# Copy this file to .env and fill in real values.
#   cp .env.example .env

# Port the server listens on
PORT=3000

# Environment. "production" hardens defaults (generic 5xx messages, no stack
# traces, /_dev dashboard NOT loaded, Secure cookies). Use "development" locally.
# NOTE: rate limiting is ON whenever NODE_ENV is not "development" — an unset
# NODE_ENV in a deploy is still throttled (an unset value never means "no limits").
NODE_ENV=development

# Rate limiting — window length (ms) + max requests per IP per window.
# RATE_LIMIT_WINDOW_MS = 900000 is 15 minutes.
RATE_LIMIT_WINDOW_MS=900000
RATE_LIMIT_MAX=500

# ── Bonjour / mDNS service discovery ──
# The app advertises itself on the local network so other devices can find it by
# name (http://<host>.local:<port>) without hard-coded IPs. On by default.
# BONJOUR_ENABLED: "off" disables advertising entirely.
# BONJOUR_NAME:    custom service name shown to other devices (default: app + host).
# BONJOUR_TYPE:    service type without the leading underscore (default: "http").
# BONJOUR_ENABLED=off
# BONJOUR_NAME=My App
# BONJOUR_TYPE=http

# ── Dev dashboard (/_dev) — a REMOTE-CODE-EXECUTION surface; keep it local-only ──
# _4BNODE_DASHBOARD:    "on" force-enable (even in production — avoid); "off" disable.
#                       Default: enabled only when NODE_ENV is not "production".
# _4BNODE_ALLOW_REMOTE: "1" allows non-loopback access (a passkey becomes mandatory).
#                       Leave unset. Always also block /_dev* at your edge proxy in
#                       any hosted environment.
# _4BNODE_DASHBOARD=off
# _4BNODE_ALLOW_REMOTE=1