.env.example

# Example environment for the stateless public surface (/v1/insights,
# /v1/plot/validate, /v1/healthz). Copy to ``.env`` and edit. Variables not
# listed here use the defaults baked into bhulan/config/settings.py.

# ----- Public web app ------------------------------------------------------
# Comma-separated CORS allowlist. "*" is fine for local dev; for a real
# deployment, list explicit origins (e.g. "https://bhulan.example.com").
# When this is "*" the server auto-sets allow_credentials=false because
# browsers reject "*" + credentials.
ALLOWED_ORIGINS=*

# Per-IP rate limits in slowapi syntax. Empty disables the limit.
RATE_LIMIT_INSIGHTS=30/minute
RATE_LIMIT_PLOT=60/minute

# Reverse-proxy allowlist for X-Forwarded-For handling. Use "*" to trust any
# peer (only safe if the app is not reachable except via the proxy). Empty
# means never trust the header — keys off the direct TCP peer.
TRUSTED_PROXIES=

# Where the built Vite SPA lives, relative to the process cwd (or absolute).
# If the directory is missing, the API still works but "/" is unmounted.
WEB_DIST_DIR=web/dist

# ----- Ingestion subsystem (optional; only used by /ingest, /jobs) --------
# MONGO_URI=mongodb://localhost:27017
# MONGO_DB_NAME=bhulan
# API_KEY=

# ----- Process -------------------------------------------------------------
# API_HOST=0.0.0.0
# API_PORT=8000
# LOG_LEVEL=INFO