.env.example

# -- Required -------------------------------------------------------------------
# Generate a strong random key: python3 -c "import secrets; print(secrets.token_hex(32))"
SECRET_KEY=changeme-please-set-me

# Admin login credentials for the web UI
ADMIN_USER=admin
ADMIN_PASSWORD=changeme

# JWT session duration in hours
TOKEN_TTL_HOURS=8

# Audit log retention in days (entries older than this are pruned on startup)
AUDIT_RETENTION_DAYS=7

# -- Optional -------------------------------------------------------------------
ENVIRONMENT="CloudShell on IU2FRL server" # Used to distinguish TOTP tokens

# Data directory — SQLite DB and encrypted SSH keys are stored here.
# When running via Docker Compose this is managed by a named volume;
# set this only when running the backend directly on the host.
# DATA_DIR=/data

# CORS allowed origins for the backend API.
# In production set this to your public frontend URL, e.g. https://cloudshell.example.com
# Leave unset when using Docker Compose (Nginx proxies everything on the same origin).
# CORS_ORIGINS=https://cloudshell.example.com

# Comma-separated reverse-proxy peer IPs trusted to provide X-Forwarded-For/X-Real-IP.
# Keep unset unless backend is behind a trusted proxy and you know its source IP(s).
# TRUSTED_PROXIES=127.0.0.1,::1