# Network
HOST=0.0.0.0
PORT=3000

# Storage: persistent filesystem directory where uploaded files and
# metadata live. Files survive restarts.
STORAGE_DIR=./storage

# Maximum upload size. Accepts plain bytes or units (B, KB, MB, GB, TB,
# case-insensitive). A request larger than this is rejected with 413.
MAX_FILE_SIZE=10GB

# How long an uploaded file lives before it expires and is deleted.
# In milliseconds. Default is 1 week (604800000).
FILE_TTL_MS=604800000

# Brute-force protection: rate limit per client IP on download and
# deletion endpoints. Set RATE_LIMIT_ENABLED=0 to disable.
RATE_LIMIT_ENABLED=1
RATE_LIMIT_MAX=300
RATE_LIMIT_WINDOW_MS=60000

# Set to 1 ONLY when running behind a reverse proxy that sets or
# overwrites X-Forwarded-For (e.g. nginx: proxy_set_header
# X-Forwarded-For $proxy_add_x_forwarded_for). Never enable this when
# clients can reach the server directly - they could spoof the header.
TRUST_PROXY=0