.env.example

# ── Server ────────────────────────────────────────────────────────────────────
HOST=0.0.0.0
PORT=3030

# ── Authentication ────────────────────────────────────────────────────────────
# Plain-text username used for login (case-insensitive, trimmed).
AUTH_USERNAME=admin

# To generate a password hash and salt, run:
#   node -e "const crypto = require('crypto'); const salt = crypto.randomBytes(16).toString('hex'); const hash = crypto.scryptSync('YOUR_PASSWORD', Buffer.from(salt,'hex'), 64).toString('hex'); console.log('AUTH_PASSWORD_SALT=' + salt); console.log('AUTH_PASSWORD_HASH=' + hash);"
AUTH_PASSWORD_SALT=MUST_BE_SET
AUTH_PASSWORD_HASH=MUST_BE_SET

# ── Session ───────────────────────────────────────────────────────────────────
# Session lifetime in milliseconds (default: 8 hours).
SESSION_TTL_MS=28800000

# ── Rate Limiting ─────────────────────────────────────────────────────────────
# Minimum response time for login requests (timing-attack mitigation).
AUTH_MIN_RESPONSE_MS=900

# Sliding window for counting login attempts per identity.
LOGIN_WINDOW_MS=600000
LOGIN_MAX_REQUESTS=12

# Failure-based lockout: 3 consecutive failed logins within
# LOGIN_FAILURE_WINDOW_MS lock the client out for LOGIN_MAX_LOCKOUT_MS.
LOGIN_FAILURE_WINDOW_MS=1800000
LOGIN_MAX_LOCKOUT_MS=43200000

# Unauthenticated access rate limiting (applies to all protected routes).
# After UNAUTH_MAX_REQUESTS unauthenticated hits within UNAUTH_WINDOW_MS,
# subsequent requests are delayed by UNAUTH_PENALTY_MS and receive 429.
UNAUTH_WINDOW_MS=60000
UNAUTH_MAX_REQUESTS=2
UNAUTH_PENALTY_MS=5000

# ── Cookies / Proxy ──────────────────────────────────────────────────────────
# "auto" (default) | "always" | "never"
COOKIE_SECURE=auto

# Set to "1" if behind a reverse proxy that sets X-Forwarded-For / X-Forwarded-Proto.
TRUST_PROXY=0

# ── Logs ──────────────────────────────────────────────────────────────────────
# Maximum bytes to read from each PM2 log file (default: 5 MB).
MAX_LOG_BYTES_PER_FILE=5242880

# ── Monitoring Retention ───────────────────────────────────────────────────────
# How long CPU/memory metric samples are kept (default: 24 hours = 86400000 ms).
METRICS_RETENTION_MS=86400000

# How long stored log entries are kept (default: 14 days = 1209600000 ms).
LOGS_RETENTION_MS=1209600000

# ── Database ──────────────────────────────────────────────────────────────────
# Directory where the SQLite database is stored. The file pm2-hawkeye.db is
# created automatically inside this directory. Defaults to ./data.
SQLITE_DB_PATH=./data

# ── Deployments ───────────────────────────────────────────────────────────────
# Base directory where deployed apps are cloned. Each app gets its own
# subdirectory named after the PM2 process name. Defaults to ./apps.
DEPLOY_BASE_DIR=./apps