first commit

.env.example

@@ -0,0 +1,32 @@
+# Canonical configuration. Rust reads .env without executing its contents.
+APP_NAME="MikroTik Backup System"
+APP_ENV=production
+APP_PORT=5581
+# Native defaults to 127.0.0.1; Docker overrides this to 0.0.0.0:5581.
+LISTEN_ADDR=127.0.0.1:5581
+API_PREFIX=/api
+TIMEZONE=Europe/Warsaw
+DATA_DIR=./storage
+# DATABASE_PATH=./storage/routeros_backup_next.db
+# Legacy alias also supported: DATABASE_URL=sqlite:///./storage/routeros_backup_next.db
+
+# Empty SECRET_KEY generates a persistent random key in DATA_DIR/secrets/jwt.key.
+# Set the old strong (32+ characters) key to keep existing JWTs valid during migration.
+SECRET_KEY=
+JWT_ALGORITHM=HS256
+ACCESS_TOKEN_EXPIRE_MINUTES=1440
+ALLOW_REGISTRATION=false
+DEFAULT_ADMIN_USERNAME=admin
+# Empty: random first-start password in DATA_DIR/secrets/initial-admin-password.
+# Applied only if the database has no users.
+DEFAULT_ADMIN_PASSWORD=
+
+SSH_TIMEOUT_SECONDS=30
+# strict: require DATA_DIR/ssh_known_hosts. accept-new: pin first observed key;
+# changed keys are always rejected. Verify fingerprints outside this application.
+SSH_HOST_KEY_POLICY=strict
+MAX_PARALLEL_BACKUPS=4
+SMTP_STARTTLS=true
+SMTP_TIMEOUT_SECONDS=20
+CORS_ORIGINS=[]
+RUST_LOG=mikrotik_backup=info,tower_http=warn