# REQUIRED: a long, random shared secret used to authenticate sync clients.
# Generate one, e.g.:  openssl rand -hex 32
# The server refuses to start with this placeholder or a value shorter than 24 chars.
SYNC_TOKEN=CHANGE_ME_generate_a_long_random_secret

PORT=12342

# REQUIRED S3 / S3-compatible (e.g. MinIO) connection. No defaults are assumed —
# the server fails to start if endpoint / access key / secret key is missing.
S3_ENDPOINT=http://localhost:8987
S3_REGION=us-east-1
S3_ACCESS_KEY_ID=CHANGE_ME
S3_SECRET_ACCESS_KEY=CHANGE_ME
S3_BUCKET=donut-sync
S3_FORCE_PATH_STYLE=true

# The address Donut Browser is sent to for file transfers. Set this whenever
# S3_ENDPOINT is only reachable from the server — running MinIO in the same
# compose file makes S3_ENDPOINT a container name like http://minio:9000, which
# resolves on the container network and nowhere else. Presigned URLs are signed
# against the host they name, so leaving this unset there hands every client a
# URL it cannot open: /health and /readyz stay green while every transfer fails.
# Defaults to S3_ENDPOINT, which is correct when storage is already public.
# S3_PUBLIC_ENDPOINT=https://storage.example.com