# AI Software Factory — realtime gateway (apps/realtime)
# Copy to .env and fill in real values. NEVER commit secrets to source control.

# WebSocket gateway port (ws)
PORT=4001
# Health/metrics HTTP port
HEALTH_PORT=4002
# JWT secret shared with the API (HS256; 32+ bytes)
JWT_SECRET=change-me-32-bytes-minimum-0000
# Redis (cross-node room fan-out, presence)
REDIS_URL=redis://localhost:6379
# API base URL (token/session verification fallback)
API_URL=http://localhost:4000
# Log level: fatal | error | warn | info | debug | trace
LOG_LEVEL=info
# Rate limiting: max messages per client per window
RATE_LIMIT_WINDOW_MS=60000
RATE_LIMIT_MAX=300
# Maximum sockets per document room
MAX_ROOM_SIZE=200
# Realtime DB (REALTIME_DB=0 → in-memory doc store, dev mode)
REALTIME_DB=1
# Shared service token for the API's internal endpoints (TASK-0092 slice 2).
# Non-empty → the doc store persists through the API's /internal/blocks/*
# (the production seam — one Postgres write funnel); empty → the
# in-process Prisma store (single-node dev). Must MATCH the API's
# INTERNAL_SERVICE_TOKEN (the guard fails closed when it is empty there).
INTERNAL_SERVICE_TOKEN=