# Canonical configuration. Rust reads .env without executing its contents.
APP_NAME="MikroTik Backup System"
APP_ENV=production
APP_PORT=5581
# Native defaults to 127.0.0.1; Docker overrides this to 0.0.0.0:5581.
LISTEN_ADDR=127.0.0.1:5581
API_PREFIX=/api
TIMEZONE=Europe/Warsaw
DATA_DIR=./storage
# DATABASE_PATH=./storage/routeros_backup_next.db
# Legacy alias also supported: DATABASE_URL=sqlite:///./storage/routeros_backup_next.db

# Empty SECRET_KEY generates a persistent random key in DATA_DIR/secrets/jwt.key.
# Set the old strong (32+ characters) key to keep existing JWTs valid during migration.
SECRET_KEY=
JWT_ALGORITHM=HS256
ACCESS_TOKEN_EXPIRE_MINUTES=1440
ALLOW_REGISTRATION=false
DEFAULT_ADMIN_USERNAME=admin
# Empty: random first-start password in DATA_DIR/secrets/initial-admin-password.
# Applied only if the database has no users.
DEFAULT_ADMIN_PASSWORD=

SSH_TIMEOUT_SECONDS=30
# strict: require DATA_DIR/ssh_known_hosts. accept-new: pin first observed key;
# changed keys are always rejected. Verify fingerprints outside this application.
SSH_HOST_KEY_POLICY=strict
MAX_PARALLEL_BACKUPS=4
SMTP_STARTTLS=true
SMTP_TIMEOUT_SECONDS=20
CORS_ORIGINS=[]
RUST_LOG=mikrotik_backup=info,tower_http=warn