RC-7

.env.example

@@ -1,4 +1,8 @@
 # Core
+# Docker image names. The project builds three independent runtime images.
+NEURALHUNT_SERVER_IMAGE=neuralhunt-server:local
+NEURALHUNT_CUSTOMER_IMAGE=neuralhunt-customer-service:local
+
 # Public listener: put this behind your normal HTTPS reverse proxy.
 HTTP_ADDR=:8080
 # Private control-plane listener: expose only through VPN/private reverse proxy.
@@ -85,3 +89,83 @@ A1111_USER=
 A1111_PASSWORD=
 A1111_SAMPLER=
 A1111_CFG_SCALE=7
+
+# ─────────────────────────────────────────────────────────────────────────────
+# OPTIONAL BEACON HUNT
+# ─────────────────────────────────────────────────────────────────────────────
+# 0 = legacy random lottery, 1 = PULSE/FLUX/ORBIT choice + future drand reveal.
+# These defaults are stored in SQLite on first start and can then be changed in
+# the game Admin UI under Runtime.
+DEFAULT_BEACON_HUNT_ENABLED=0
+DEFAULT_BEACON_BONUS_WEIGHT=2
+# Public randomness beacon. Defaults are normally sufficient.
+BEACON_DRAND_URL=https://api.drand.sh
+BEACON_DRAND_BEACON_ID=quicknet
+
+# ─────────────────────────────────────────────────────────────────────────────
+# OPTIONAL HOSTED CUSTOMER SERVICE / PREPAID WORKERS
+# ─────────────────────────────────────────────────────────────────────────────
+# Same secret is read by the game server and Customer Service. Generate a
+# separate random value; do not reuse JWT_SECRET.
+CUSTOMER_SERVICE_SHARED_SECRET=replace-with-a-separate-32-plus-char-random-secret
+
+# Customer portal (8090), private Customer-Service admin (8091), and the
+# Docker-network-only worker registration listener (8092).
+CS_HTTP_ADDR=:8090
+CS_ADMIN_HTTP_ADDR=:8091
+CS_INTERNAL_ADDR=:8092
+CS_PUBLIC_BASE_URL=https://customers.example.com
+CS_COOKIE_SECURE=true
+CS_SESSION_TTL=24h
+CS_ADMIN_USER=admin
+CS_ADMIN_PASSWORD=replace-with-another-strong-unique-password
+
+# Manual prepaid top-ups are a deliberately gated test/support bypass. Keep 0
+# in production unless you explicitly need private admin grants.
+CS_ALLOW_MANUAL_CREDITS=0
+
+# Hosted worker billing: 1.0 means one credit is consumed for each paid minute
+# of each running worker. Billing is prepaid; the worker stops before a minute
+# that cannot be funded.
+CS_WORKER_CREDITS_PER_MINUTE=1.0
+# id:price-in-cents:CURRENCY:credits ; entries separated by semicolons.
+CS_CREDIT_PACKAGES=starter:499:EUR:60;plus:1999:EUR:300;power:4999:EUR:900
+
+# Docker worker orchestration. CS_WORKER_IMAGE is now a dedicated worker image
+# and may point directly at a registry tag, e.g. registry.example.com/neuralhunt/worker:v4.1.
+# When CS_WORKER_AUTO_PULL=true, Customer Service asks Docker Engine to pull the
+# image if it is not already present. Public registries need no extra values.
+# For a private registry, use a read-only deploy/robot token; credentials are
+# sent only to Docker Engine as X-Registry-Auth and never to worker containers.
+CS_WORKER_IMAGE=neuralhunt-worker:local
+CS_WORKER_AUTO_PULL=true
+CS_WORKER_REGISTRY_SERVER=
+CS_WORKER_REGISTRY_USERNAME=
+CS_WORKER_REGISTRY_PASSWORD=
+# Leave empty for the dedicated worker image. Compatibility override for old
+# monolithic V4.0 images: /app/neuralhunt-client
+CS_WORKER_ENTRYPOINT=
+CS_WORKER_NETWORK=neuralhunt_backend
+CS_WORKER_REGISTER_URL=http://customer-service:8092/internal/workers/register
+DOCKER_HOST=unix:///var/run/docker.sock
+
+# Game endpoints as seen from Customer Service. Compose sets them to app:8080/8081.
+CS_GAME_PUBLIC_URL=http://app:8080
+CS_GAME_ADMIN_URL=http://app:8081
+CUSTOMER_SQLITE_PATH=/customer-data/customer-service.db
+
+# PayPal. Start in sandbox. Live mode is additionally locked in code until the
+# explicit approval acknowledgement is set because paid prize/chance products
+# may require PayPal approval depending on their exact commercial design.
+PAYPAL_ENABLED=false
+PAYPAL_ENVIRONMENT=sandbox
+PAYPAL_CLIENT_ID=
+PAYPAL_CLIENT_SECRET=
+PAYPAL_WEBHOOK_ID=
+# Only after provider/legal approval for the live product:
+# PAYPAL_LIVE_APPROVAL_ACK=I_HAVE_PAYPAL_APPROVAL
+# Host capacity guards independent of reverse-proxy request limits.
+CS_MAX_WORKERS_PER_CUSTOMER=20
+CS_MAX_WORKERS_GLOBAL=1000
+CS_MAX_RUNNING_WORKERS_PER_CUSTOMER=10
+CS_MAX_RUNNING_WORKERS_GLOBAL=100