# ═══════════════════════════════════════════════════════════════
# openvibe.services — Environment Configuration
# Copy to .env for development. In production this lives at /etc/openvibe/services.env (0600).
# Names only here; never commit a value.
# ═══════════════════════════════════════════════════════════════

# Server
PORT=4930
HOST=127.0.0.1
NODE_ENV=development
BASE_URL=http://localhost:4930
# Cloudflare and nginx sit in front in production.
TRUST_PROXY=2

# ── Data: PostgreSQL (ADR-035) ──────────────────────────────
# Host's roles/add-service.sh writes both in production. Unset in development: an embedded PGlite
# database in data/pglite (one process). Tests need neither.
DATABASE_URL=
DATABASE_DIRECT_URL=

# ── Identity: OpenVibe.Network ──────────────────────────────
OV_NETWORK_URL=https://openvibe.network
# The origin Services asks about project membership (GET /api/v1/projects/:project, with the caller's
# own user token) and reads the signing key from (GET /api/.well-known/jwks).
OV_NETWORK_INTERNAL_URL=http://127.0.0.1:4000
#OV_NETWORK_ISSUER=https://openvibe.network
# Audience Services answers for: incoming service tokens must carry it.
SERVICES_AUDIENCE=openvibe.services
# Services' own Network client `services`: sign-in (authorization code + PKCE, redirect
# BASE_URL/auth/callback), the events relay, and one client-credentials token per authority audience
# (openvibe.network, openvibe.media, …) for the index. Unset in development: nobody can sign in, events wait
# in the outbox, and every authority that requires a token is reported partial (ADR-046 section 6).
OV_OAUTH_CLIENT_ID=services
OV_OAUTH_CLIENT_SECRET=
#OV_OAUTH_REDIRECT_URI=https://openvibe.services/auth/callback
COOKIE_SECURE=false
# Signs the per-person form token (CSRF). Required in production; unset in development: a random key per process.
SERVICES_FORM_SECRET=
# Staff who set trust tiers (besides Network admins holding staff.site.configure): usr_ subjects, comma-separated.
SERVICES_STAFF_SUBJECTS=

# ── Valkey (ADR-035): per-actor limit counters; optional ────
VALKEY_URL=
VALKEY_PREFIX=ov:services:
#SERVICES_LIMITS_MINUTE=120
#SERVICES_LIMITS_HOUR=3000

# ── Playgrounds and the project archive ─────────────────────
# Playgrounds call Events and Media with the APP's own token; the defaults are the public origins in the
# pinned contracts. The archive reads Media and Events on loopback with Network's read-only export tokens.
#SERVICES_PLAYGROUND_EVENTS_URL=https://openvibe.events
#SERVICES_PLAYGROUND_MEDIA_URL=https://openvibe.media
#SERVICES_PLAYGROUND_MAX_UPLOAD_BYTES=1048576
#SERVICES_PLAYGROUND_RUNS_PER_HOUR=60
#SERVICES_EXPORT_MEDIA_URL=http://127.0.0.1:4100
#SERVICES_EXPORT_EVENTS_URL=http://127.0.0.1:4300
#SERVICES_REGISTRY_TTL_MS=30000

# ── Search engines ──────────────────────────────────────────
# IndexNow: with a key, public release changes ping the engines and /<key>.txt is served. Unset: off.
INDEXNOW_KEY=

# ── The authorities (plan T13 step 6) ───────────────────────
# An authority is a service whose pinned openvibe-contracts manifest lists <id>.resource.read as
# active; its loopback origin comes from that manifest. SERVICES_<ID>_URL overrides one for the
# operator (the id uppercased, '-' -> '_'):
#SERVICES_NETWORK_URL=http://127.0.0.1:4000
#SERVICES_MEDIA_URL=http://127.0.0.1:4100
#SERVICES_EVENTS_URL=http://127.0.0.1:4300
#SERVICES_HOST_URL=http://127.0.0.1:4910

# ── The resource index ──────────────────────────────────────
# The per-authority page size the fan-out asks for, how many authorities are read at once, and how long
# one authority may take before its rows are omitted and it is named in X-OpenVibe-Partial-Authorities.
SERVICES_INDEX_PAGE_SIZE=100
SERVICES_INDEX_CONCURRENCY=4
SERVICES_INDEX_TIMEOUT_MS=5000
# The caller-facing page size: default and ceiling.
SERVICES_INDEX_DEFAULT_LIMIT=100
SERVICES_INDEX_MAX_LIMIT=1000
# How long the membership question to Network may take before the person-facing path answers 503.
SERVICES_NETWORK_TIMEOUT_MS=5000

# ── OpenVibe.Events ─────────────────────────────────────────
# The outbox relay publishes services.app.published|deprecated|revoked and services.moderation.action with
# Services' own service token. Without EVENTS_URL (or the OAuth secret) events wait in services_events_outbox.
EVENTS_URL=
#SERVICES_EVENTS_ENABLED=1
#EVENTS_RELAY_INTERVAL_MS=2000
# OpenVibe.Events → Services (ADR-033 account export and deletion): signs a delivery to POST /internal/events
# (comma-separated for rotation, 32+ characters each). Unset: the route answers 503 and no subscription is created.
#SERVICES_EVENTS_SECRET=