# Optional overrides for bluearchive-toolkit-bat-api.service.
#
# Install as:
#   sudo install -o root -g root -m 0644 deployments/systemd/bat-api.env.example /etc/bluearchive-toolkit/bat-api.env
#
# Production contract:
#   - bat-api runs in the same server/container environment as Rust bat.
#   - The current resource_root comes from bat.sock RPC.
#   - Do not set BAT_API_RESOURCE_ROOT in production; it is only for local
#     fixtures or emergency read-only diagnostics when RPC is unavailable.
#   - Publish HTTP through a reverse proxy/TLS if exposed publicly; never expose
#     bat.sock outside the host.
#   - Player-facing deployments should set BAT_API_AUTH_TOKEN through a secret
#     manager or process environment, not in a committed file.

BAT_API_LISTEN=127.0.0.1:18080
BAT_API_PUBLIC_BASE_URL=http://127.0.0.1:18080
BAT_API_STATE_DIR=/var/lib/bluearchive-toolkit/daemon-state
BAT_API_SOCKET=/var/lib/bluearchive-toolkit/daemon-state/bat.sock
BAT_API_REQUIRE_INDEXED=true
BAT_API_VERIFY_SIZE=true
BAT_API_RPC_TIMEOUT=30s
BAT_API_REFRESH_INTERVAL=1m
BAT_API_SKIP_ENV_FILE=1
BAT_API_AUTH_QUERY_PARAM=bat_token
# BAT_API_AUTH_TOKEN=
# BAT_API_AUTH_EXEMPT_PATHS=/healthz,/readyz
BAT_API_TRUST_PROXY_HEADERS=false
BAT_API_ACCESS_LOG=true
BAT_API_RATE_LIMIT_RPS=30
BAT_API_RATE_LIMIT_BURST=120
BAT_API_MAX_RESOURCE_LIMIT=1000

# Local fixture / emergency only:
# BAT_API_RESOURCE_ROOT=/var/lib/bluearchive-toolkit/official/current

# Reserved for future API persistence:
# BAT_API_DATABASE_URL=postgres://bat:@127.0.0.1:5432/bat?sslmode=disable
# BAT_API_DATABASE_PASSWORD=
# BAT_API_REDIS_URL=redis://127.0.0.1:6379/0
# BAT_API_REDIS_PASSWORD=