# Production API environment (non-secret keys). Secrets live in data/secrets/install.env
APP_ENV=production
ENABLE_DOCS=false
ENABLE_TEST_ROUTES=false
COOKIE_SECURE=true
ENABLE_RATE_LIMIT=true
EMAIL_DELIVERY_MODE=smtp
SEED_DEMO_USERS=false
JWT_ACCESS_TTL_MIN=15
JWT_REFRESH_TTL_DAYS=30
STORAGE_MODE=s3
S3_BUCKET=compton
S3_REGION=us-east-1
AVATAR_MAX_BYTES=2097152
MEDIA_URL_TTL_SECONDS=600
LOG_LEVEL=INFO
AUDIT_RETENTION_DAYS=90
COMPTON_SETTINGS_PATH=data/compton_settings.json
ADMIN_AUDIT_LOG_PATH=data/logs/admin-audit.jsonl
SERVER_LOG_PATH=data/logs/server.log
PASSWORD_DENYLIST_PATH=data/security/password-denylist.txt
# Set on server: FRONTEND_URL, PUBLIC_BASE_URL, CORS_ORIGINS, SMTP_*, DATABASE_URL (via install.env)