.env.example

# ═══════════════════════════════════════════════════════════
# Anamnesis — example environment file
# Copy to `.env` and fill in your own values.
# ═══════════════════════════════════════════════════════════

# ─── Core ───────────────────────────────────────────────────
# 6-digit PIN for user login (hashed with scrypt on first start)
APP_PIN=123456

NODE_ENV=development
PORT=3010

# ─── API tokens ─────────────────────────────────────────────
# Generate with: openssl rand -hex 32
API_TOKEN=
ADMIN_TOKEN=

# ─── CORS ───────────────────────────────────────────────────
# Comma-separated list of allowed origins.
# In production use a strict whitelist, never `*`.
CORS_ORIGINS=http://localhost:5173

# ─── WebAuthn (Face ID / Touch ID / Windows Hello) ─────────
# RP_ID must match your domain (no protocol, no port)
# For local dev: 'localhost'. For prod: 'your-domain.com'
WEBAUTHN_RP_ID=localhost
WEBAUTHN_RP_NAME=Anamnesis
# Optional: override expected origin. Defaults to http://localhost:5173 (dev) / https://{RP_ID} (prod)
# WEBAUTHN_ORIGIN=https://your-domain.com

# ─── Backups ────────────────────────────────────────────────
BACKUP_ENABLED=true
BACKUP_INTERVAL_HOURS=6
BACKUP_KEEP_COUNT=14

# AES-256 key for encrypted daily archives.
# Generate with: openssl rand -hex 32
# CRITICAL: store this key in a password manager, SEPARATELY from the server.
# Without it, encrypted offsite backups are unrecoverable after server loss.
BACKUP_ENCRYPTION_KEY=

# ─── Telegram (optional — for notifications + offsite backup) ─────
# Create a bot via @BotFather, then send /start to your bot,
# then get your chat_id from https://api.telegram.org/bot<TOKEN>/getUpdates
TELEGRAM_BOT_TOKEN=
TELEGRAM_CHAT_ID=