# =============================================================================
# AI Usage Disclosure Standard - complete runtime configuration reference
# =============================================================================
# Copy to .env and adjust for your deployment. Values ending in *_FILE are
# recommended for Docker/Kubernetes secrets. If a *_FILE value is configured,
# the file is authoritative and the corresponding plain environment value is
# ignored.

# -----------------------------------------------------------------------------
# HTTP / public identity
# -----------------------------------------------------------------------------
LISTEN_ADDRESS=:8080
BASE_URL=http://localhost:8080
OUTPUT_BASE_URL=http://localhost:8080
PUBLIC_NAME=UCNG
CONTACT_URL=https://b1tsblog.org/page/ai
DEFAULT_LANGUAGE=de

# Used only by the binary's "--healthcheck" command inside containers.
HEALTHCHECK_URL=http://127.0.0.1:8080/healthz

# Runtime mode: full (UI + API), api (machine APIs only), bulk (Bulk UI + API).
SERVICE_MODE=full

# CORS for /v1, /schema and /context endpoints. Empty disables CORS headers.
API_ALLOWED_ORIGIN=*

# -----------------------------------------------------------------------------
# Reverse proxy, security and request logging
# -----------------------------------------------------------------------------
# Proxy headers are trusted only when the direct peer matches one of these
# CIDRs. TRUST_PROXY=true without a valid CIDR list is rejected at startup.
TRUST_PROXY=false
TRUSTED_PROXY_CIDRS=10.0.0.0/8,172.16.0.0/12,192.168.0.0/16

# Client IP addresses are omitted from structured request logs by default.
LOG_CLIENT_IP=false

# Enable only when the public service is served exclusively over HTTPS.
ENABLE_HSTS=false

# A commercial deployment can fail closed when no valid runtime licence exists.
REQUIRE_LICENSE=false
WHITE_LABEL=false

# -----------------------------------------------------------------------------
# Prometheus
# -----------------------------------------------------------------------------
# /metrics returns 404 while disabled. When enabled, a bearer token of at least
# 32 characters is mandatory. Prefer METRICS_TOKEN_FILE in containers.
METRICS_ENABLED=false
METRICS_TOKEN=
METRICS_TOKEN_FILE=

# -----------------------------------------------------------------------------
# Operator / legal / privacy information
# -----------------------------------------------------------------------------
# The application exposes /legal, /privacy and /accessibility in full and bulk
# mode. These pages are configurable operator information, not legal advice.
#
# LEGAL_STRICT=true prevents startup while the core operator/privacy fields are
# empty or contain REPLACE_ME, CHANGEME or TODO. For local development leave it
# false; set it to true after completing the production information.
LEGAL_STRICT=false

LEGAL_NAME=
LEGAL_ADDRESS=
LEGAL_REPRESENTATIVE=
LEGAL_EMAIL=
LEGAL_PHONE=
LEGAL_REGISTER=
LEGAL_REGISTER_NUMBER=
LEGAL_VAT_ID=

# Only set these after assessing whether a journalistically/editorially designed
# service requires a specifically named responsible person in your jurisdiction.
EDITORIAL_RESPONSIBLE_NAME=
EDITORIAL_RESPONSIBLE_ADDRESS=

DATA_PROTECTION_CONTACT=
HOSTING_PROVIDER=
HOSTING_ADDRESS=
LOG_RETENTION=7 days
DATA_RECIPIENTS=
THIRD_COUNTRY_TRANSFERS=
SUPERVISORY_AUTHORITY_NAME=
SUPERVISORY_AUTHORITY_URL=

# One of: not_applicable, not_participating, participating.
# If "participating" is selected and LEGAL_STRICT=true, body and URL are required.
CONSUMER_DISPUTE_STATUS=not_applicable
CONSUMER_DISPUTE_BODY=
CONSUMER_DISPUTE_URL=

ACCESSIBILITY_CONTACT=
ACCESSIBILITY_STATUS=

# -----------------------------------------------------------------------------
# Runtime licence - issued by the standalone Universal License Platform
# -----------------------------------------------------------------------------
# No private signing key and no configurable issuer public key belong here.
# Prefer LICENSE_TOKEN_FILE for Docker/Kubernetes secrets.
LICENSE_TOKEN=
LICENSE_TOKEN_FILE=
LICENSE_INSTANCE_ID=
LICENSE_MODE=offline
LICENSE_SERVER_URL=
LICENSE_CACHE_FILE=/data/license-lease.json
LICENSE_REFRESH_INTERVAL=15m
LICENSE_REQUEST_TIMEOUT=5s

# -----------------------------------------------------------------------------
# Bulk workspace / API
# -----------------------------------------------------------------------------
# The dedicated bulk image forces the intended bulk service mode and can require
# the licensed "bulk_api" capability. BULK_MAX_ITEMS may be further reduced by
# the licence limit "bulk_items".
BULK_MAX_ITEMS=500
BULK_MAX_BODY_BYTES=4194304
BULK_REQUIRE_API_KEY=false
BULK_API_KEY=
BULK_API_KEY_FILE=

# -----------------------------------------------------------------------------
# Removed / intentionally unsupported legacy marketing variables
# -----------------------------------------------------------------------------
# SALES_URL and PRICE_* are intentionally not runtime settings anymore. Pricing
# and Pro advertising were removed from the public application UI.