# MrJuneJune Server Configuration — DEVELOPMENT TEMPLATE
#
# This file is a copyable filler only.  It contains no real secrets, hashes,
# or credentials.  Copy it to .config (which is VCS-ignored) and fill in your
# local values before starting the server.
#
#   cp mrjunejune/.config.development mrjunejune/.config
#
# ─────────────────────────────────────────────────────────────────────────────
# Auth token for S3 upload API
# Client must send: Authorization: Bearer <token>
UPLOAD_AUTH_TOKEN=REPLACE_WITH_LOCAL_TOKEN

# S3 Configuration
S3_REGION=REPLACE_WITH_REGION
S3_BUCKET=REPLACE_WITH_BUCKET

# Presigned URL expiration (seconds)
S3_URL_EXPIRES=3600

# ─────────────────────────────────────────────────────────────────────────────
# This is the authoritative runtime configuration source for the server and
# inference stack. Normal Bazel workflows require no shell exports. Environment
# values are used only for tests, backwards compatibility when no config file is
# present, and internal supervisor-to-child wiring. Never commit real values.
#
# AUTH_COOKIE_SECRET
#   A cryptographically random 32-byte secret encoded as a lowercase hex string
#   (64 hex chars).  Used to sign session and guest cookies via HMAC-SHA-256.
#   Generate with:
#     openssl rand -hex 32
#   Minimum: 64 hex chars (32 bytes).  Maximum: 2048 hex chars (1024 bytes).
AUTH_COOKIE_SECRET=REPLACE_WITH_OUTPUT_OF_openssl_rand_hex_32

# AUTH_BOOTSTRAP_USERNAME / AUTH_BOOTSTRAP_PASSWORD_HASH
#   Creates the initial admin account on first startup if no admin exists yet.
#   Both must be set together, or both must be absent.
#   Generate the hash with:
#     bazel run //auth:hash_password
#   Then enter the desired bootstrap password at the prompt.
#   Example format (do not use this value — it is a public test fixture):
#     zenbu-scrypt$v=1$N=32768$r=8$p=1$<salt>$<hash>
AUTH_BOOTSTRAP_USERNAME=admin
AUTH_BOOTSTRAP_PASSWORD_HASH=REPLACE_WITH_OUTPUT_OF_bazel_run_//auth:hash_password

# AUTH_TRUSTED_PROXY
#   Exact direct-peer IP address of your reverse proxy (e.g. nginx/Caddy).
#   When set, the server trusts X-Real-IP from this peer for client-IP binding.
#   Leave commented out if the server receives direct connections.
#   Must be a valid IPv4 or IPv6 address.
# AUTH_TRUSTED_PROXY=10.0.0.1

# AUTH_SESSION_IDLE_TTL / AUTH_SESSION_ABS_TTL
#   Idle TTL: seconds since last request before a session expires (default 7 d).
#   Abs TTL: absolute session lifetime regardless of activity (default 30 d).
#   Idle must not exceed Abs.  Both must be 60–31536000.
# AUTH_SESSION_IDLE_TTL=604800
# AUTH_SESSION_ABS_TTL=2592000

# AUTH_GUEST_TTL
#   Lifetime of a guest identity record in seconds (default 30 d).
# AUTH_GUEST_TTL=2592000

# AUTH_DEV_INSECURE_COOKIE
#   Set to true to issue cookies without the Secure attribute.
#   ONLY valid when SERVER_HOST is a loopback address (127.0.0.1, ::1, or localhost).
#   Must NOT be set in production or on a non-loopback bind.
AUTH_DEV_INSECURE_COOKIE=true

# ─────────────────────────────────────────────────────────────────────────────
# SERVER_HOST
#   IP address the server listens on.  Defaults to 0.0.0.0 (all interfaces).
#   For local development, set to 127.0.0.1 — required when
#   AUTH_DEV_INSECURE_COOKIE=true.
#   In production, either leave unset (0.0.0.0) or set to a specific interface.
SERVER_HOST=127.0.0.1

# ─────────────────────────────────────────────────────────────────────────────
# Inference stack
# The local stack generates and persists LITELLM_MASTER_KEY into the ignored
# .config on the first live run if this is left empty.
LITELLM_MASTER_KEY=
LITELLM_HOST=127.0.0.1
LITELLM_PORT=4000
LITELLM_MODEL=jrpg-copilot
LITELLM_WIRE_API=completions
MRJUNEJUNE_ALLOW_GUEST_INFERENCE=false
# GITHUB_COPILOT_TOKEN_DIR=/absolute/path/to/litellm-copilot
# MRJUNEJUNE_INFERENCE_STATE=/absolute/path/to/inference-state
#
# Guest inference quota
# These integer values control per-guest rate limits.
# Malformed or out-of-range values cause startup failure.
# AUTH_GUEST_DAILY_TURNS=10
# AUTH_GUEST_DAILY_OUTPUT_TOKENS=20000
# AUTH_GUEST_REQUEST_OUTPUT_TOKENS=2048

# ─────────────────────────────────────────────────────────────────────────────
# OPERATIONAL NOTES
#
# Bootstrap password rotation:
#   After the bootstrap admin logs in for the first time, change the password
#   via the /account/password page.  To rotate the bootstrap credential itself:
#   1. Generate a new hash:  bazel run //auth:hash_password
#   2. Update AUTH_BOOTSTRAP_PASSWORD_HASH in .config.
#   3. Use Admin_API or SQL to reset the stored hash for the admin user.
#      (Bootstrap only creates the user on first startup when no admin exists.)
#
# Guest data retention:
#   Guest identity rows accumulate in the auth SQLite database.  Rows expire
#   after AUTH_GUEST_TTL seconds from last activity.  Auth_Store automatically
#   skips expired rows on reads; periodic cleanup of very old rows can be done
#   with: DELETE FROM guest_identities WHERE expires_at < strftime('%s','now');
#   Run this against the auth database (DB_PATH, default mrjunejune/data/).
#
# Secure cookie policy:
#   Production deployments must NOT set AUTH_DEV_INSECURE_COOKIE=true.
#   Ensure your reverse proxy terminates TLS and forwards via SERVER_HOST.
#   The Secure cookie attribute is enforced automatically on non-loopback hosts.