# Every key here has an environment twin: prefix KMOOD_, a double underscore for
# each section, the key as it is spelled below. KMOOD_SERVER__PORT sets server.port,
# KMOOD_SERVER__CORS__ALLOW_ANY_ORIGIN sets server.cors.allow_any_origin. The
# environment wins over this file, so secrets can stay out of it entirely.

[server]
host = "0.0.0.0"
port = 3000
max_body_size = 10485760
# spa_dir = "spa/dist"

[server.cors]
allow_any_origin = true
# allowed_origins = ["https://app.example.com"]

[entry]
max_content_length = 65536
max_photos = 10
max_voice_memos = 5
max_activities_per_entry = 50
max_entries_per_page = 200

[server.rate_limit]
# Guards the API only. The client's own static files are served outside this
# budget — one cold load asks for a dozen or more hashed assets at once, and
# counting those here lets a hard refresh starve the app of its own code.
enabled = true
# Sustained ceiling per caller. Opening the client and touching every screen
# costs roughly 25 API calls, so this is far above any person and still caps
# what a script can pull.
requests_per_second = 15
# How much can arrive at once before the ceiling applies. Covers that opening
# flurry about twice over, and refills completely in four seconds.
burst = 60
# Behind a reverse proxy this MUST be true, or every caller shares one bucket
# keyed by the proxy's address and one busy client throttles everyone. Only
# turn it on when the proxy sets X-Forwarded-For itself and refuses to pass
# through a client-supplied one, or the limit can be evaded by forging it.
trust_forwarded_for = false

[storage]
data_dir = "./data"
# database_url = "sqlite://./data/k-mood.db"

[storage.media]
backend = "local"
media_dir = "media"

# [storage.media]
# backend = "s3"
# bucket = "k-mood-media"
# region = "us-east-1"
# endpoint = "http://localhost:9000"
# access_key = "minioadmin"
# secret_key = "minioadmin"

[auth]
jwt_secret = "change-me-in-production"
access_token_ttl_seconds = 900
refresh_token_ttl_seconds = 2592000
allow_registration = true

# [push]
# enabled = true
# vapid_private_key = "<base64url-encoded 32-byte EC private key>"
# vapid_subject = "mailto:you@example.com"

[provider]
# Base64-encoded 32-byte key that encrypts every user's music-service credential
# at rest. Generate with: openssl rand -base64 32
# Absent: provider connections are unavailable and the server logs this at startup.
# Malformed: the server refuses to start rather than storing credentials the
# operator believes are encrypted.
# encryption_key = "<base64url-encoded 32-byte key>"

[analysis]
minimum_sample_size = 30
false_discovery_rate = 0.10

[import]
maximum_days_per_import = 90
rejections_kept = 200

[worker]
poll_seconds = 15
sweep_seconds = 900
session_cleanup_seconds = 3600
reminder_seconds = 60
reminder_grace_minutes = 30
jobs_per_poll = 20
enqueued_per_sweep = 200
most_attempts = 5
stalled_after_seconds = 300
look_up_weather = true