.env.example

# Server Configuration
PORT=3000
NODE_ENV=production
BASE_URL=http://localhost:3000

# Application Settings
SITE_TITLE=DumbPad

# Security: PIN Protection (4-10 digits, leave empty to disable)
DUMBPAD_PIN=

# Session Configuration
COOKIE_MAX_AGE=24
PAGE_HISTORY_COOKIE_AGE=365

# Rate Limiting
MAX_ATTEMPTS=5
LOCKOUT_TIME=15

# CORS Configuration
# Comma-separated list of allowed origins (use * for development)
# ALLOWED_ORIGINS=http://localhost:3000,https://yourdomain.com

# Proxy Trust Configuration
# WARNING: Only enable proxy trust if deploying behind a trusted reverse proxy
# Default: false (most secure - always use direct socket IP for rate-limiting and auth)
TRUST_PROXY=false

# Comma-separated list of trusted proxy IPs that connect directly to this app
# Required when TRUST_PROXY=true to prevent IP spoofing attacks
# Examples:
#   - Docker default gateway: 172.17.0.1
#   - Local nginx: 127.0.0.1
#   - VPC internal proxy: 10.0.0.1
# Only connections from these IPs will have their X-Forwarded-For header trusted
TRUSTED_PROXY_IPS=

# Syntax Highlighting Configuration
# Comma-separated list of language identifiers for code syntax highlighting
# Leave empty to use all available languages (default)
# Example: HIGHLIGHT_LANGUAGES=javascript,python,bash,css,html
HIGHLIGHT_LANGUAGES=