.env.example

# Copy to .env and adjust. Never commit real secrets.

# --- Server ---
# Bind address. Use 127.0.0.1 for local-only (recommended default).
# Use 0.0.0.0 only behind a reverse proxy with TLS and access control.
GLS_HOST=127.0.0.1
GLS_PORT=8080
GLS_SHOW_BROWSER=1

# --- Session signing (REQUIRED for any public / multi-user deploy) ---
# Generate with: python -c "import secrets; print(secrets.token_urlsafe(48))"
GLS_STORAGE_SECRET=change-me-to-a-long-random-string

# --- GitHub API (optional but strongly recommended) ---
# Classic or fine-grained PAT with public_repo / Contents: Read for public repos.
# Higher rate limits and access to private repos you can see.
GITHUB_TOKEN=

# --- Abuse / resource limits ---
GLS_MAX_BATCH_URLS=15
GLS_MAX_PACKAGES_LOOKUP=80
GLS_MAX_DEPENDENCY_FILES=30
GLS_MAX_CONCURRENT_LOOKUPS=12
GLS_RATE_LIMIT_SCANS=20
GLS_RATE_LIMIT_WINDOW=3600

# --- Cache / history ---
GLS_LICENSE_CACHE_TTL=3600
GLS_LICENSE_CACHE_MAX=2000
GLS_HISTORY_MAX=100
# Prune history entries older than N days (0 = keep until max entries only)
GLS_HISTORY_MAX_AGE_DAYS=90

# --- Multi-user auth (optional; required for isolated history) ---
# Create users:  python -m gls.auth add-user alice
# Then set:
# GLS_AUTH_ENABLED=1
# GLS_USERS_FILE=/path/to/users.json   (default: users.json in the user data dir)
GLS_AUTH_ENABLED=0
# GLS_USERS_FILE=