# OpenVibe.Rent — environment (production: /etc/openvibe/rent.env). Names only; never commit values.

NODE_ENV=production
PORT=5010
HOST=127.0.0.1
BASE_URL=https://openvibe.rent
# IndexNow: with a key (8–128 letters and digits), pages Search gains or changes are sent to search engines and the
# key is served at /<key>.txt. Unset: off.
#INDEXNOW_KEY=
TRUST_PROXY=2
# PostgreSQL (ADR-035), written by OpenVibe.Host roles/data/add-service.sh rent: the runtime role through PgBouncer,
# the owner on a direct connection (migrations), and Valkey (shared limit counters).
# Without DATABASE_URL, development uses an embedded PGlite database in data/pglite.
DATABASE_URL=
DATABASE_DIRECT_URL=
# development only: where the embedded PGlite database lives (default data/pglite)
#RENT_PGLITE_DIR=
VALKEY_URL=
VALKEY_PREFIX=ov:rent:
# Per-caller limits (server/http/caller-limits.js): requests one caller may make to the API per minute and per hour.
#RENT_LIMITS_MINUTE=120
#RENT_LIMITS_HOUR=3000
# Requests one address may make to the API and to the pages per minute (server/app.js). The product's own budgets
# for posting, reporting, renewing and saving a search are in server/http/caller-limits.js, not here.
#RENT_API_RATE_LIMIT_PER_MIN=240
#RENT_RATE_LIMIT_PER_MIN=300

# OpenVibe.Network: SSO (OAuth client `rent`, PKCE S256) and its JWKS; app tokens for audience openvibe.rent.
OV_NETWORK_URL=https://openvibe.network
OV_NETWORK_INTERNAL_URL=http://127.0.0.1:4000
OV_OAUTH_CLIENT_ID=rent
OV_OAUTH_CLIENT_SECRET=
# OV_OAUTH_REDIRECT_URI=https://openvibe.rent/auth/callback
# RENT_AUDIENCE=openvibe.rent

# OpenVibe.Events → Rent (ADR-033 account export and deletion): the secret signs a delivery (comma-separated for
# rotation, 32+ characters each; unset makes POST /internal/events answer 503); the url is where the two subscriptions
# are created at boot (off when unset); RENT_EVENTS_SUBSCRIBE=0 turns that off.
RENT_EVENTS_SECRET=
RENT_EVENTS_URL=
# OpenVibe.AI for the listing screen (server/listings/screen.js): each posted or edited listing is screened for the signs of a
# rental scam, for staff (needs OV_OAUTH_CLIENT_SECRET too). Unset: off.
#OV_AI_INTERNAL_URL=http://127.0.0.1:4700
#RENT_EVENTS_ENDPOINT=http://127.0.0.1:5010/internal/events

# optional: defaults to true in production
# COOKIE_SECURE=true