# --- VAPID Keys ---
# Generate using: npx web-push generate-vapid-keys
# The Public Key is needed by your PWA to subscribe.
VAPID_PUBLIC_KEY=YOUR_VAPID_PUBLIC_KEY
# The Private Key MUST be kept secret on the server.
VAPID_PRIVATE_KEY=YOUR_VAPID_PRIVATE_KEY
# A contact URL for the push service (mailto: or https:)
VAPID_SUBJECT=mailto:admin@yourdomain.com

# --- Application Settings ---
# Port the Node.js server will listen on inside the container
PORT=3000
# Path to the JSON file storing Flic button serial -> PWA subscription mappings
SUBSCRIPTIONS_FILE=/app/subscriptions.json

# --- Security ---
# (Optional) A secret bearer token. If set, Flic requests must include "Authorization: Bearer <YOUR_SECRET>" header.
# Generate a strong secret, e.g., using: openssl rand -hex 32
FLIC_SECRET=YOUR_OPTIONAL_FLIC_SECRET_TOKEN

# --- CORS Settings ---
# Comma-separated list of allowed origins for CORS requests (e.g., your PWA's domain)
# Leave empty or unset to allow any origin (less secure, useful for testing)
# Example: ALLOWED_ORIGINS=https://pwa.yourdomain.com,http://localhost:8080
ALLOWED_ORIGINS=https://game-timer.virtonline.eu
# Comma-separated list of allowed HTTP methods
ALLOWED_METHODS=POST,OPTIONS
# Comma-separated list of allowed HTTP headers
ALLOWED_HEADERS=Content-Type,Authorization