core app, all updates and Cirkels are free. A handful of extras
# (newsletter, statistics, EPK, link-in-bio, embeddable player, show agenda,
# release planning, download-for-email, paid posts) are unlocked by a one-time
# Patreon supporter link — that's what funds the project:
# klonkt.com / patreon.com/c/roboburr. Leave this on.
KLONKT_PREMIUM_ENABLED=on