.env.example

APP_ENV=development
APP_HOST=127.0.0.1
APP_PORT=8000
APP_LOG_MODE=stdout
APP_ACCESS_LOG=false
# To opt into bounded file logging, also set APP_LOG_PATH and keep rotation enabled.
# APP_LOG_PATH=/var/log/alicebot/api.log
# APP_LOG_MAX_BYTES=10485760
# APP_LOG_BACKUP_COUNT=5
# Development-only local credentials. Override for any shared or remote environment.
DATABASE_URL=postgresql://alicebot_app:alicebot_app@localhost:5432/alicebot
DATABASE_ADMIN_URL=postgresql://alicebot_admin:alicebot_admin@localhost:5432/alicebot
REDIS_URL=redis://localhost:6379/0
S3_ENDPOINT_URL=http://localhost:9000
S3_ACCESS_KEY=alicebot
S3_SECRET_KEY=alicebot-secret
S3_BUCKET=alicebot-local
HEALTHCHECK_TIMEOUT_SECONDS=2
TASK_WORKSPACE_ROOT=/tmp/alicebot/task-workspaces
# Server-side authenticated user binding for /v0 requests.
ALICEBOT_AUTH_USER_ID=00000000-0000-0000-0000-000000000001
# Default sample-data fixture consumed by ./scripts/load_sample_data.sh.
PUBLIC_SAMPLE_DATA_PATH=fixtures/public_sample_data/continuity_v1.json
# Per-user response generation throttle (POST /v0/responses).
RESPONSE_RATE_LIMIT_WINDOW_SECONDS=60
RESPONSE_RATE_LIMIT_MAX_REQUESTS=20
# Hosted auth and webhook ingress throttles.
MAGIC_LINK_START_RATE_LIMIT_WINDOW_SECONDS=300
MAGIC_LINK_START_RATE_LIMIT_MAX_REQUESTS=5
MAGIC_LINK_VERIFY_RATE_LIMIT_WINDOW_SECONDS=300
MAGIC_LINK_VERIFY_RATE_LIMIT_MAX_REQUESTS=10
TELEGRAM_WEBHOOK_RATE_LIMIT_WINDOW_SECONDS=60
TELEGRAM_WEBHOOK_RATE_LIMIT_MAX_REQUESTS=120
# Telegram transport defaults.
TELEGRAM_LINK_TTL_SECONDS=600
TELEGRAM_BOT_USERNAME=alicebot
TELEGRAM_WEBHOOK_SECRET=
TELEGRAM_BOT_TOKEN=
# Browser security posture.
CORS_ALLOWED_ORIGINS=http://localhost:3000,http://127.0.0.1:3000
CORS_ALLOWED_METHODS=GET,POST,PUT,PATCH,DELETE,OPTIONS
CORS_ALLOWED_HEADERS=Authorization,Content-Type,X-AliceBot-User-Id,X-Telegram-Bot-Api-Secret-Token
CORS_ALLOW_CREDENTIALS=false
CORS_PREFLIGHT_MAX_AGE_SECONDS=600
SECURITY_HEADERS_ENABLED=true
SECURITY_HEADERS_HSTS_MAX_AGE_SECONDS=31536000
SECURITY_HEADERS_HSTS_INCLUDE_SUBDOMAINS=true
# Proxy and ingress trust boundaries.
TRUST_PROXY_HEADERS=false
TRUSTED_PROXY_IPS=
# Entrypoint abuse-control backend.
ENTRYPOINT_RATE_LIMIT_BACKEND=redis