.env.example

# Server
PACKYARD_PORT=8080
PACKYARD_BASE_URL=https://repo.example.com
PACKYARD_LOG_LEVEL=info

# Database (mysql, postgres, sqlite)
PACKYARD_DB_DRIVER=sqlite
PACKYARD_DB_HOST=localhost
PACKYARD_DB_PORT=3306
PACKYARD_DB_NAME=packyard
PACKYARD_DB_USER=packyard
PACKYARD_DB_PASSWORD=
PACKYARD_DB_SSLMODE=disable
PACKYARD_DB_PATH=./packyard.db

# Storage (local, s3)
PACKYARD_STORAGE_TYPE=local
PACKYARD_STORAGE_LOCAL_PATH=./data/packages

# S3/R2 (when PACKYARD_STORAGE_TYPE=s3)
PACKYARD_S3_BUCKET=packyard-packages
PACKYARD_S3_REGION=us-east-1
PACKYARD_S3_ENDPOINT=
PACKYARD_S3_ACCESS_KEY=
PACKYARD_S3_SECRET_KEY=
PACKYARD_S3_FORCE_PATH_STYLE=false

# Auth
# REQUIRED: 32+ char random string used to sign session cookies (HMAC-SHA256).
# Generate with: openssl rand -hex 32
# Server refuses to start if this is shorter than 32 characters.
PACKYARD_SESSION_SECRET=
PACKYARD_SESSION_MAX_AGE=86400

# Session-cookie `Domain` attribute. Empty (default) scopes the cookie
# to the exact hostname the server answers on — correct for single-host
# deploys. Set to a parent domain like ".example.com" to share login
# state across subdomains (e.g. dashboard at app.example.com plus a
# companion marketing site at example.com).
PACKYARD_COOKIE_DOMAIN=

# Session-cookie `SameSite` attribute. Values: strict (default), lax,
# none. Strict is safest against CSRF but blocks the cookie on
# cross-subdomain redirects — use "lax" if you've set
# PACKYARD_COOKIE_DOMAIN and need the cookie to travel on top-level
# navigations between subdomains. "none" requires HTTPS (Secure).
PACKYARD_COOKIE_SAMESITE=strict

# Comma-separated CIDRs (or bare IPs) of reverse proxies whose
# X-Forwarded-For header is honored. Leave EMPTY when the server is
# exposed directly — otherwise the per-IP rate limiter can be bypassed
# by header injection.
# Example: PACKYARD_TRUSTED_PROXIES=10.0.0.0/8,127.0.0.1
PACKYARD_TRUSTED_PROXIES=
PACKYARD_BCRYPT_COST=12

# Download-event retention in days. A daily goroutine prunes events older
# than this so the download_events table doesn't grow unbounded. Set to 0
# to keep events forever (useful for audit trails; table grows without
# bound). Per-version cumulative counters (download_count) are never
# affected — they persist regardless of retention.
PACKYARD_DOWNLOAD_RETENTION_DAYS=90

# Rate limit on the Composer dist endpoint: DIST_RATELIMIT requests per
# DIST_RATELIMIT_WINDOW_SECONDS seconds per client IP. Every successful
# download triggers an UPDATE + INSERT, so this cap is what keeps a
# compromised token from inflating counters or bloating download_events.
# Defaults comfortably accommodate `composer install` bursts (most of
# which are cache hits anyway).
PACKYARD_DIST_RATELIMIT=120
PACKYARD_DIST_RATELIMIT_WINDOW_SECONDS=60

# How long /packages/stats responses stay cached in memory, per-org.
# Six DB queries per request get collapsed into one per TTL window. Set
# to 0 to disable caching (always hit the DB).
PACKYARD_STATS_CACHE_TTL_SECONDS=60

# Number of goroutines pulling sync jobs from the queue concurrently.
# 2 is plenty for a single-instance deploy (one can absorb a long-running
# sync while another handles quick webhook triggers). Set to 0 to disable
# the worker pool entirely — useful for replicas that shouldn't perform
# mutations.
PACKYARD_SYNC_WORKERS=2

# How long terminal sync_jobs rows are kept. A daily goroutine prunes
# finished rows older than this. Active (queued/running) jobs are never
# touched. 0 disables pruning (the table grows unbounded; probably fine
# for low-volume deploys, but usually not desired).
PACKYARD_JOB_RETENTION_DAYS=30

# Provider credentials encryption key. Required when saving GitHub/GitLab
# tokens in provider connections, and when migrating legacy per-source tokens.
# Generate with: openssl rand -hex 32
PACKYARD_CREDENTIALS_KEY=

# Initial admin (used on first run only)
PACKYARD_ADMIN_EMAIL=admin@example.com
PACKYARD_ADMIN_PASSWORD=changeme