# Template. Copy to /etc/off-season/off-season.env and chmod 600.
# Replace every CHANGE_ME. Do not commit the filled file.

# Separate database. Do not point this at any other application's database.
LH_DATABASE_URL=postgres://offseason:CHANGE_ME_DB@127.0.0.1:5432/offseason?sslmode=disable

# Listen on localhost only. The parent confirms 18080 is free before use.
LH_HTTP_ADDR=127.0.0.1:18080

# Directory that contains account/ and game/ from this release's web/.
LH_WEB_DIR=/opt/off-season/web

# Unpacked corresponding source. GET /source.tar.gz is built from this tree.
LH_SOURCE_ROOT=/opt/off-season/source

# Public site. Cookies are Secure. The reverse proxy must pass this Host through.
LH_PUBLIC_URL=https://offseason.paperlocks.com
LH_COOKIE_SECURE=true

# Trust X-Forwarded-For only from the local reverse proxy. 127.0.0.1/32 when
# nginx or Caddy on this machine connects to 127.0.0.1:18080. Do not use 0.0.0.0/0.
LH_TRUSTED_PROXIES=127.0.0.1/32

# Created once, on first start, if the offseason database has no admin yet.
# Use a long password that is not a test fixture. This is not a player password.
LH_ADMIN_USERNAME=offseason-admin
LH_ADMIN_PASSWORD=CHANGE_ME_ADMIN

# Abuse limits. These are not a substitute for the email sign-in below.
# Anyone with the site URL may ask for a code. LH_INVITE_CODE is not used.
LH_REGISTRATIONS_PER_HOUR=10
LH_GUESTS_PER_HOUR=10
LH_INSTANT_MAX_WORLDS=1

# Sign-in mail. Empty LH_MAIL_MODE refuses to send and does not print codes.
# Do not set capture on a public host.
#
# This host already sends with the Amazon SES API v2, not SMTP.
# Copy the existing credential VALUES into THIS file only, by hand, on the server.
# Do not point the game at /etc/paperlocks/paperlocks.env and do not print the values.
# Names on that file, mapped here:
#   SES_REGION              -> LH_SES_REGION
#   SES_ACCESS_KEY_ID       -> LH_SES_ACCESS_KEY_ID
#   SES_SECRET_ACCESS_KEY   -> LH_SES_SECRET_ACCESS_KEY
# The verified address is signin@paperlocks.com. The display name is Off-Season.
# Do not invent a game@ address. Whether the SES account is still in the sandbox
# is unconfirmed; a sandbox account only delivers to verified recipients.
# LH_MAIL_MODE=ses
# LH_SES_REGION=eu-central-1
# LH_SES_ACCESS_KEY_ID=
# LH_SES_SECRET_ACCESS_KEY=
# LH_MAIL_FROM=Off-Season <signin@paperlocks.com>
#
# SMTP remains available if a later host uses it. It is not this host's transport.
# LH_MAIL_MODE=smtp
# LH_SMTP_HOST=
# LH_SMTP_PORT=587
# LH_SMTP_USERNAME=
# LH_SMTP_PASSWORD=
# LH_SMTP_FROM=
#
# HMAC key for sign-in codes. At least 16 characters, chosen for this service.
# Required whenever LH_MAIL_MODE is ses, smtp, or capture.
# LH_OTP_SECRET=

# Leave unset: LH_TIME_SCALE, LH_TIME_EPOCH_MS, LH_VALKEY_URL, LH_RECORD_DECISIONS.
