.env.example

# Stack Blog Environment Configuration
# Copy this file to .env and update with your settings

# =============================================================================
# Application Configuration
# =============================================================================

# Environment: development, production, test
NODE_ENV=production

# Server configuration
PORT=3000
HOST=0.0.0.0
TRUST_PROXY=true

# =============================================================================
# Security Configuration (REQUIRED)
# =============================================================================

# Session secret (64+ characters, cryptographically secure)
# Generate with: node -e "console.log(require('crypto').randomBytes(64).toString('hex'))"
SESSION_SECRET=your-super-secure-session-secret-that-is-at-least-64-characters-long

# API key for REST API access (32+ characters)
# Generate with: node -e "console.log(require('crypto').randomBytes(32).toString('hex'))"
API_KEY=your-secure-api-key-change-this-in-production

# Admin password hash (generate with: npm run setup)
ADMIN_PASSWORD_HASH=$2b$12$your.bcrypt.password.hash.goes.here

# =============================================================================
# Content Configuration
# =============================================================================

# Content and media paths
CONTENT_PATH=./content
MEDIA_PATH=./content/media

# Caching configuration
CACHE_ENABLED=true
CACHE_TTL=300000
CACHE_MAX_SIZE=100

# =============================================================================
# CORS Configuration
# =============================================================================

# Allowed origins (comma-separated)
ALLOWED_ORIGINS=https://yourdomain.com,https://www.yourdomain.com

# =============================================================================
# Rate Limiting Configuration
# =============================================================================

# Rate limiting windows and limits
RATE_LIMIT_WINDOW=900000

# General requests per window (15 minutes)
RATE_LIMIT_GENERAL=1000

# Authentication attempts per window
RATE_LIMIT_AUTH=5

# API requests per window
RATE_LIMIT_API=100

# File uploads per hour
RATE_LIMIT_UPLOAD=50

# =============================================================================
# Search Configuration
# =============================================================================

# Search functionality
SEARCH_ENABLED=true
SEARCH_INDEX_TTL=300000
SEARCH_MAX_RESULTS=50
SEARCH_SNIPPET_LENGTH=150

# =============================================================================
# Security Headers Configuration
# =============================================================================

# Content Security Policy
CSP_ENABLED=true

# HTTP Strict Transport Security
HSTS_ENABLED=true
HSTS_MAX_AGE=31536000

# =============================================================================
# Session Configuration
# =============================================================================

# Session settings
SESSION_NAME=stackblog.sid
SESSION_MAX_AGE=86400000
SESSION_SECURE=true
SESSION_HTTP_ONLY=true

# =============================================================================
# File Upload Configuration
# =============================================================================

# Upload restrictions
UPLOAD_MAX_SIZE=10485760
UPLOAD_ALLOWED_TYPES=image/jpeg,image/png,image/gif,image/webp,application/pdf,text/plain

# =============================================================================
# Logging Configuration
# =============================================================================

# Log level: error, warn, info, debug
LOG_LEVEL=info
LOG_FILE=./logs/app.log

# =============================================================================
# Plugin Configuration
# =============================================================================

# Plugin system
PLUGINS_ENABLED=true
PLUGINS_PATH=./plugins
PLUGINS_AUTOLOAD=true

# =============================================================================
# Performance Configuration
# =============================================================================

# Cluster mode (for PM2)
CLUSTER_MODE=true
MAX_WORKERS=4
MEMORY_LIMIT=512

# =============================================================================
# Docker Configuration
# =============================================================================

# Docker-specific settings
DOMAIN=localhost

# Redis configuration (if using Redis profile)
REDIS_PASSWORD=changeme

# Monitoring configuration (if using monitoring profile)
GRAFANA_PASSWORD=admin

# Backup configuration (if using backup profile)
BACKUP_RETENTION_DAYS=30

# =============================================================================
# Optional: Database Configuration
# =============================================================================
# If using plugins that require a database

# DATABASE_URL=sqlite:./data/stack_blog.db
# DATABASE_HOST=localhost
# DATABASE_PORT=5432
# DATABASE_NAME=stack_blog
# DATABASE_USER=stack_blog
# DATABASE_PASSWORD=secure_password

# =============================================================================
# Optional: Email Configuration
# =============================================================================
# For plugins that send emails

# SMTP_HOST=smtp.gmail.com
# SMTP_PORT=587
# SMTP_SECURE=false
# SMTP_USER=your-email@gmail.com
# SMTP_PASS=your-app-password

# =============================================================================
# Optional: Cloud Storage Configuration
# =============================================================================
# For plugins that use cloud storage

# AWS_ACCESS_KEY_ID=your-access-key
# AWS_SECRET_ACCESS_KEY=your-secret-key
# AWS_REGION=us-east-1
# AWS_S3_BUCKET=your-bucket-name

# =============================================================================
# Optional: Analytics Configuration
# =============================================================================
# For analytics plugins

# GOOGLE_ANALYTICS_ID=GA-XXXXXXXXX-X
# GOOGLE_ANALYTICS_4_ID=G-XXXXXXXXXX
# FACEBOOK_PIXEL_ID=xxxxxxxxxxxxxxx

# =============================================================================
# Optional: Social Media Configuration
# =============================================================================
# For social media plugins

# TWITTER_CONSUMER_KEY=your-consumer-key
# TWITTER_CONSUMER_SECRET=your-consumer-secret
# FACEBOOK_APP_ID=your-facebook-app-id
# FACEBOOK_APP_SECRET=your-facebook-app-secret

# =============================================================================
# Development-Only Configuration
# =============================================================================
# These settings should only be used in development

# Debug settings (development only)
# ENABLE_DEBUG=true
# DEBUG_LEVEL=verbose
# HOT_RELOAD=true

# Development database (development only)
# DEV_DATABASE_URL=sqlite:./dev-data/stack_blog.db