# Network
HOST=0.0.0.0
PORT=3000

# Public base URL of the site (the domain your users see, including scheme,
# WITHOUT a trailing slash). When set, share links returned by the API and the
# dashboard are absolute URLs (e.g. https://files.example.com/xmK5lLMRErlN).
# Leave unset to keep relative paths (the browser host is used).
PUBLIC_BASE_URL=https://files.example.com

# Storage: persistent filesystem directory where uploaded files and
# metadata live. Files survive restarts.
STORAGE_DIR=./storage

# Maximum upload size. Accepts plain bytes or units (B, KB, MB, GB, TB,
# case-insensitive). A request larger than this is rejected with 413.
MAX_FILE_SIZE=10GB

# Maximum fraction of the storage filesystem that may be used, from 0.0 to 1.0.
# When usage exceeds this ratio uploads are rejected with 503 "try again later".
# Default 0.5 = block uploads once more than 50% of the disk is used.
MAX_STORAGE_USAGE=0.5

# How long an uploaded file lives before it expires and is deleted.
# In milliseconds. Default and hard maximum is 48 hours (172800000).
FILE_TTL_MS=172800000

# Brute-force protection: rate limit per client IP on download and
# deletion endpoints. Set RATE_LIMIT_ENABLED=0 to disable.
RATE_LIMIT_ENABLED=1
RATE_LIMIT_MAX=300
RATE_LIMIT_WINDOW_MS=60000

# Set to 1 ONLY when running behind a reverse proxy that sets or
# overwrites X-Forwarded-For (e.g. nginx: proxy_set_header
# X-Forwarded-For $proxy_add_x_forwarded_for). Never enable this when
# clients can reach the server directly - they could spoof the header.
TRUST_PROXY=0