# Core
# Docker image names. The project builds three independent runtime images.
NEURALHUNT_SERVER_IMAGE=neuralhunt-server:local
NEURALHUNT_CUSTOMER_IMAGE=neuralhunt-customer-service:local

# Public listener: put this behind your normal HTTPS reverse proxy.
HTTP_ADDR=:8080
# Private control-plane listener: expose only through VPN/private reverse proxy.
ADMIN_HTTP_ADDR=:8081

# REQUIRED for normal/public operation. Generate unique secrets; startup refuses
# the known development defaults. For local throwaway development only, you may
# set ALLOW_INSECURE_DEV_DEFAULTS=1.
JWT_SECRET=replace-with-at-least-32-random-characters
ADMIN_USER=admin
ADMIN_PASSWORD=replace-with-a-strong-unique-password
# Admin session cookies are Secure by default. Set false only for local HTTP dev.
ADMIN_COOKIE_SECURE=true
# ALLOW_INSECURE_DEV_DEFAULTS=1

# WebSocket hardening. Same-origin browser WebSockets work automatically. Add
# explicit extra origins only when your proxy topology genuinely needs them.
WS_ALLOWED_ORIGINS=
WS_MAX_USER_CONNECTIONS=5000
WS_MAX_LEADERBOARD_CONNECTIONS=500
# Legacy token-in-query fallback is disabled by default because URLs are logged.
# WS_ALLOW_QUERY_TOKEN=1

# Local data paths. Docker Compose overrides both to /data/... so the named volume remains persistent.
SQLITE_PATH=./data/neuralhunt.db
ARTIFACT_DIR=./data/artifacts
# Optional absolute base URL. Leave empty to store relative /artifacts/... links.
ARTIFACT_PUBLIC_BASE_URL=

# Runtime defaults. These are copied into SQLite on first start and can then be
# changed in the Admin UI.
DEFAULT_GUESS_MIN_INTERVAL_SEC=10
DEFAULT_CLIENT_SUBMIT_INTERVAL_SEC=11
DEFAULT_GUESS_LOTTERY_WINDOW_SEC=60
DEFAULT_GUESS_LOTTERY_MAX_ACCEPTED=0
# Anti-Sybil friction for newly created browser identities. 0 disables each part.
DEFAULT_SYBIL_POW_BITS=15
DEFAULT_SYBIL_WARMUP_SEC=15
# OpenAI cost circuit breaker. Rolling windows; 0 disables the individual limit.
DEFAULT_OPENAI_MAX_CALLS_1H=20
DEFAULT_OPENAI_MAX_CALLS_24H=100
DEFAULT_OPENAI_MAX_COST_24H_USD=5.00
DEFAULT_OPENAI_BUDGET_RESERVE_USD=0.20
DEFAULT_TASK_RANGE_BITS=28
DEFAULT_ACTIVE_TASK_COUNT=1
DEFAULT_PRESENCE_TTL_SEC=35
DEFAULT_MAX_NODES=2000
DEFAULT_PUBLIC_SCORE_PRECISION=2

# RIFT full-art collection (default). For normal operation you only need these
# two values. Create the global RIFT character anchor once from Admin → ARTIFACT
# (or let the first winner create it as a fallback). Each task can then receive
# its own JPEG/PNG style reference in Admin → TASK ACTIONS; the bundled style
# reference is only the fallback for tasks without a custom style.
ARTIFACT_MODEL=gpt-image-2
OPENAI_API_KEY=

# Optional OpenAI endpoint override. Normally leave this unchanged/omitted.
OPENAI_BASE_URL=https://api.openai.com

# Advanced overrides only; the built-in preset already uses OpenAI, 1024x1536
# portrait output, medium quality and a deterministic programmatic SVG card frame.
# ARTIFACT_PRESET=raccoon_full_art_v1
# ARTIFACT_PROVIDER=openai
# ARTIFACT_WIDTH=1024
# ARTIFACT_HEIGHT=1536
# ARTIFACT_QUALITY=medium
# ARTIFACT_HTTP_TIMEOUT=4m
# ARTIFACT_PROMPT=...          # only used by legacy preset/providers
# ARTIFACT_NEGATIVE_PROMPT=... # only used by legacy/local providers

# ComfyUI local API. COMFYUI_WORKFLOW_PATH must point to a workflow exported in
# API format. The workflow can use placeholders documented in README.md.
# When Neural Hunt runs in Docker and ComfyUI runs on the host, use
# http://host.docker.internal:8188 and mount/copy the workflow into /data.
COMFYUI_URL=
COMFYUI_WORKFLOW_PATH=
COMFYUI_POLL_TIMEOUT=4m

# AUTOMATIC1111 Stable Diffusion WebUI API. Start A1111 with --api.
# Docker-to-host example: http://host.docker.internal:7860
A1111_URL=
A1111_USER=
A1111_PASSWORD=
A1111_SAMPLER=
A1111_CFG_SCALE=7

# ─────────────────────────────────────────────────────────────────────────────
# OPTIONAL BEACON HUNT
# ─────────────────────────────────────────────────────────────────────────────
# 0 = legacy random lottery, 1 = PULSE/FLUX/ORBIT choice + future drand reveal.
# These defaults are stored in SQLite on first start and can then be changed in
# the game Admin UI under Runtime.
DEFAULT_BEACON_HUNT_ENABLED=0
DEFAULT_BEACON_BONUS_WEIGHT=2
# Public randomness beacon. Defaults are normally sufficient.
BEACON_DRAND_URL=https://api.drand.sh
BEACON_DRAND_BEACON_ID=quicknet

# ─────────────────────────────────────────────────────────────────────────────
# OPTIONAL HOSTED CUSTOMER SERVICE / PREPAID WORKERS
# ─────────────────────────────────────────────────────────────────────────────
# Same secret is read by the game server and Customer Service. Generate a
# separate random value; do not reuse JWT_SECRET.
CUSTOMER_SERVICE_SHARED_SECRET=replace-with-a-separate-32-plus-char-random-secret

# Customer portal (8090), private Customer-Service admin (8091), and the
# Docker-network-only worker registration listener (8092).
CS_HTTP_ADDR=:8090
CS_ADMIN_HTTP_ADDR=:8091
CS_INTERNAL_ADDR=:8092
CS_PUBLIC_BASE_URL=https://customers.example.com
CS_COOKIE_SECURE=true
CS_SESSION_TTL=24h
CS_ADMIN_USER=admin
CS_ADMIN_PASSWORD=replace-with-another-strong-unique-password

# Manual prepaid top-ups are a deliberately gated test/support bypass. Keep 0
# in production unless you explicitly need private admin grants.
CS_ALLOW_MANUAL_CREDITS=0

# Hosted worker billing: 1.0 means one credit is consumed for each paid minute
# of each running worker. Billing is prepaid; the worker stops before a minute
# that cannot be funded.
CS_WORKER_CREDITS_PER_MINUTE=1.0
# id:price-in-cents:CURRENCY:credits ; entries separated by semicolons.
CS_CREDIT_PACKAGES=starter:499:EUR:60;plus:1999:EUR:300;power:4999:EUR:900

# Docker worker orchestration. CS_WORKER_IMAGE is now a dedicated worker image
# and may point directly at a registry tag, e.g. registry.example.com/neuralhunt/worker:v4.1.
# When CS_WORKER_AUTO_PULL=true, Customer Service asks Docker Engine to pull the
# image if it is not already present. Public registries need no extra values.
# For a private registry, use a read-only deploy/robot token; credentials are
# sent only to Docker Engine as X-Registry-Auth and never to worker containers.
CS_WORKER_IMAGE=neuralhunt-worker:local
CS_WORKER_AUTO_PULL=true
CS_WORKER_REGISTRY_SERVER=
CS_WORKER_REGISTRY_USERNAME=
CS_WORKER_REGISTRY_PASSWORD=
# Leave empty for the dedicated worker image. Compatibility override for old
# monolithic V4.0 images: /app/neuralhunt-client
CS_WORKER_ENTRYPOINT=
CS_WORKER_NETWORK=neuralhunt_backend
CS_WORKER_REGISTER_URL=http://customer-service:8092/internal/workers/register
DOCKER_HOST=unix:///var/run/docker.sock

# Game endpoints as seen from Customer Service. Compose sets them to app:8080/8081.
CS_GAME_PUBLIC_URL=http://app:8080
CS_GAME_ADMIN_URL=http://app:8081
CUSTOMER_SQLITE_PATH=/customer-data/customer-service.db

# PayPal. Start in sandbox. Live mode is additionally locked in code until the
# explicit approval acknowledgement is set because paid prize/chance products
# may require PayPal approval depending on their exact commercial design.
PAYPAL_ENABLED=false
PAYPAL_ENVIRONMENT=sandbox
PAYPAL_CLIENT_ID=
PAYPAL_CLIENT_SECRET=
PAYPAL_WEBHOOK_ID=
# Only after provider/legal approval for the live product:
# PAYPAL_LIVE_APPROVAL_ACK=I_HAVE_PAYPAL_APPROVAL
# Host capacity guards independent of reverse-proxy request limits.
CS_MAX_WORKERS_PER_CUSTOMER=20
CS_MAX_WORKERS_GLOBAL=1000
CS_MAX_RUNNING_WORKERS_PER_CUSTOMER=10
CS_MAX_RUNNING_WORKERS_GLOBAL=100