# Fresh MariaDB 11.4.13+ installation; read docs/spaceship-supreme.md before use.
# Deployment profile: standard (MySQL + Redis + daemons) or spaceship (MariaDB + bounded cron).
HOSTING_PROFILE=spaceship
DATABASE_DIALECT=mariadb
# Telegram Task Earning — Phase 16 environment template
# Copy this file to .env only in a secure deployment environment.
# Replace every replace-* and example value before starting the application.

# Application
NODE_ENV=production
APP_ORIGIN=https://app.example.com
APP_HOST=127.0.0.1
PORT=3000
TRUST_PROXY=loopback
SHUTDOWN_TIMEOUT_MS=10000

# MySQL
DATABASE_HOST=127.0.0.1
DATABASE_PORT=3306
DATABASE_NAME=telegram_task_earning
DATABASE_USER=telegram_task_user
DATABASE_PASSWORD=replace-with-database-password
DATABASE_CONNECTION_LIMIT=3
DATABASE_QUEUE_LIMIT=30
DATABASE_CONNECT_TIMEOUT_MS=10000
DATABASE_IDLE_TIMEOUT_MS=60000
DATABASE_TIMEZONE=Z
DATABASE_SSL_MODE=preferred

# Redis
REDIS_ENABLED=false
REDIS_URL=redis://:replace-with-redis-password@127.0.0.1:6379/0
REDIS_KEY_PREFIX=tge:
REDIS_CONNECT_TIMEOUT_MS=5000
REDIS_MAX_RETRIES_PER_REQUEST=3
REDIS_TLS_REJECT_UNAUTHORIZED=true

# Queue
QUEUE_PREFIX=tge
QUEUE_CONCURRENCY=1
QUEUE_MAX_ATTEMPTS=5
QUEUE_BACKOFF_DELAY_MS=1000
QUEUE_POLL_INTERVAL_MS=1000
QUEUE_BATCH_SIZE=1
QUEUE_LEASE_SECONDS=60
QUEUE_REMOVE_COMPLETE_AFTER_SECONDS=86400
QUEUE_REMOVE_FAILED_AFTER_SECONDS=604800
SCHEDULER_POLL_INTERVAL_MS=30000
SCHEDULER_LEASE_SECONDS=60

# Telegram
TELEGRAM_BOT_TOKEN=replace-with-telegram-bot-token
TELEGRAM_BOT_USERNAME=replace_with_bot_username
TELEGRAM_WEBHOOK_SECRET=replace-with-telegram-webhook-secret
TELEGRAM_WEBHOOK_PATH=/webhooks/telegram
TELEGRAM_INIT_DATA_MAX_AGE_SECONDS=300
TELEGRAM_API_BASE_URL=https://api.telegram.org
TELEGRAM_WEB_APP_URL=https://app.example.com

# Sessions
SESSION_SECRET=replace-with-at-least-64-random-characters
SESSION_COOKIE_NAME=tge.sid
SESSION_COOKIE_SECURE=true
SESSION_COOKIE_SAME_SITE=lax
SESSION_IDLE_TTL_SECONDS=3600
SESSION_ABSOLUTE_TTL_SECONDS=86400
ADMIN_SESSION_IDLE_TTL_SECONDS=1800
ADMIN_SESSION_ABSOLUTE_TTL_SECONDS=43200
SESSION_ROLLING=true

# Cryptography and request security
ENCRYPTION_MASTER_KEY=replace-with-base64-32-byte-key
APP_KEY_VERSION=key-v1
CSRF_SECRET=replace-with-at-least-32-random-characters
PASSWORD_PEPPER=replace-with-at-least-32-random-characters
IDEMPOTENCY_HMAC_KEY=replace-with-at-least-32-random-characters
HEALTH_CHECK_TOKEN=replace-with-at-least-32-random-characters
CORS_ALLOWED_ORIGINS=https://app.example.com
CSP_FRAME_ANCESTORS="'self',https://web.telegram.org"
URL_ALLOWED_SCHEMES=https,tg
URL_ALLOWED_DOMAINS=
ADMIN_ALLOWED_IPS=
RATE_LIMIT_STORE=database
RATE_LIMIT_WINDOW_MS=60000
RATE_LIMIT_GLOBAL_MAX=120
RATE_LIMIT_AUTH_MAX=10
RATE_LIMIT_SENSITIVE_MAX=20
CSRF_TOKEN_TTL_SECONDS=7200
REQUEST_BODY_LIMIT=64kb

# Uploads and media
UPLOAD_ROOT=./storage
UPLOAD_PUBLIC_SUBDIR=public
UPLOAD_PRIVATE_SUBDIR=private
UPLOAD_QUARANTINE_SUBDIR=quarantine
UPLOAD_MAX_BYTES=5242880
UPLOAD_IMAGE_MAX_PIXELS=20000000
UPLOAD_ALLOWED_IMAGE_MIME_TYPES=image/jpeg,image/png,image/webp
MEDIA_PUBLIC_BASE_PATH=/media

# Logging and monitoring
LOG_LEVEL=info
LOG_FORMAT=json
LOG_DIRECTORY=./storage/logs
LOG_RETENTION_DAYS=30
LOG_REQUEST_BODY=false
LOG_RESPONSE_BODY=false
SENTRY_DSN=
SENTRY_ENVIRONMENT=

# One-time Super Admin bootstrap; set only while running `npm run admin:create`.
# Remove these values immediately after the first administrator is created.
ADMIN_BOOTSTRAP_EMAIL=
ADMIN_BOOTSTRAP_PASSWORD=
ADMIN_BOOTSTRAP_TOTP_REQUIRED=true