RC-6

.env.example

@@ -1,8 +1,26 @@
 # Core
+# Public listener: put this behind your normal HTTPS reverse proxy.
 HTTP_ADDR=:8080
-JWT_SECRET=change-me-to-a-long-random-secret
+# Private control-plane listener: expose only through VPN/private reverse proxy.
+ADMIN_HTTP_ADDR=:8081
+
+# REQUIRED for normal/public operation. Generate unique secrets; startup refuses
+# the known development defaults. For local throwaway development only, you may
+# set ALLOW_INSECURE_DEV_DEFAULTS=1.
+JWT_SECRET=replace-with-at-least-32-random-characters
 ADMIN_USER=admin
-ADMIN_PASSWORD=change-me
+ADMIN_PASSWORD=replace-with-a-strong-unique-password
+# Admin session cookies are Secure by default. Set false only for local HTTP dev.
+ADMIN_COOKIE_SECURE=true
+# ALLOW_INSECURE_DEV_DEFAULTS=1
+
+# WebSocket hardening. Same-origin browser WebSockets work automatically. Add
+# explicit extra origins only when your proxy topology genuinely needs them.
+WS_ALLOWED_ORIGINS=
+WS_MAX_USER_CONNECTIONS=5000
+WS_MAX_LEADERBOARD_CONNECTIONS=500
+# Legacy token-in-query fallback is disabled by default because URLs are logged.
+# WS_ALLOW_QUERY_TOKEN=1
 
 # Local data paths. Docker Compose overrides both to /data/... so the named volume remains persistent.
 SQLITE_PATH=./data/neuralhunt.db
@@ -16,6 +34,14 @@ DEFAULT_GUESS_MIN_INTERVAL_SEC=10
 DEFAULT_CLIENT_SUBMIT_INTERVAL_SEC=11
 DEFAULT_GUESS_LOTTERY_WINDOW_SEC=60
 DEFAULT_GUESS_LOTTERY_MAX_ACCEPTED=0
+# Anti-Sybil friction for newly created browser identities. 0 disables each part.
+DEFAULT_SYBIL_POW_BITS=15
+DEFAULT_SYBIL_WARMUP_SEC=15
+# OpenAI cost circuit breaker. Rolling windows; 0 disables the individual limit.
+DEFAULT_OPENAI_MAX_CALLS_1H=20
+DEFAULT_OPENAI_MAX_CALLS_24H=100
+DEFAULT_OPENAI_MAX_COST_24H_USD=5.00
+DEFAULT_OPENAI_BUDGET_RESERVE_USD=0.20
 DEFAULT_TASK_RANGE_BITS=28
 DEFAULT_ACTIVE_TASK_COUNT=1
 DEFAULT_PRESENCE_TTL_SEC=35