# Copy to .env and edit. .env is gitignored.

POSTGRES_USER=bucketeer
POSTGRES_PASSWORD=change-me-strong
POSTGRES_DB=bucketeer

# Local compose (private bridge network, no TLS):
DATABASE_URL=postgres://bucketeer:change-me-strong@postgres:5432/bucketeer?sslmode=disable

# Production: use a TLS-enabled database instead, e.g.
# DATABASE_URL=postgres://user:pass@db.example.com:5432/bucketeer?sslmode=verify-full

# DNS_SERVERS unset = ~20 curated public resolvers. Options:
#   DNS_SERVERS=system             use the OS resolver
#   DNS_SERVERS=1.1.1.1,8.8.8.8    your own comma-separated list
# DNS_SERVERS=system
DNS_WORKERS=16
DNS_CACHE_SIZE=262144
DEDUP_SIZE=262144
LOG_LEVEL=info
LOG_FORMAT=text          # json for log pipelines / LLM analysis
ACTIVE_PROBING=false
PROBE_DEEP=true          # unauthenticated read-only DB protocol checks
INDEX_ENABLED=true       # index metadata of readable resources
INDEX_MAX_OBJECTS=1000

# Optional HTTP basic auth for the web UI (/ and /api/*):
# UI_USER=admin
# UI_PASS=change-me-strong

# Bucket-name discovery (finds open buckets; CT SANs are domains, not buckets)
BUCKET_SCAN_ENABLED=true
BUCKET_SCAN_QPS=50
BUCKET_SCAN_WORKERS=16
BUCKET_SCAN_QUEUE=65536