Initial commit

.env.example

@@ -0,0 +1,49 @@
+# ─── Bach to Basics — environment configuration ─────────────────────────────
+# Copy this file to .env and customize for your deployment.
+# .env is gitignored — never commit secrets.
+
+# ── Authentication ───────────────────────────────────────────────────────────
+
+# When set to a non-empty string, all API requests must include the header:
+#   X-API-Key: <value>
+# Leave blank for an open backend (local-only setup).
+# Generate a strong key with:  python3 -c "import secrets; print(secrets.token_urlsafe(32))"
+BACKEND_API_KEY=
+
+# Set to 1 to make the server refuse to start if BACKEND_API_KEY is not
+# configured. Useful for preventing accidental open deployments.
+# REQUIRE_AUTH=1
+
+# ── CORS ─────────────────────────────────────────────────────────────────────
+
+# Comma-separated list of frontend origins allowed to call the backend.
+# For local development the default is fine. For a public deployment, set
+# this to your actual domain(s), e.g. "https://bach.example.com".
+ALLOWED_ORIGINS=http://localhost:5173
+
+# ── Rate limiting ─────────────────────────────────────────────────────────────
+
+# Max requests per IP per minute. Set to 0 to disable
+# (e.g. when running behind a reverse proxy that handles rate limiting).
+RATE_LIMIT_PER_MIN=60
+
+# Stricter limit for expensive endpoints (/omr/, /youtube/).
+# HEAVY_RATE_LIMIT_PER_MIN=10
+
+# Comma-separated IPs of trusted reverse proxies. When set, the real client
+# IP is read from X-Forwarded-For instead of the connection address.
+# TRUSTED_PROXY_IPS=10.0.0.1
+
+# ── Processing timeouts ───────────────────────────────────────────────────────
+
+# Hard timeout (seconds) for music21 conversions (MIDI-to-MusicXML, etc.).
+# Raise for very dense scores; reduce for faster failure.
+MUSIC21_TIMEOUT_S=60
+
+# Hard timeout (seconds) for Audiveris OMR.
+# Raise for large or multi-page PDFs.
+AUDIVERIS_TIMEOUT_S=120
+
+# Hard timeout (seconds) for auto-fingering generation (pianoplayer).
+# Raise for very long or complex scores.
+# FINGERING_TIMEOUT_S=120