# Core
# Docker image names. The project builds three independent runtime images.
NEURALHUNT_SERVER_IMAGE=neuralhunt-server:local
NEURALHUNT_CUSTOMER_IMAGE=neuralhunt-customer-service:local

# Public listener: put this behind your normal HTTPS reverse proxy.
HTTP_ADDR=:8080
# Private control-plane listener: expose only through VPN/private reverse proxy.
ADMIN_HTTP_ADDR=:8081

# REQUIRED for normal/public operation. Generate unique secrets; startup refuses
# the known development defaults. For local throwaway development only, you may
# set ALLOW_INSECURE_DEV_DEFAULTS=1.
JWT_SECRET=replace-with-at-least-32-random-characters
ADMIN_USER=admin
ADMIN_PASSWORD=replace-with-a-strong-unique-password
# Admin session cookies are Secure by default. Set false only for local HTTP dev.
# Public/proxied HTTPS: true. VPN-only direct HTTP admin: auto.
ADMIN_COOKIE_SECURE=auto
# ALLOW_INSECURE_DEV_DEFAULTS=1

# WebSocket hardening. Same-origin browser WebSockets work automatically. Add
# explicit extra origins only when your proxy topology genuinely needs them.
WS_ALLOWED_ORIGINS=
WS_MAX_USER_CONNECTIONS=5000
WS_MAX_LEADERBOARD_CONNECTIONS=500
WS_MAX_PLACE_CONNECTIONS=1500
# Legacy token-in-query fallback is disabled by default because URLs are logged.
# WS_ALLOW_QUERY_TOKEN=1

# Local data paths. Docker Compose overrides both to /data/... so the named volume remains persistent.
SQLITE_PATH=./data/neuralhunt.db
ARTIFACT_DIR=./data/artifacts
# Optional absolute base URL. Leave empty to store relative /artifacts/... links.
ARTIFACT_PUBLIC_BASE_URL=

# Runtime defaults. These are copied into SQLite on first start and can then be
# changed in the Admin UI.
DEFAULT_GUESS_MIN_INTERVAL_SEC=10
DEFAULT_CLIENT_SUBMIT_INTERVAL_SEC=11
DEFAULT_GUESS_LOTTERY_WINDOW_SEC=60
DEFAULT_GUESS_LOTTERY_MAX_ACCEPTED=0
# Anti-Sybil friction for newly created browser identities. 0 disables each part.
DEFAULT_SYBIL_POW_BITS=15
DEFAULT_SYBIL_WARMUP_SEC=15
# OpenAI cost circuit breaker. Rolling windows; 0 disables the individual limit.
DEFAULT_OPENAI_MAX_CALLS_1H=20
DEFAULT_OPENAI_MAX_CALLS_24H=100
DEFAULT_OPENAI_MAX_COST_24H_USD=5.00
DEFAULT_OPENAI_BUDGET_RESERVE_USD=0.20
DEFAULT_TASK_RANGE_BITS=28
DEFAULT_ACTIVE_TASK_COUNT=1
DEFAULT_PRESENCE_TTL_SEC=35
DEFAULT_MAX_NODES=2000
DEFAULT_PUBLIC_SCORE_PRECISION=2

# Neural Place economy. Rewards can come from score progress, actually drawn
# lottery tickets and active signed Hunt time. Delegated worker rewards are
# always routed to the linked owner wallet. Set draw/time points to 0 to disable
# that reward source. Long idle gaps above MAX_GAP are never backfilled.
DEFAULT_PLACE_ENABLED=1
DEFAULT_PLACE_WIDTH=256
DEFAULT_PLACE_HEIGHT=256
DEFAULT_PLACE_POINTS_PER_SCORE=100
DEFAULT_PLACE_DRAW_POINTS=25
DEFAULT_PLACE_DRAW_BEACON_MULTIPLIER=1
DEFAULT_PLACE_TIME_POINTS=20
DEFAULT_PLACE_TIME_INTERVAL_SEC=60
DEFAULT_PLACE_TIME_MAX_GAP_SEC=120
DEFAULT_PLACE_PIXEL_COST=100

# RIFT full-art collection (default). For normal operation you only need these
# two values. Create the global RIFT character anchor once from Admin → ARTIFACT
# (or let the first winner create it as a fallback). Each task can then receive
# its own JPEG/PNG style reference in Admin → TASK ACTIONS; the bundled style
# reference is only the fallback for tasks without a custom style.
ARTIFACT_MODEL=gpt-image-2
OPENAI_API_KEY=

# Optional OpenAI endpoint override. Normally leave this unchanged/omitted.
OPENAI_BASE_URL=https://api.openai.com

# Advanced overrides only; the built-in preset already uses OpenAI, 1024x1536
# portrait output, medium quality and a deterministic programmatic SVG card frame.
# ARTIFACT_PRESET=raccoon_full_art_v1
# ARTIFACT_PROVIDER=openai
# ARTIFACT_WIDTH=1024
# ARTIFACT_HEIGHT=1536
# ARTIFACT_QUALITY=medium
# ARTIFACT_HTTP_TIMEOUT=4m

# Default rarity distribution for newly generated RIFT collectibles. These
# values seed the runtime settings and must add up to exactly 100.00.
DEFAULT_ARTIFACT_RARITY_COMMON_PCT=58.00
DEFAULT_ARTIFACT_RARITY_UNCOMMON_PCT=29.50
DEFAULT_ARTIFACT_RARITY_RARE_PCT=9.90
DEFAULT_ARTIFACT_RARITY_ULTRA_RARE_PCT=2.25
DEFAULT_ARTIFACT_RARITY_SPECIAL_ILLUSTRATION_PCT=0.35

# ARTIFACT_PROMPT=...          # only used by legacy preset/providers
# ARTIFACT_NEGATIVE_PROMPT=... # only used by legacy/local providers

# ComfyUI local API. COMFYUI_WORKFLOW_PATH must point to a workflow exported in
# API format. The workflow can use placeholders documented in README.md.
# When Neural Hunt runs in Docker and ComfyUI runs on the host, use
# http://host.docker.internal:8188 and mount/copy the workflow into /data.
COMFYUI_URL=
COMFYUI_WORKFLOW_PATH=
COMFYUI_POLL_TIMEOUT=4m

# AUTOMATIC1111 Stable Diffusion WebUI API. Start A1111 with --api.
# Docker-to-host example: http://host.docker.internal:7860
A1111_URL=
A1111_USER=
A1111_PASSWORD=
A1111_SAMPLER=
A1111_CFG_SCALE=7

# ─────────────────────────────────────────────────────────────────────────────
# OPTIONAL BEACON HUNT
# ─────────────────────────────────────────────────────────────────────────────
# 0 = legacy random lottery, 1 = PULSE/FLUX/ORBIT choice + future drand reveal.
# These defaults are stored in SQLite on first start and can then be changed in
# the game Admin UI under Runtime.
DEFAULT_BEACON_HUNT_ENABLED=0
DEFAULT_BEACON_BONUS_WEIGHT=2
# Public randomness beacon. Defaults are normally sufficient.
BEACON_DRAND_URL=https://api.drand.sh
BEACON_DRAND_BEACON_ID=quicknet

# ─────────────────────────────────────────────────────────────────────────────
# OPTIONAL HOSTED CUSTOMER SERVICE / PREPAID WORKERS
# ─────────────────────────────────────────────────────────────────────────────
# Same secret is read by the game server and Customer Service. Generate a
# separate random value; do not reuse JWT_SECRET.
CUSTOMER_SERVICE_SHARED_SECRET=replace-with-a-separate-32-plus-char-random-secret
# Game -> Customer Service internal callback for durable hosted-worker credit rewards.
# Docker/Compose: http://customer-service:8092 ; local go run: http://127.0.0.1:8092
CUSTOMER_SERVICE_INTERNAL_URL=http://127.0.0.1:8092

# Customer portal (8090), private Customer-Service admin (8091), and the
# Docker-network-only worker registration listener (8092).
CS_HTTP_ADDR=:8090
CS_ADMIN_HTTP_ADDR=:8091
CS_INTERNAL_ADDR=:8092
CS_PUBLIC_BASE_URL=https://customers.example.com
# Public customer portal stays HTTPS-only.
CS_COOKIE_SECURE=true
# Private Customer-Service admin (:8091): auto uses Secure over HTTPS and
# non-Secure when accessed directly over an encrypted VPN via HTTP.
CS_ADMIN_COOKIE_SECURE=auto
CS_SESSION_TTL=24h
CS_ADMIN_USER=admin
CS_ADMIN_PASSWORD=replace-with-another-strong-unique-password

# Manual prepaid top-ups are a deliberately gated test/support bypass. Keep 0
# in production unless you explicitly need private admin grants.
CS_ALLOW_MANUAL_CREDITS=0

# Customer engagement defaults. They are seeded into customer-service SQLite
# only once and can then be changed live in the private Customer Admin UI.
CS_CUSTOMER_LOGIN_ENABLED=true
CS_CUSTOMER_REGISTRATION_ENABLED=true
# 0 disables browser registration proof-of-work; 16 is a moderate default.
CS_REGISTRATION_POW_BITS=16
# When true, registration also requires an admin-generated one-shot invite.
CS_REGISTRATION_INVITE_REQUIRED=false
# Free prepaid credits for a newly created customer account. 0 disables.
CS_NEW_CUSTOMER_CREDITS=0
# Credits granted when a hosted worker improves its personal best score.
# 0 disables the reward. Normal browser/CLI identities are never credited here.
CS_POSITIVE_TIP_CREDITS=0

# Hosted worker billing: 1.0 means one credit is consumed for each paid minute
# of each running worker. Billing is prepaid; the worker stops before a minute
# that cannot be funded.
CS_WORKER_CREDITS_PER_MINUTE=1.0
# id:price-in-cents:CURRENCY:credits ; entries separated by semicolons.
CS_CREDIT_PACKAGES=starter:499:EUR:60;plus:1999:EUR:300;power:4999:EUR:900

# Docker worker orchestration. CS_WORKER_IMAGE is now a dedicated worker image
# and may point directly at a registry tag, e.g. registry.example.com/neuralhunt/worker:v4.1.
# When CS_WORKER_AUTO_PULL=true, Customer Service asks Docker Engine to pull the
# image if it is not already present. Public registries need no extra values.
# For a private registry, use a read-only deploy/robot token; credentials are
# sent only to Docker Engine as X-Registry-Auth and never to worker containers.
CS_WORKER_IMAGE=neuralhunt-worker:local
CS_WORKER_AUTO_PULL=true
CS_WORKER_REGISTRY_SERVER=
CS_WORKER_REGISTRY_USERNAME=
CS_WORKER_REGISTRY_PASSWORD=
# Leave empty for the dedicated worker image. Compatibility override for old
# monolithic V4.0 images: /app/neuralhunt-client
CS_WORKER_ENTRYPOINT=
CS_WORKER_NETWORK=neuralhunt_backend
CS_WORKER_REGISTER_URL=http://customer-service:8092/internal/workers/register
# direct = legacy docker.sock on Customer Service host
# controller = all new workers run on registered remote Service Controllers
# hybrid = prefer Service Controllers; local Docker is fallback / legacy host
CS_WORKER_ORCHESTRATION_MODE=direct
# Separate secret used only between Customer Service (Master) and Service Controllers.
# Required in controller/hybrid mode. Do not reuse JWT_SECRET or CUSTOMER_SERVICE_SHARED_SECRET.
SERVICE_CONTROLLER_SHARED_SECRET=replace-with-another-32-plus-char-random-secret
CS_CONTROLLER_OFFLINE_AFTER=45s
DOCKER_HOST=unix:///var/run/docker.sock

# ─────────────────────────────────────────────────────────────────────────────
# REMOTE SERVICE CONTROLLER (set these on each worker host)
# ─────────────────────────────────────────────────────────────────────────────
# Stable unique ID per host. Changing it creates a new controller identity.
SC_ID=worker-host-01
SC_NAME=Worker Host 01
# Customer Service internal listener reachable over your private VPN/network.
SC_MASTER_URL=http://192.168.16.3:8092
# This controller's private control endpoint as reachable from Customer Service.
SC_ADVERTISE_URL=http://192.168.16.20:8102
SC_CONTROL_ADDR=:8102
SC_ADMIN_ADDR=:8101
SC_ADMIN_USER=admin
SC_ADMIN_PASSWORD=replace-with-strong-controller-admin-password
SC_ADMIN_COOKIE_SECURE=auto
SC_MAX_WORKERS=500
SC_MAX_RUNNING_WORKERS=100
SC_HEARTBEAT_INTERVAL=15s
# Emergency UI image pull defaults. Normal Master commands still carry CS_WORKER_IMAGE.
SC_WORKER_IMAGE=neuralhunt-worker:local
SC_WORKER_REGISTRY_SERVER=
SC_WORKER_REGISTRY_USERNAME=
SC_WORKER_REGISTRY_PASSWORD=
# Optional per-host topology overrides. Recommended for distributed hosts.
SC_WORKER_NETWORK=bridge
# Must be reachable from the worker container. Usually the Customer Service VPN IP.
SC_WORKER_REGISTER_URL=http://192.168.16.3:8092/internal/workers/register
# Must be reachable from the remote host; normally use the public HTTPS game URL.
SC_GAME_PUBLIC_URL=https://play.example.com

# Game endpoints as seen from Customer Service. These localhost defaults make
# `go run ./cmd/customer-service` work when the game server also runs locally.
# docker-compose.yml explicitly overrides them to http://app:8080 / :8081.
CS_GAME_PUBLIC_URL=http://127.0.0.1:8080
CS_GAME_ADMIN_URL=http://127.0.0.1:8081
CUSTOMER_SQLITE_PATH=/customer-data/customer-service.db

# PayPal. Start in sandbox. Live mode is additionally locked in code until the
# explicit approval acknowledgement is set because paid prize/chance products
# may require PayPal approval depending on their exact commercial design.
PAYPAL_ENABLED=false
PAYPAL_ENVIRONMENT=sandbox
PAYPAL_CLIENT_ID=
PAYPAL_CLIENT_SECRET=
PAYPAL_WEBHOOK_ID=
# Only after provider/legal approval for the live product:
# PAYPAL_LIVE_APPROVAL_ACK=I_HAVE_PAYPAL_APPROVAL
# Host capacity guards independent of reverse-proxy request limits.
CS_MAX_WORKERS_PER_CUSTOMER=20
CS_MAX_WORKERS_GLOBAL=1000
CS_MAX_RUNNING_WORKERS_PER_CUSTOMER=10
CS_MAX_RUNNING_WORKERS_GLOBAL=100