# BetterDesk Node.js Console Configuration
# Template for fresh install / merge on update (issue #158).
# Placeholders __NAME__ are substituted by the installer merge-env script.

PORT=5000
HOST=0.0.0.0
NODE_ENV=production
# Console log verbosity: error | warn | info | debug (default: warn in production)
LOG_LEVEL=warn

# RustDesk paths (critical for key/QR code generation)
RUSTDESK_DIR=__RUSTDESK_DIR__
KEYS_PATH=__RUSTDESK_DIR__
PUB_KEY_PATH=__PUB_KEY_PATH__
API_KEY_PATH=__API_KEY_PATH__

# Database (SQLite default; PostgreSQL when DB_TYPE=postgres)
DB_TYPE=__DB_TYPE__
DB_PATH=__DB_PATH__
DATABASE_URL=__DATABASE_URL__

# Auth database location (panel users, sessions — passwords live in auth.db / PostgreSQL)
DATA_DIR=__DATA_DIR__

# Go server HTTP API (REST + RustDesk handlers — canonical port)
GO_API_PORT=__GO_API_PORT__
HBBS_API_URL=__HBBS_API_URL__
BETTERDESK_API_URL=__BETTERDESK_API_URL__

# SMTP (optional — can also be configured in Settings → Email)
SMTP_HOST=
SMTP_PORT=587
SMTP_SECURE=false
SMTP_USER=
SMTP_PASS=
SMTP_FROM=
SMTP_ALERT_EMAIL=
SMTP_TLS_VERIFY=false

# Public panel URL used in notification emails (optional)
PANEL_PUBLIC_URL=

# Public IP or DNS shown in RustDesk client configuration on the dashboard
# when operators open the panel via localhost or an internal hostname (optional)
PANEL_PUBLIC_HOST=

# Public RustDesk client endpoints when console, ID/relay, and API use different hostnames (optional)
# Used for Dashboard client config, QR codes, and deploy strings. Leave empty for auto-detection.
PUBLIC_SERVER_ID=
PUBLIC_RELAY_SERVER=
PUBLIC_API_URL=

# Backward compat: http://host:21121 → proxy to Go
API_ENABLED=true
API_PORT=__API_PORT__
API_HOST=0.0.0.0
RUSTDESK_API_PROXY=true
RUSTDESK_API_TLS=auto

# Server backend (betterdesk = Go server, rustdesk = legacy Rust)
SERVER_BACKEND=betterdesk

# Install-only seed (not used after first admin exists in database — see authService.ensureDefaultAdmin)
DEFAULT_ADMIN_USERNAME=admin
DEFAULT_ADMIN_PASSWORD=__DEFAULT_ADMIN_PASSWORD__

# Session
SESSION_SECRET=__SESSION_SECRET__

# AES-GCM key for org peer credential vault (#367). Prefer a dedicated 32+ char secret.
# If empty, the Go server falls back to JWT_SECRET / stored jwt_secret.
# ORG_PEER_VAULT_KEY=

# RustDesk client login sessions (Issue #242 — also configurable in Settings → Authentication → RustDesk clients)
# Go server reads these on startup; panel updates server_config at runtime via Settings UI.
CLIENT_SESSION_EXPIRY_DAYS=7
CLIENT_SESSION_SLIDING=true
CLIENT_SESSION_MAX_DAYS=30
# Legacy Node client API path only (RUSTDESK_API_PROXY=false):
API_TOKEN_EXPIRY_DAYS=7

# HTTPS (set to true and provide certificate paths to enable)
HTTPS_ENABLED=false
HTTPS_PORT=5443
SSL_CERT_PATH=__SSL_CERT_PATH__
SSL_KEY_PATH=__SSL_KEY_PATH__
SSL_CA_PATH=
HTTP_REDIRECT_HTTPS=true

# Trust reverse proxy (set Y or 1 behind nginx/Caddy; Y works for Node + Go server)
TRUST_PROXY=false
# Comma-separated CIDR/IP allowlist of reverse proxies that may set X-Forwarded-*.
# Required for Go server when TRUST_PROXY=Y — without this, forwarded headers are ignored (#276).
# Example (same-host Nginx/Caddy): 127.0.0.1/32,::1/128
TRUSTED_PROXIES=

# Source IPs allowed to start PunchHole/RequestRelay without a registered RustDesk peer.
# Used by the Node panel WebSocket→TCP proxy for Web Remote (/ws/rendezvous → hbbs).
# Default in Go is 127.0.0.0/8,::1/128 when unset. Override for split panel↔Go containers
# (e.g. Docker bridge CIDR of the console). Refs #302.
# Do NOT add office/CGNAT public /32 here as a shared-NAT workaround — that trusts every
# egress from that IP as Web Remote. Prefer ALLOW_SHARED_NAT_INITIATOR for multi-device NATs (#399).
# PANEL_SIGNAL_PROXY_CIDRS=127.0.0.0/8,::1/128
PANEL_SIGNAL_PROXY_CIDRS=

# Opt-in (#399): authorize PunchHole/RequestRelay when multiple live peers share the
# initiator's public IP and the stock client has no login token / usable udp_port.
# Uses synthetic id shared-nat-initiator (does not inherit another peer's identity).
# Weakens managed enrollment outbound gate for that NAT — default off.
# ALLOW_SHARED_NAT_INITIATOR=N

# WebSocket Origin allow-list (comma-separated). Same-host browser upgrades are always allowed.
# WS_ALLOWED_ORIGINS=https://panel.example.com

# Console→Go API: keep on 127.0.0.1 (native install) or http://betterdesk-server:21114/api (Docker).
# Do not expose the Go API port directly to WAN — use the console proxy on :21121 for RustDesk clients.

# CDAP gateway (21122). Use WSS with a trusted certificate for WAN agents.
# CDAP_TLS_REQUIRED=Y rejects legacy plaintext CDAP; keep N only during migration.
CDAP_ENABLED=Y
CDAP_TLS=N
CDAP_TLS_REQUIRED=N

# Billing / NTP (commercialization module — read by betterdesk-server Go process)
# Stored in console .env; Linux installs load this via EnvironmentFile on betterdesk-server.service.
# After changes, restart betterdesk-server (Commercialization → Settings can apply + restart).
NTP_SERVERS=pool.ntp.org,time.google.com,time.cloudflare.com
BILLING_MAX_CLOCK_SKEW_MS=2000
BILLING_REQUIRE_SYNCED_CLOCK=1
BILLING_TRUST_OS_NTP=1
BILLING_ROUNDING_MINUTES=1
BILLING_REQUIRE_WORK_REPORT=1

# GitHub update source (stable = main branch, development = dev branch)
UPDATE_GITHUB_BRANCH=main
# Optional: read-only GitHub PAT for update checks (60 req/h unauthenticated → 5,000/h with token)
# UPDATE_GITHUB_TOKEN=