# Public endpoint assigned to this stack. Caddy obtains TLS certificates for
# DOMAIN automatically when it terminates TLS itself.
DOMAIN=game.example.com
PUBLIC_SCHEME=https
ACME_EMAIL=admin@example.com
# Set http://DOMAIN when an external reverse proxy terminates TLS.
CADDY_SITE_ADDRESS=
HTTP_PORT=80
HTTPS_PORT=443

# Current local E2E ingress example (do not use dev-sam2026.hided.net here):
# DOMAIN=dev-sam-e2e.hided.net
# PUBLIC_SCHEME=https
# CADDY_SITE_ADDRESS=http://dev-sam-e2e.hided.net
# HTTP_PORT=14999
# HTTPS_PORT=15099

# Runtime hard limits. Keep swap equal to memory so the container cannot consume host swap.
RUNTIME_MEMORY_LIMIT=4g
RUNTIME_MEMORY_SWAP_LIMIT=4g
RUNTIME_CPU_LIMIT=4
RUNTIME_PIDS_LIMIT=256
# Bound Node/Rolldown build parallelism inside the runtime container.
RUNTIME_NODE_OPTIONS=--max-old-space-size=1536
# Optional turn-daemon-only heap. Raise the runtime memory hard limit first.
TURN_DAEMON_NODE_OPTIONS=--max-old-space-size=1536
RUNTIME_RAYON_NUM_THREADS=1
# Optional smoke-only limits used with compose.smoke.yaml (maximum supported defaults shown).
# SMOKE_RUNTIME_MEMORY_LIMIT=4g
# SMOKE_RUNTIME_MEMORY_SWAP_LIMIT=4g
# SMOKE_RUNTIME_CPU_LIMIT=4
# SMOKE_RUNTIME_PIDS_LIMIT=256

# Core2026 source. A public HTTPS URL needs no extra credential.
CORE_REPOSITORY_URL=https://github.com/your-org/core2026.git
CORE_BOOTSTRAP_REF=main

# Optional private repository authentication. Keep only one mode enabled.
# HTTPS mode uses a read-only token through GIT_ASKPASS and never embeds it in the URL.
CORE_REPOSITORY_USERNAME=
CORE_REPOSITORY_TOKEN=
# SSH mode accepts base64-encoded deploy key and known_hosts contents.
CORE_SSH_PRIVATE_KEY_BASE64=
CORE_SSH_KNOWN_HOSTS_BASE64=

# Development bind override (used only with compose.dev.yaml).
# CORE_DEV_PATH=../core2026
# DEV_UID=1000
# DEV_GID=1000
# DEV_RUNTIME_MEMORY_LIMIT=4g
# DEV_RUNTIME_MEMORY_SWAP_LIMIT=4g
# DEV_RUNTIME_CPU_LIMIT=4
# DEV_RUNTIME_PIDS_LIMIT=256

# Persistent services. Use long random values; do not commit .env.
POSTGRES_DB=sammo
POSTGRES_USER=sammo
POSTGRES_PASSWORD=replace-with-a-long-random-database-password
REDIS_PASSWORD=replace-with-a-long-random-redis-password
GAME_TOKEN_SECRET=replace-with-at-least-32-random-bytes
GATEWAY_BOOTSTRAP_TOKEN=replace-with-a-separate-random-bootstrap-token

# The first startup creates this superuser only when the user table is empty.
INITIAL_ADMIN_USERNAME=admin
INITIAL_ADMIN_PASSWORD=replace-with-a-long-random-admin-password
INITIAL_ADMIN_DISPLAY_NAME=Administrator

# Kakao Developers app values. Register https://DOMAIN/gateway/oauth/callback.
KAKAO_REST_KEY=replace-with-kakao-rest-api-key
KAKAO_ADMIN_KEY=

# Account policy and optional compatibility secret.
GATEWAY_LOCAL_REGISTRATION_ENABLED=true
GATEWAY_ADMIN_LOCAL_ACCOUNT_ENABLED=true
GATEWAY_LOCAL_ACCOUNT_GRACE_DAYS=7
GATEWAY_LEGACY_PASSWORD_GLOBAL_SALT=

# Shared image service. The two secret files must contain the values configured
# for the core2026 caller on the image server and must not be committed.
IMAGE_SERVICE_URL=https://sam-image.hided.net
IMAGE_PUBLIC_URL=https://sam-image.hided.net
IMAGE_UPLOAD_CORE2026_SECRET_FILE=./secrets/image_upload_core2026_secret
IMAGE_SYNC_CORE2026_SECRET_FILE=./secrets/image_sync_core2026_secret

# Initial stopped profile inventory. Each deployment can choose its own branch in the Admin GUI.
BOOTSTRAP_PROFILES=gateway,che,kwe,pwe,twe,nya,pya,hwe
TZ=Asia/Seoul