# Gokapi host-local binds + disk-protection tuning — copy to .env (gitignored)
# next to docker-compose.yml and fill in real values. Never commit .env.
# No auth secrets here: Gokapi has no headless admin env vars — the admin
# account is created in the one-time /setup web wizard (see README).

# Tailscale IP of the VPS node (ubuntu-4gb-hel1-1). Bind the gokapi port
# ONLY to this interface — never 0.0.0.0. The public internet never reaches
# port 53842 directly; share.okit.pl reaches gokapi only through npm@VPS
# (which runs on the same host and connects to this IP via Docker hairpin
# NAT — see docker-compose.yml). Verify when rebuilding the host:
# tailscale ip -4.
TAILSCALE_BIND_IP=100.95.58.48

TZ=Europe/Warsaw

# --- Disk protection -------------------------------------------------------
# VPS has an 80 GB disk shared with npm, outline, joplin, ai-cluster,
# fleet-prometheus's TSDB, etc. — gokapi is NOT the only tenant, and it has
# no S3 backend (local disk only, by design). Keep uploads small and leave
# headroom so expiring links actually reclaim space before the disk fills.

# Per-file upload cap in MB. 5120 = 5 GB. Upstream default is 102400
# (100 GB), which would let a single upload fill the whole disk.
GOKAPI_MAX_FILESIZE=5120

# Refuse new uploads once free disk space drops below this many MB. Upstream
# default is 400; raised here for the same reason as above.
GOKAPI_MIN_FREE_SPACE=2048

# npm@VPS and gokapi run on the same host; npm reaches gokapi's Tailscale-
# bound port via Docker hairpin NAT, so the connection arrives from the
# docker bridge gateway, not the real client IP. Trust that range so
# X-Forwarded-For / IP logging work correctly — same lesson as nextcloud's
# TRUSTED_PROXIES. Narrow to the exact /24 once the stack is up on the live
# host: docker network inspect gokapi_default.
GOKAPI_TRUSTED_PROXIES=172.16.0.0/12

# --- NOT env vars — Gokapi has no headless config for these. Set them in
# the one-time /setup wizard on first boot (see README Cutover checklist):
# - Admin username/password                       (Authentication step)
# - Storage backend: Local                         (Storage step — NOT S3,
#                                                    per Oskar's decision)
# - Encryption level: End-to-End (Level 3)          (Encryption step —
#                                                    Oskar wants E2E ON)
# - Default expiry / max downloads: there is NO global default in Gokapi —
#   it's chosen per-upload in the web form. Use conservative values (e.g.
#   7 days / 10 downloads) each time to keep the disk from filling.