# ─── Bach to Basics — environment configuration ─────────────────────────────
# Copy this file to .env and customize for your deployment.
# .env is gitignored — never commit secrets.

# ── Authentication ───────────────────────────────────────────────────────────

# When set to a non-empty string, all API requests must include the header:
#   X-API-Key: <value>
# Leave blank for an open backend (local-only setup).
# Generate a strong key with:  python3 -c "import secrets; print(secrets.token_urlsafe(32))"
BACKEND_API_KEY=

# Set to 1 to make the server refuse to start if BACKEND_API_KEY is not
# configured. Useful for preventing accidental open deployments.
# REQUIRE_AUTH=1

# ── CORS ─────────────────────────────────────────────────────────────────────

# Comma-separated list of frontend origins allowed to call the backend.
# For local development the default is fine. For a public deployment, set
# this to your actual domain(s), e.g. "https://bach.example.com".
ALLOWED_ORIGINS=http://localhost:5173

# ── Rate limiting ─────────────────────────────────────────────────────────────

# Max requests per IP per minute. Set to 0 to disable
# (e.g. when running behind a reverse proxy that handles rate limiting).
RATE_LIMIT_PER_MIN=60

# Stricter limit for expensive endpoints (/omr/, /youtube/).
# HEAVY_RATE_LIMIT_PER_MIN=10

# Comma-separated IPs of trusted reverse proxies. When set, the real client
# IP is read from X-Forwarded-For instead of the connection address.
# TRUSTED_PROXY_IPS=10.0.0.1

# ── Processing timeouts ───────────────────────────────────────────────────────

# Hard timeout (seconds) for music21 conversions (MIDI-to-MusicXML, etc.).
# Raise for very dense scores; reduce for faster failure.
MUSIC21_TIMEOUT_S=60

# Hard timeout (seconds) for Audiveris OMR.
# Raise for large or multi-page PDFs.
AUDIVERIS_TIMEOUT_S=120

# Hard timeout (seconds) for auto-fingering generation (pianoplayer).
# Raise for very long or complex scores.
# FINGERING_TIMEOUT_S=120