# Overlord Server Environment Configuration
# Copy this file to .env and customize for your deployment

# Server Configuration
PORT=5173
HOST=0.0.0.0

# Optional: Set custom hostname for certificate generation
# OVERLORD_HOSTNAME=your-server.com

# Authentication
OVERLORD_USER=admin
# Default bootstrap password is "admin" unless you override it
OVERLORD_PASS=admin

# Optional overrides. Leave empty to auto-generate and persist in ./data/save.json
JWT_SECRET=
OVERLORD_AGENT_TOKEN=

# TLS/HTTPS Configuration
# By default, certificates are generated when missing and Overlord serves HTTPS.
# OVERLORD_TLS_CERT=./certs/server.crt
# OVERLORD_TLS_KEY=./certs/server.key
# OVERLORD_TLS_CA=./certs/ca.crt

# Additional SHA-256 SPKI pins embedded in newly generated agents. Use this for
# a planned next certificate key, or provide the externally terminated TLS
# certificate pins when OVERLORD_TLS_OFFLOAD=true. Comma-separated; an optional
# "sha256/" prefix is accepted.
# OVERLORD_TLS_SPKI_PINS=base64-sha256-current,base64-sha256-next

# Reverse-proxy TLS offload. This serves internal HTTP only; keep the listener
# on loopback and expose HTTPS/WSS through nginx, Caddy, or another trusted proxy.
# HOST=127.0.0.1
# OVERLORD_TLS_OFFLOAD=true
# OVERLORD_HEALTHCHECK_URL=http://127.0.0.1:5173/health

# Performance tuning
PRUNE_BATCH=500