# Overlord Server Environment Configuration
# Copy this file to .env and customize for your deployment

# Server Configuration
PORT=5173
HOST=0.0.0.0

# Optional: Set custom hostname for certificate generation
# OVERLORD_HOSTNAME=your-server.com

# Authentication
OVERLORD_USER=admin
# Default bootstrap password is "admin" unless you override it
OVERLORD_PASS=admin

# Optional overrides. Leave empty to auto-generate and persist in ./data/save.json
JWT_SECRET=
OVERLORD_AGENT_TOKEN=

# Pin browser Origin/CSRF checks to the externally visible server origin.
# Recommended for every production deployment, especially behind a proxy.
# OVERLORD_PUBLIC_ORIGIN=https://overlord.example.com

# Comma-separated immediate public proxy IPs whose forwarding headers may be
# trusted. Only loopback peers are automatic; list private container/LAN proxy
# addresses explicitly as well.
# OVERLORD_TRUSTED_PROXY_IPS=203.0.113.10

# Query-string agent credentials remain enabled for older clients. Current
# agents send X-Agent-Token; set this to false after migrating every client.
# OVERLORD_ALLOW_AGENT_TOKEN_QUERY=false
# Legacy password-protected file-share links remain supported. Prefer the
# X-Download-Password header; set this to false to reject query secrets.
# OVERLORD_ALLOW_FILE_SHARE_PASSWORD_QUERY=false

# Pending enrollment abuse controls (use larger values for very large fleets).
# OVERLORD_PENDING_ENROLLMENT_TTL_HOURS=168
# OVERLORD_MAX_PENDING_ENROLLMENTS=100000
# OVERLORD_MAX_PENDING_ENROLLMENTS_PER_IP=10000
# OVERLORD_MAX_PREAUTH_SOCKETS_GLOBAL=100000
# OVERLORD_MAX_PREAUTH_SOCKETS_PER_IP=10000
# OVERLORD_MAX_ENROLLMENT_VERIFICATIONS=4096
# OVERLORD_ENROLLMENT_VERIFICATION_ATTEMPTS_PER_SECOND=100000
# OVERLORD_ENROLLMENT_VERIFICATION_ATTEMPT_BURST=200000

# Generous defaults avoid dropping frames in large fleets; lower these if the
# server operator wants explicit memory/backpressure limits.
# OVERLORD_THUMBNAIL_PENDING_MAX_COUNT=512
# OVERLORD_THUMBNAIL_PENDING_MAX_BYTES=536870912
# OVERLORD_THUMBNAIL_QUEUE_MAX=512
# OVERLORD_THUMBNAIL_CACHE_MAX_BYTES=1073741824
# OVERLORD_THUMBNAIL_REQUEST_MAX=4096
# OVERLORD_THUMBNAIL_WAITER_ID_MAX=4096
# OVERLORD_THUMBNAIL_WAITER_MAX=8192

# Notification screenshot retention quotas (byte values are raw bytes).
# OVERLORD_NOTIFICATION_SCREENSHOT_CLIENT_MAX_COUNT=10000
# OVERLORD_NOTIFICATION_SCREENSHOT_CLIENT_MAX_BYTES=1073741824
# OVERLORD_NOTIFICATION_SCREENSHOT_GLOBAL_MAX_COUNT=100000
# OVERLORD_NOTIFICATION_SCREENSHOT_GLOBAL_MAX_BYTES=17179869184

# Notification metadata history quotas. Oldest rows (and any linked screenshots)
# are pruned atomically when a per-client or fleet-wide limit is reached.
# OVERLORD_NOTIFICATION_HISTORY_CLIENT_MAX_COUNT=100000
# OVERLORD_NOTIFICATION_HISTORY_CLIENT_MAX_BYTES=1073741824
# OVERLORD_NOTIFICATION_HISTORY_GLOBAL_MAX_COUNT=1000000
# OVERLORD_NOTIFICATION_HISTORY_GLOBAL_MAX_BYTES=17179869184

# Chat-plugin fleet retention quotas. These prevent many approved client
# identities from multiplying the built-in per-client message/attachment caps.
# OVERLORD_CHAT_PLUGIN_GLOBAL_MAX_MESSAGES=1000000
# OVERLORD_CHAT_PLUGIN_GLOBAL_MAX_MESSAGE_BYTES=17179869184
# OVERLORD_CHAT_PLUGIN_GLOBAL_MAX_ATTACHMENT_BYTES=17179869184

# Fleet-wide archived keylog quotas. These are in addition to the built-in
# per-client cap; oldest rows and their FTS entries are pruned first.
# OVERLORD_INPUT_ARCHIVE_GLOBAL_MAX_FILES=1000000
# OVERLORD_INPUT_ARCHIVE_GLOBAL_MAX_BYTES=68719476736


# Audit retention is opt-in. Uncomment either setting to prune old history.
# OVERLORD_AUDIT_RETENTION_DAYS=90
# OVERLORD_AUDIT_MAX_ROWS=250000

# Web Push subscription quotas, mutation rate limits, and bounded fan-out.
# A user's oldest subscription is replaced when their per-user cap is reached.
# OVERLORD_MAX_PUSH_SUBSCRIPTIONS_PER_USER=10
# OVERLORD_MAX_PUSH_SUBSCRIPTIONS=10000
# OVERLORD_PUSH_SUBSCRIPTION_RATE_LIMIT_MAX=20
# OVERLORD_PUSH_SUBSCRIPTION_RATE_LIMIT_WINDOW_SECONDS=60
# OVERLORD_PUSH_SUBSCRIPTION_RATE_LIMIT_LOCKOUT_SECONDS=60
# OVERLORD_WEB_PUSH_DELIVERY_CONCURRENCY=8
# OVERLORD_WEB_PUSH_DELIVERY_BATCH_SIZE=100

# TLS/HTTPS Configuration
# By default, certificates are generated when missing and Overlord serves HTTPS.
# OVERLORD_TLS_CERT=./certs/server.crt
# OVERLORD_TLS_KEY=./certs/server.key
# OVERLORD_TLS_CA=./certs/ca.crt

# Additional SHA-256 SPKI pins embedded in newly generated agents. Use this for
# a planned next certificate key, or provide the externally terminated TLS
# certificate pins when OVERLORD_TLS_OFFLOAD=true. Comma-separated; an optional
# "sha256/" prefix is accepted.
# OVERLORD_TLS_SPKI_PINS=base64-sha256-current,base64-sha256-next

# Reverse-proxy TLS offload. This serves internal HTTP only; keep the listener
# on loopback and expose HTTPS/WSS through nginx, Caddy, or another trusted proxy.
# HOST=127.0.0.1
# OVERLORD_TLS_OFFLOAD=true
# OVERLORD_HEALTHCHECK_URL=http://127.0.0.1:5173/health

# Performance tuning
PRUNE_BATCH=500