2.0.2 Update und Anpassungen

.env.example

@@ -1,28 +1,128 @@
+# =============================================================================
+# AI Usage Disclosure Standard - complete runtime configuration reference
+# =============================================================================
+# Copy to .env and adjust for your deployment. Values ending in *_FILE are
+# recommended for Docker/Kubernetes secrets. If a *_FILE value is configured,
+# the file is authoritative and the corresponding plain environment value is
+# ignored.
+
+# -----------------------------------------------------------------------------
+# HTTP / public identity
+# -----------------------------------------------------------------------------
+LISTEN_ADDRESS=:8080
 BASE_URL=http://localhost:8080
 OUTPUT_BASE_URL=http://localhost:8080
 PUBLIC_NAME=AI Usage Disclosure
 CONTACT_URL=https://b1tsblog.org/page/ai
 DEFAULT_LANGUAGE=de
-TRUST_PROXY=false
 
-# Runtime mode: full (UI + API), api (API without public product/generator pages), bulk.
+# Used only by the binary's "--healthcheck" command inside containers.
+HEALTHCHECK_URL=http://127.0.0.1:8080/healthz
+
+# Runtime mode: full (UI + API), api (machine APIs only), bulk (Bulk UI + API).
 SERVICE_MODE=full
+
+# CORS for /v1, /schema and /context endpoints. Empty disables CORS headers.
 API_ALLOWED_ORIGIN=*
 
-# Runtime license issued by the standalone Universal License Platform.
-# No private keys or configurable public keys belong in this application.
-LICENSE_TOKEN=
-LICENSE_MODE=offline
-LICENSE_SERVER_URL=
-LICENSE_INSTANCE_ID=
-LICENSE_CACHE_FILE=/data/license-lease.json
-LICENSE_REFRESH_INTERVAL=15m
-LICENSE_REQUEST_TIMEOUT=5s
+# -----------------------------------------------------------------------------
+# Reverse proxy, security and request logging
+# -----------------------------------------------------------------------------
+# Proxy headers are trusted only when the direct peer matches one of these
+# CIDRs. TRUST_PROXY=true without a valid CIDR list is rejected at startup.
+TRUST_PROXY=false
+TRUSTED_PROXY_CIDRS=10.0.0.0/8,172.16.0.0/12,192.168.0.0/16
+
+# Client IP addresses are omitted from structured request logs by default.
+LOG_CLIENT_IP=false
+
+# Enable only when the public service is served exclusively over HTTPS.
+ENABLE_HSTS=false
+
+# A commercial deployment can fail closed when no valid runtime licence exists.
 REQUIRE_LICENSE=false
 WHITE_LABEL=false
 
-# Bulk API. The dedicated bulk image forces BULK_REQUIRE_API_KEY=true.
+# -----------------------------------------------------------------------------
+# Prometheus
+# -----------------------------------------------------------------------------
+# /metrics returns 404 while disabled. When enabled, a bearer token of at least
+# 32 characters is mandatory. Prefer METRICS_TOKEN_FILE in containers.
+METRICS_ENABLED=false
+METRICS_TOKEN=
+METRICS_TOKEN_FILE=
+
+# -----------------------------------------------------------------------------
+# Operator / legal / privacy information
+# -----------------------------------------------------------------------------
+# The application exposes /legal, /privacy and /accessibility in full and bulk
+# mode. These pages are configurable operator information, not legal advice.
+#
+# LEGAL_STRICT=true prevents startup while the core operator/privacy fields are
+# empty or contain REPLACE_ME, CHANGEME or TODO. For local development leave it
+# false; set it to true after completing the production information.
+LEGAL_STRICT=false
+
+LEGAL_NAME=
+LEGAL_ADDRESS=
+LEGAL_REPRESENTATIVE=
+LEGAL_EMAIL=
+LEGAL_PHONE=
+LEGAL_REGISTER=
+LEGAL_REGISTER_NUMBER=
+LEGAL_VAT_ID=
+
+# Only set these after assessing whether a journalistically/editorially designed
+# service requires a specifically named responsible person in your jurisdiction.
+EDITORIAL_RESPONSIBLE_NAME=
+EDITORIAL_RESPONSIBLE_ADDRESS=
+
+DATA_PROTECTION_CONTACT=
+HOSTING_PROVIDER=
+HOSTING_ADDRESS=
+LOG_RETENTION=7 days
+DATA_RECIPIENTS=
+THIRD_COUNTRY_TRANSFERS=
+SUPERVISORY_AUTHORITY_NAME=
+SUPERVISORY_AUTHORITY_URL=
+
+# One of: not_applicable, not_participating, participating.
+# If "participating" is selected and LEGAL_STRICT=true, body and URL are required.
+CONSUMER_DISPUTE_STATUS=not_applicable
+CONSUMER_DISPUTE_BODY=
+CONSUMER_DISPUTE_URL=
+
+ACCESSIBILITY_CONTACT=
+ACCESSIBILITY_STATUS=
+
+# -----------------------------------------------------------------------------
+# Runtime licence - issued by the standalone Universal License Platform
+# -----------------------------------------------------------------------------
+# No private signing key and no configurable issuer public key belong here.
+# Prefer LICENSE_TOKEN_FILE for Docker/Kubernetes secrets.
+LICENSE_TOKEN=
+LICENSE_TOKEN_FILE=
+LICENSE_INSTANCE_ID=
+LICENSE_MODE=offline
+LICENSE_SERVER_URL=
+LICENSE_CACHE_FILE=/data/license-lease.json
+LICENSE_REFRESH_INTERVAL=15m
+LICENSE_REQUEST_TIMEOUT=5s
+
+# -----------------------------------------------------------------------------
+# Bulk workspace / API
+# -----------------------------------------------------------------------------
+# The dedicated bulk image forces the intended bulk service mode and can require
+# the licensed "bulk_api" capability. BULK_MAX_ITEMS may be further reduced by
+# the licence limit "bulk_items".
 BULK_MAX_ITEMS=500
 BULK_MAX_BODY_BYTES=4194304
 BULK_REQUIRE_API_KEY=false
 BULK_API_KEY=
+BULK_API_KEY_FILE=
+
+# -----------------------------------------------------------------------------
+# Removed / intentionally unsupported legacy marketing variables
+# -----------------------------------------------------------------------------
+# SALES_URL and PRICE_* are intentionally not runtime settings anymore. Pricing
+# and Pro advertising were removed from the public application UI.