# Copy this file to .env for local development. Existing process variables win.
# Keep real secrets out of source control; .env is ignored by Git and Docker.
# Request limits must be positive. Invalid values fail server startup.
# Listener IP and port. Loopback limits access to this machine.
# Use 0.0.0.0:3000 inside a container; the Dockerfile already sets that default.
BIND_ADDRESS=127.0.0.1:3000
# tracing filter: info in production; debug temporarily when diagnosing issues.
# Module-specific example: info,my_api::user=debug (use your Rust crate name).
RUST_LOG=info
# Handler deadline in seconds (1..3600); expiration returns HTTP 504.
# Covers work until response headers, not the lifetime of a streaming response.
REQUEST_TIMEOUT_SECONDS=30
# Maximum request-drain time after Ctrl-C/SIGTERM, in seconds (1..300).
# Set the container/orchestrator stop grace longer than this value.
SHUTDOWN_GRACE_SECONDS=10
# Request body limit in bytes (1..1073741824); 1048576 is 1 MiB.
# Oversized declared or consumed bodies are rejected with HTTP 413.
BODY_LIMIT_BYTES=1048576
# Concurrent handler limit (1..100000); excess work returns HTTP 503.
# Health probes bypass this limit so overload does not block liveness checks.
MAX_IN_FLIGHT_REQUESTS=256
# Requests allowed per socket peer IP per fixed window (1..4294967295).
# Quota rejections return HTTP 429 with Retry-After. This is per server process.
# Forwarded IP headers are ignored; a reverse proxy shares one peer-IP quota.
RATE_LIMIT_REQUESTS=60
# Fixed-window duration in seconds (1..86400).
RATE_LIMIT_WINDOW_SECONDS=60
# Maximum remembered client IPs (1..1000000), bounding limiter memory.
# Expired entries are reclaimed at capacity; active quota counters are retained.
RATE_LIMIT_MAX_CLIENTS=10000
# CORS list values are JSON arrays of strings, single-quoted for dotenv parsing.
# Exact browser origins; [] disables cross-origin browser access.
# Example: CORS_ORIGINS='["https://example.com","http://localhost:5173"]'
# Do not use *, paths, trailing slashes, or embedded credentials.
CORS_ORIGINS='[]'
# Uppercase methods allowed during browser preflight checks; restrict to API needs.
CORS_ALLOWED_METHODS='["GET","POST","PUT","PATCH","DELETE","HEAD","OPTIONS"]'
# Request headers permitted in cross-origin requests; [] denies custom headers.
CORS_ALLOWED_HEADERS='["content-type","authorization"]'
# Response headers browser JavaScript may read beyond the CORS-safelisted headers.
CORS_EXPOSE_HEADERS='["x-request-id","retry-after"]'
# Browser cookies/credentials. true requires at least one explicit allowed origin.
# Authentication and CSRF protections still belong to the application.
CORS_ALLOW_CREDENTIALS=false
# Browser preflight cache lifetime, in seconds (0..86400); 0 disables caching.
CORS_MAX_AGE_SECONDS=600
# Serve Swagger UI at /docs and OpenAPI JSON at /docs/openapi.json.
# Set false to disable both routes. No external CDN is required.
SWAGGER_ENABLED=true