.env.example

# =================================
# GEOCODING API - ENVIRONMENT CONFIG
# =================================

# Database Configuration
# -----------------------
DB_USER=geocoding_user
DB_PASSWORD=CHANGE_THIS_SECURE_PASSWORD_IN_PRODUCTION
DB_NAME=geocoding_db
DB_SSLMODE=disable

# Application Configuration  
# -------------------------
API_PORT=8080
GO_ENV=production

# CORS Configuration (Optional)
# -----------------------------
# Production automatically uses: https://geocode.jfay.dev
# Set CORS_ORIGINS to override (comma-separated list)
# CORS_ORIGINS=https://geocode.jfay.dev,https://your-other-domain.com

# CRITICAL SECURITY SETTINGS
# ===========================
# Generate secure values with: openssl rand -hex 32
JWT_SECRET=CHANGE_THIS_32_CHAR_SECRET_IN_PRODUCTION
API_SECRET_KEY=CHANGE_THIS_32_CHAR_SECRET_IN_PRODUCTION

# Performance Settings
# --------------------
RATE_LIMIT_PER_MINUTE=100
MAX_CONNECTIONS=50

# =================================
# DEPLOYMENT NOTES:
# - Set strong passwords (24+ chars)
# - Generate secure JWT/API secrets  
# - Never commit real secrets to git
# - Test with docker-compose first
# =================================
RUN_MIGRATIONS_ASYNC=true
# --- Auth endpoint throttle ---
# /auth/login and /auth/register sit outside the API-key quota, and login runs
# a bcrypt comparison per attempt. These bound how hard a single client IP can
# hit them. Set AUTH_RATE_PER_MINUTE=0 to disable (load testing only).
AUTH_RATE_PER_MINUTE=12
AUTH_RATE_BURST=5

# Client IP derivation. Default (unset or anything but "false"): prefer
# Cloudflare's CF-Connecting-IP, else the socket peer -- never the
# caller-supplied X-Forwarded-For, which anyone can forge to mint a fresh rate
# limit bucket per request. Set to "false" only for a deployment behind a
# proxy it controls that genuinely sets XFF; that reopens the bypass.
# Also determines the ip_address recorded against every metered API call.
# TRUST_CLOUDFLARE_IP=false