# The private Dungeons-Ground origin. Keep it inaccessible from the public internet.
UPSTREAM_URL=http://127.0.0.1:3000
# The public gateway origin; HTTPS is required with NODE_ENV=production.
PUBLIC_URL=http://localhost:8080
HOST=0.0.0.0
PORT=8080
NODE_ENV=development
# Generate with: node -e "console.log(require('crypto').randomBytes(32).toString('hex'))"
SESSION_SECRET=replace-with-a-random-secret-at-least-32-characters
DATA_FILE=./data/access.json

CODE_LENGTH=10
CODE_TTL_DAYS=15
SESSION_TTL_HOURS=360
REQUEST_TTL_HOURS=24
REQUEST_COOLDOWN_SECONDS=300
LOGIN_ATTEMPTS=5
LOGIN_WINDOW_SECONDS=900
GLOBAL_LOGIN_ATTEMPTS=100
# Set only when the proxy is reachable exclusively through your trusted edge.
# The edge must OVERWRITE X-Forwarded-For with the single client IP.
TRUST_PROXY=false

# Either or both bots can be enabled. Empty tokens disable a provider.
# Telegram uses long polling. Users and admins must first /start the bot in DM.
TELEGRAM_BOT_TOKEN=
TELEGRAM_BOT_USERNAME=
TELEGRAM_ADMIN_IDS=
# Optional BotFather game short name for THIS bot (not a numeric game ID).
# Empty disables the game. The native Play button opens the original 2048.
TELEGRAM_GAME_SHORT_NAME=

# Discord uses a signed HTTP interactions endpoint at /_access/discord.
DISCORD_BOT_TOKEN=
DISCORD_APPLICATION_ID=
DISCORD_PUBLIC_KEY=
DISCORD_ADMIN_IDS=
# Channel/server link where users can invoke /access (shown on the gate).
DISCORD_ACCESS_URL=
# Optional: register /access immediately in one server instead of globally.
DISCORD_GUILD_ID=

# Comma-separated request details sent to admins. platform, user_id and request_id
# are always included. Names/handles are informational, never authorization IDs.
ADMIN_REQUEST_FIELDS=username,display_name,language_code,guild_id,created_at