env.example

SERVER_HOST=0.0.0.0
SERVER_PORT=3004
DEV_DASHBOARD_PORT=8080

# Log verbosity for the structured run and server logs (issue #47): one of
# error, warn, info or debug. Records are one JSON object per line, carrying a
# correlation id per request (X-Request-Id) and per simulation run. An
# unsupported value falls back to info.
#LOG_LEVEL=info

# Optional hardening limits. The defaults shown here are what the server applies
# when they are unset, so leave them commented out unless you need to change
# one. See the "Security-related configuration" section of the README.
#CORS_ALLOWED_ORIGINS=
#BODY_LIMIT=1mb
#RATE_LIMIT_WINDOW_MS=900000
#RATE_LIMIT_MAX=1000
#CSP_REPORT_ONLY=false
#CSP_REPORT_URI=

# Authentication. The API is closed to anonymous callers, so a deployment needs
# an administrator credential: set AUTH_ADMIN_PASSWORD_HASH (preferred - see the
# README for the one-line command that generates it) or, for a first start,
# AUTH_ADMIN_PASSWORD. NEVER commit a real value into this file.
#AUTH_ADMIN_USERNAME=admin
#AUTH_ADMIN_PASSWORD=
#AUTH_ADMIN_PASSWORD_HASH=

# Sessions. SESSION_SECRET signs the session cookie; when it is unset the server
# generates an ephemeral one per process and says so loudly, which means every
# session ends at a restart. Set it in production. Set SESSION_COOKIE_SECURE=true
# whenever TLS reaches the application itself.
#SESSION_SECRET=
#SESSION_TTL_MS=3600000
#SESSION_ABSOLUTE_TTL_MS=43200000
#SESSION_COOKIE_SECURE=false
# Hard cap on the session table. When it is full the least recently seen record
# is evicted, so the table stays bounded whatever the traffic.
#SESSION_MAX_RECORDS=1000

# Delegating identity to an authenticating reverse proxy. Both must be set: the
# identity header is only believed when the request comes from a listed peer.
# Delegation is not a CSRF exemption: a non-browser client behind the proxy must
# GET /api/auth/session for its token before it can POST or DELETE.
#AUTH_TRUST_PROXY_HEADER=false
#AUTH_PROXY_USER_HEADER=x-forwarded-user
#AUTH_TRUSTED_PROXIES=

# Failed logins per window per client before the login endpoint starts refusing.
# Successful logins do not count towards it.
#AUTH_LOGIN_RATE_LIMIT_WINDOW_MS=900000
#AUTH_LOGIN_RATE_LIMIT_MAX=10

# Where the runtime-state registry (issue #29) persists which simulations,
# data recorders and test campaigns are running. Defaults to
# src/server/data/runtime-state.json, alongside the other data files.
#TAS_RUNTIME_STATE_PATH=

# Where the stored artefacts live (issue #30). Topologies, data-recorder
# definitions and the service configuration are records of an artifact store
# that writes them atomically and serialises concurrent edits; existing files
# in these directories were written by earlier versions and are adopted as
# they are. Defaults: src/server/data/models, src/server/data/data-recorders
# and src/server/data (which holds data-storage.json).
#TAS_MODELS_DIR=
#TAS_DATA_RECORDERS_DIR=
#TAS_DATA_DIR=