.env.example

# RedPaste configuration example. Copy to `.env` and adjust. All REDPASTE_* vars
# are validated at startup; production fails fast on unsafe values.

# ── Core ────────────────────────────────────────────────────────────────────
REDPASTE_ENV=development                     # development | production
REDPASTE_BASE_URL=http://localhost:8080      # canonical public origin (https in prod)
REDPASTE_SHORT_BASE_URL=                     # first-party short-link origin (defaults to BASE_URL)
REDPASTE_LISTEN_ADDR=:8080

# ── Storage (leave DATABASE_URL empty to use the embedded SQLite default) ─────
REDPASTE_DATABASE_URL=                       # e.g. postgres://user:pass@localhost:5432/redpaste
REDPASTE_SQLITE_PATH=redpaste.db
REDPASTE_REDIS_URL=                          # optional, for multi-instance production

# ── Security ─────────────────────────────────────────────────────────────────
# Capability/token HMAC pepper. MUST be >= 32 bytes in production. Generate with:
#   openssl rand -hex 32
REDPASTE_SERVER_PEPPER=
REDPASTE_TRUSTED_PROXY_CIDRS=                # e.g. 127.0.0.1/32,10.0.0.0/8

# ── Limits & retention (hard max 4320h = 180 days) ───────────────────────────
REDPASTE_MAX_PASTE_BYTES=3145728              # 3 MiB
REDPASTE_MAX_CIPHERTEXT_BYTES=4718592         # 4.5 MiB (3 MiB * 1.5 for encryption/encoding overhead)
REDPASTE_MAX_INFLIGHT=512                     # global concurrent-request cap (load shedding)
REDPASTE_MAX_RETENTION_HOURS=4320
REDPASTE_DEFAULT_STATIC_RETENTION_HOURS=168
REDPASTE_DEFAULT_LIVE_RETENTION_HOURS=24

# ── Live collaboration ───────────────────────────────────────────────────────
REDPASTE_ENABLE_LIVE=true
REDPASTE_LIVE_MAX_PARTICIPANTS=8
REDPASTE_LIVE_MAX_UPDATE_BYTES=65536           # 64 KiB, single CRDT update cap
REDPASTE_LIVE_MAX_STORAGE_BYTES=20971520       # 20 MiB, total stored bytes per room
REDPASTE_STUN_URLS=
REDPASTE_TURN_URLS=
REDPASTE_TURN_SECRET=

# ── Short links ──────────────────────────────────────────────────────────────
REDPASTE_ENABLE_SHORT_LINKS=true

# ── Observability ────────────────────────────────────────────────────────────
REDPASTE_LOG_LEVEL=info
REDPASTE_METRICS_ADDR=127.0.0.1:9091         # private metrics listener (empty = off)

# ── Private automation API (kept out of the public repo; disabled by default) ─
REDPASTE_PRIVATE_API_ENABLED=false
REDPASTE_PRIVATE_API_LISTEN_ADDR=127.0.0.1:9090
REDPASTE_PRIVATE_API_ALLOWED_CIDRS=
REDPASTE_PRIVATE_API_REQUIRE_MTLS=false
REDPASTE_PRIVATE_API_TOKEN_HASHES_FILE=
# Note: the private API only exists in builds made with `-tags privateapi`.
# A normal (public) build links a no-op stub. See docs/private-api.