# Generate separate values with: openssl rand -hex 32
API_KEY=replace-with-a-long-random-api-key-at-least-32-characters
POSTGRES_PASSWORD=replace-with-a-random-hex-database-password
APP_ENV=development
PUBLIC_BASE_URL=http://127.0.0.1:8000
MAX_UPLOAD_BYTES=33554432
PARSE_TIMEOUT_SECONDS=60
LINK_TTL_SECONDS=604800
MAX_PENDING_JOBS=100
# Production: APP_ENV=production and PUBLIC_BASE_URL=https://your-domain.example
# Storage: auto uses S3 when S3_BUCKET is set; otherwise local. Use s3 to require S3.
STORAGE_BACKEND=auto
S3_BUCKET=
# AWS S3: leave endpoint blank. S3-compatible provider: its service endpoint, not a public file URL.
S3_ENDPOINT_URL=
S3_REGION=us-east-1
# Optional namespace inside the bucket, e.g. altium/production (empty preserves old S3 keys).
S3_PREFIX=
# auto, path (commonly MinIO/S3-compatible), or virtual
S3_ADDRESSING_STYLE=auto
S3_CONNECT_TIMEOUT=5
S3_READ_TIMEOUT=60
S3_MAX_ATTEMPTS=3
# Credentials are server-only. Omit for IAM/workload credentials.
# AWS_ACCESS_KEY_ID=
# AWS_SECRET_ACCESS_KEY=
# AWS_SESSION_TOKEN=
# Optional custom CA bundle path, available in both API/worker containers:
# AWS_CA_BUNDLE=/path/to/provider-ca.pem
# Optional encryption: empty (provider default), AES256 or aws:kms.
S3_SERVER_SIDE_ENCRYPTION=
S3_KMS_KEY_ID=
# API and workers must use exactly the same bucket/prefix/endpoint/region.