# bike-admin configuration (all values are BIKE_ADMIN_-prefixed env vars or .env entries)

# --- Required -------------------------------------------------
# Username + password for the single admin login. The app refuses to start
# without a password (no insecure default).
BIKE_ADMIN_USERNAME=admin
BIKE_ADMIN_PASSWORD=change-me-to-something-strong

# --- Recommended ----------------------------------------------
# Secret used to derive the CSRF token. Generate with:
#   python -c "import secrets;print(secrets.token_urlsafe(32))"
BIKE_ADMIN_SECRET_KEY=

# Flip to true when served over HTTPS (behind a TLS-terminating reverse proxy).
# This adds the Secure flag to the session cookie.
BIKE_ADMIN_IS_PRODUCTION=false

# Bind address. Leave 127.0.0.1 when behind a reverse proxy (recommended).
BIKE_ADMIN_BIND_HOST=127.0.0.1
BIKE_ADMIN_BIND_PORT=8000

# Where the single SQLite file lives (defaults to ./data/bike_admin.db).
# BIKE_ADMIN_DATA_DIR=./data

# --- Optional fine-tuning (defaults shown) ---------------------
# Session lifetime (seconds; default 7 days).
# BIKE_ADMIN_SESSION_TTL_SECONDS=604800
# Login brute-force throttling: N attempts per window per IP.
# BIKE_ADMIN_LOGIN_MAX_ATTEMPTS=8
# BIKE_ADMIN_LOGIN_WINDOW_SECONDS=300
# Trust X-Forwarded-For / X-Forwarded-Proto from the reverse proxy.
# BIKE_ADMIN_TRUST_PROXY=true