APP_ENV=local
HTTP_ADDR=:8080
HTTP_READ_HEADER_TIMEOUT=5s
HTTP_IDLE_TIMEOUT=120s
HTTP_SHUTDOWN_TIMEOUT=20s
HTTP_MAX_BODY_BYTES=33554432

DATABASE_URL=postgres://gateway:gateway@localhost:5432/gateway?sslmode=disable
DATABASE_MAX_CONNS=40
DATABASE_MIN_CONNS=4

REDIS_CRITICAL_URL=redis://localhost:6379/0
REDIS_CACHE_URL=redis://localhost:6380/0

AUTH_SESSION_TTL=12h
AUTH_TOTP_CHALLENGE_TTL=5m
LOGIN_MAX_FAILURES=5
LOGIN_LOCK_DURATION=15m

# 登录防爆破：按 IP 的滑动窗口限流（与上面的账号锁定叠加）。
# 单 IP 在窗口内最多 LOGIN_RATE_LIMIT_MAX 次登录尝试，超出返回 429。
LOGIN_RATE_LIMIT_MAX=30
LOGIN_RATE_LIMIT_WINDOW=5m

# Base64-encoded 32-byte AES-256 key. Generate with: openssl rand -base64 32
CREDENTIAL_MASTER_KEY=
CREDENTIAL_KEK_VERSION=1
ALLOW_PRIVATE_PROVIDER_URLS=false
ALLOW_PRIVATE_TOOL_URLS=false
ALLOW_PRIVATE_WEBHOOK_URLS=false
PROVIDER_REFRESH_INTERVAL=5s

# Transitional bootstrap credential. It will be replaced by database-backed API keys.
# Disabled by default for security; it bypasses per-key rate limits and tenant
# isolation, so only enable it during migration with a strong random value.
GATEWAY_BOOTSTRAP_API_KEY_ENABLED=false
GATEWAY_BOOTSTRAP_API_KEY=
UPSTREAM_BASE_URL=https://api.openai.com
UPSTREAM_API_KEY=
UPSTREAM_FALLBACK_ENABLED=true

AUDIT_QUEUE_SIZE=4096
AUDIT_BATCH_SIZE=200
AUDIT_FLUSH_INTERVAL=1s
AUDIT_RETENTION=2160h
USAGE_RETENTION=17520h
AUDIT_PARTITION_MONTHS_AHEAD=3
AUDIT_MAINTENANCE_INTERVAL=6h

# Keep the {outbox} hash tag so marker and Stream keys share a Redis Cluster slot.
OUTBOX_STREAM=gateway:{outbox}:events
OUTBOX_BATCH_SIZE=100
OUTBOX_POLL_INTERVAL=500ms
OUTBOX_LEASE=30s
OUTBOX_MAX_ATTEMPTS=10
OUTBOX_MAX_BACKOFF=5m
OUTBOX_STREAM_MAX_LENGTH=100000
OUTBOX_MARKER_TTL=720h

# Multi-instance immutable snapshot refresh. Admin writes also reload the local process immediately.
CONTENT_POLICY_REFRESH_INTERVAL=30s
PRICING_REFRESH_INTERVAL=30s

# Opt-in non-streaming JSON shadow traffic. A dedicated credential is mandatory;
# production client Authorization headers are never forwarded to the shadow.
SHADOW_BASE_URL=
SHADOW_API_KEY=
SHADOW_SAMPLE_RATE=0
SHADOW_TIMEOUT=20s
SHADOW_MAX_BODY_BYTES=2097152
SHADOW_MAX_CONCURRENT=16

# Used only by cmd/gateway-bootstrap; never commit the real value.
BOOTSTRAP_ADMIN_USERNAME=admin
BOOTSTRAP_ADMIN_PASSWORD=