# Flask Configuration
FLASK_ENV=development

# IMPORTANT: Generate secure keys for production!
# Run: python -c "import secrets; print(secrets.token_hex(32))"
SECRET_KEY=change-this-to-a-secure-random-string

# Database
DATABASE_URL=sqlite:///serverkit.db

# JWT Configuration
# IMPORTANT: Generate a unique key for production!
# Run: python -c "import secrets; print(secrets.token_hex(32))"
JWT_SECRET_KEY=change-this-to-another-secure-random-string

# CORS - comma-separated list of allowed origins
CORS_ORIGINS=http://localhost:41921,http://127.0.0.1:41921,http://localhost:47927,http://127.0.0.1:47927

# Server
PORT=47927

# Trusted reverse proxy (client IP)
# Default OFF for local dev: run.py is directly exposed with no proxy, so an
# X-Forwarded-For header would be client-forgeable and must NOT be trusted.
# In production the panel sits behind its bundled nginx — set this to true there
# (the shipped .env.example does) so ServerKit derives the real client IP via
# ProxyFix for rate-limiting / login lockout / audit logs. TRUSTED_PROXY_HOPS is
# the number of proxies in front of Flask (bundled nginx = 1).
# TRUST_PROXY_HEADERS=false
# TRUSTED_PROXY_HOPS=1

# Login brute-force throttle (per client IP), on top of per-user lockout.
# Defaults shown; uncomment to tune.
# AUTH_IP_MAX_ATTEMPTS=10
# AUTH_IP_WINDOW_MINUTES=15
# AUTH_IP_BLOCK_MINUTES=15

# Security - Agent API Secret Encryption
# IMPORTANT: Generate a unique key for production!
# Run: python -c "from cryptography.fernet import Fernet; print(Fernet.generate_key().decode())"
# Or: python -c "import base64; import os; print(base64.urlsafe_b64encode(os.urandom(32)).decode())"
SERVERKIT_ENCRYPTION_KEY=  # Generate with: python -c "from cryptography.fernet import Fernet; print(Fernet.generate_key().decode())"

# GitHub Repository for agent releases (owner/repo format)
# This is used to fetch the latest agent version for the downloads page
SERVERKIT_GITHUB_REPO=jhd3197/ServerKit

# Dev path overrides (uncomment for local development)
# Production defaults are absolute Linux paths (/var/serverkit, /etc/serverkit, etc.)
# SERVERKIT_DIR=./dev-data
# SERVERKIT_CONFIG_DIR=./dev-data/config
# SERVERKIT_LOG_DIR=./dev-data/logs
# SERVERKIT_BACKUP_DIR=./dev-data/backups
# SERVERKIT_CACHE_DIR=./dev-data/cache
# SERVERKIT_QUARANTINE_DIR=./dev-data/quarantine

# Public URL agents should dial back to. Set this whenever the panel sits
# behind a reverse proxy / tunnel / custom domain — the connection string
# the panel issues to agents will embed this URL instead of the request's
# Host header (which would otherwise be the internal IP/port).
# SERVERKIT_PUBLIC_URL=https://panel.your-domain.com

# Security opt-ins & special modes (all default off)
# SERVERKIT_ALLOW_PLUGIN_PIP=false      # let extensions pip-install their requirements
# SERVERKIT_ALLOW_PRIVATE_DOWNLOADS=false  # allow non-HTTPS/private extension downloads
# SERVERKIT_DEMO_MODE=false             # read-only demo panel
# SERVERKIT_DEMO_DEPLOYS=false          # simulated deploys through the real pipeline
# SERVERKIT_STAGING=false               # mark this panel as staging (/health flag)