# -> %h/idea-collect/secrets/backend.env (rendered by Ansible from vault)
DATABASE_URL=postgres://idea:change-me-strong@postgres:5432/idea?sslmode=disable
LISTEN_ADDR=:8080

# Served same-origin by Caddy in production, so the cookie is first-party and CORS is unused.
ALLOWED_ORIGINS=
COOKIE_SECURE=true
SESSION_TTL=2h
# openssl rand -base64 48
SESSION_SECRET=replace-with-48-random-bytes-base64

AUTH_RATE_PER_MINUTE=10
AUTH_RATE_BURST=5

GITHUB_APP_ID=123456
GITHUB_APP_INSTALLATION_ID=12345678
GITHUB_APP_PRIVATE_KEY_FILE=/etc/idea/github-app.pem