# Required
DATABASE_URL=postgres:///multithreaded
OAUTH_CLIENT_ID=your-oauth-client-id

# Optional (defaults shown)
MNW_BASE_URL=http://127.0.0.1:3000
OAUTH_REDIRECT_URI=http://127.0.0.1:3400/auth/callback
# Bind loopback by default. Rate limiting trusts X-Forwarded-For, which is only
# safe behind a reverse proxy that OVERWRITES that header (Caddy must set, not
# append, X-Forwarded-For / X-Real-IP). Only set 0.0.0.0 if the port is meant to
# be directly reachable (e.g. a tailnet-direct staging box).
HOST=127.0.0.1
PORT=3400
COOKIE_SECURE=true
RUST_LOG=info

# Platform admin (UUID of the MNW account that can access /_admin)
# PLATFORM_ADMIN_ID=00000000-0000-0000-0000-000000000000

# S3 storage (optional, required for image uploads)
# S3_ENDPOINT=https://s3.us-east-1.amazonaws.com
# S3_BUCKET=mt-uploads
# S3_ACCESS_KEY=your-access-key
# S3_SECRET_KEY=your-secret-key
# S3_REGION=us-east-1

# Internal API shared secret (HMAC-SHA256 auth for MNW → MT calls)
# INTERNAL_SHARED_SECRET=your-shared-secret