APP_DOMAIN=localhost
APP_RELEASE=stable

# If SSL Cert to be generated, set CERT_EMAIl="email <EMAIL_ADDRESS>"
CERT_EMAIL=
CERT_ACME_CA=https://acme-v02.api.letsencrypt.org/directory

SITE_ADDRESS=:80

# For DNS Challenge based certificate generation, set the CERT_ACME_DNS, CERT_EMAIL
# CERT_ACME_DNS="acme_dns <CERT_DNS_PROVIDER> <CERT_DNS_PROVIDER_API_KEY>"
CERT_ACME_DNS=

WEB_URL=http://localhost
DEBUG=0
CORS_ALLOWED_ORIGINS=http://localhost
API_BASE_URL=http://localhost:3004

#DB SETTINGS
DATABASE_URL=

# REDIS SETTINGS
REDIS_URL=

# RabbitMQ Settings
AMQP_URL=

# Secret Key — change this before deploying to production.
# Generate a secure value with: python3 -c "from django.utils.crypto import get_random_secret_key; print(get_random_secret_key())"
# or: openssl rand -hex 32
# The startup script auto-generates and persists a random key on first boot if the
# placeholder value below is left unchanged.
SECRET_KEY=change-this-key-on-deployment

# DATA STORE SETTINGS
USE_MINIO=0
AWS_REGION=
AWS_ACCESS_KEY_ID=
AWS_SECRET_ACCESS_KEY=
AWS_S3_ENDPOINT_URL=https://s3.amazonaws.com
AWS_S3_BUCKET_NAME=
BUCKET_NAME=
FILE_SIZE_LIMIT=5242880

# Gunicorn Workers
GUNICORN_WORKERS=1



# Force HTTPS for handling SSL Termination
MINIO_ENDPOINT_SSL=0

# API key rate limit
API_KEY_RATE_LIMIT=60/minute

# Per-IP throttle for anonymous authentication endpoints (magic-link
# generate / sign-in / sign-up, email sign-in). DRF format: "<n>/<period>"
# where period is second/minute/hour/day.
AUTHENTICATION_RATE_LIMIT=10/minute

# Live Server Secret Key — change this before deploying to production.
# Generate a secure value with: openssl rand -hex 32
# The startup script auto-generates and persists a random key on first boot if the
# placeholder value below is left unchanged.
LIVE_SERVER_SECRET_KEY=change-this-key-on-deployment

# Webhook IP allowlist — comma-separated IPs or CIDR ranges allowed as webhook targets
# even if they resolve to private networks (e.g. "10.0.0.0/8,192.168.1.0/24,172.16.0.5")
WEBHOOK_ALLOWED_IPS=

# Webhook hostname allowlist — comma-separated hostnames that bypass the private-IP
# SSRF check. Useful for trusted internal services whose container/service IPs are
# dynamic (e.g. "silo,silo.namespace.svc.cluster.local")
WEBHOOK_ALLOWED_HOSTS=