# Server Configuration
API_PORT=8080
ENVIRONMENT=development  # IMPORTANT: Change to 'production' for production deployments!

# Security - REQUIRED
API_KEY=CHANGE-THIS-USE-32-CHARS-MINIMUM!!

# IP Whitelist (Optional but RECOMMENDED for production)
# Comma-separated list of allowed IPs or CIDR ranges
# Leave empty to allow all IPs (NOT recommended for production)
# Examples:
#   Single IP: ALLOWED_IPS=203.0.113.50
#   Multiple IPs: ALLOWED_IPS=203.0.113.50,198.51.100.25
#   CIDR range: ALLOWED_IPS=192.168.1.0/24
#   Mix: ALLOWED_IPS=203.0.113.50,192.168.1.0/24,10.0.0.0/8
ALLOWED_IPS=

# Enable GitHub Actions IP ranges (automatically whitelists GitHub's IPs)
# Set to 'true' to allow GitHub Actions to access your API
# Updates every 24 hours automatically
ENABLE_GITHUB_IP_RANGES=false

# Trusted Proxy Configuration
# Specify the IP of your reverse proxy (Nginx Proxy Manager, Traefik, etc.)
# Default: only localhost (127.0.0.1, ::1)
# Note: The actual client IP is extracted from X-Forwarded-For header
# Examples:
#   Docker networks: TRUSTED_PROXY_IP=172.16.0.0/12
#   Single proxy: TRUSTED_PROXY_IP=172.18.0.5
#   Multiple proxies: TRUSTED_PROXY_IP=172.18.0.5,192.168.1.10
TRUSTED_PROXY_IP=

# CORS Configuration
# IMPORTANT: Update this for production deployments
CORS_ALLOWED_ORIGINS=http://localhost:3000

# Vaultwarden Configuration - REQUIRED
# URL of your Vaultwarden instance (no trailing slash)
VAULTWARDEN_URL=https://vault.yourdomain.com

# Authentication - Choose ONE method:
# Method 1: API Key (Recommended - bypasses 2FA, auto-login on startup)
# Get your API key from: Account Settings -> Security -> Keys -> View API Key
VAULTWARDEN_CLIENT_ID=user.xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx
VAULTWARDEN_CLIENT_SECRET=xxxxxxxxxxxxxxxxxxxxxxxxxxxx
VAULTWARDEN_PASSWORD=your-master-password

# Method 2: Pre-generated session token (Alternative - will expire)
# VAULTWARDEN_ACCESS_TOKEN=your-session-token-here

# Performance & Caching
# How long to cache secrets in memory (reduces API calls)
# Set to 0 to disable caching (more secure but slower)
CACHE_TTL=5m

# Timeouts
READ_TIMEOUT=10s
WRITE_TIMEOUT=10s