.env.example

# Copy to .env before starting. Generate SESSION_SECRET with:
# node -e "console.log(require('node:crypto').randomBytes(48).toString('hex'))"
# Runtime mode; use development for local testing.
NODE_ENV=production
# Port the web server listens on.
PORT=3000
# Network address the server binds to.
HOST=0.0.0.0
# Secret used to sign and protect login sessions; replace this and keep it private.
SESSION_SECRET=replace-with-at-least-32-random-characters
# Comma-separated usernames allowed to register and sign in.
WHITELIST=alice,bob
# Set to FALSE to allow any valid username to register and sign in.
WHITELISTFEATURE=TRUE
# How long a login session remains valid.
SESSION_MAX_AGE_HOURS=24
# Enable HTTPS-specific security headers when requests are served over HTTPS.
HTTPS_ENABLED=true
# Require HTTPS for the session cookie; set false for local HTTP.
COOKIE_SECURE=true
# Trust one reverse proxy for client IP and HTTPS headers.
TRUST_PROXY=false

# Directory for the database and stored files.
DATA_DIRECTORY=/app/data
# Maximum size of a single uploaded file.
MAX_FILE_SIZE_MB=100
# Storage quota per user.
MAX_STORAGE_MB=5000
# Maximum simultaneous uploads.
MAX_CONCURRENT_UPLOADS=3
# Maximum combined size of temporary uploads.
MAX_GLOBAL_STAGING_MB=300
# Maximum combined size of quarantined files.
MAX_GLOBAL_QUARANTINE_MB=1000
# Number of files scanned at the same time.
SCAN_CONCURRENCY=1
# Maximum time allowed to scan one file.
SCAN_TIMEOUT_SECONDS=120
# Largest file the scanner will inspect.
MAX_SCAN_FILE_SIZE_MB=100
# Days quarantined files are kept.
QUARANTINE_RETENTION_DAYS=7
# Maximum number of entries inspected in an archive.
MAX_ARCHIVE_ENTRIES=1000
# Maximum total uncompressed archive size.
MAX_ARCHIVE_UNCOMPRESSED_MB=500
# Maximum uncompressed size of one archive entry.
MAX_ARCHIVE_ENTRY_MB=100
# Maximum allowed archive compression ratio.
MAX_ARCHIVE_COMPRESSION_RATIO=100