.env.example

# ── Proxy (runtime, loaded via Node --env-file) ──
PORTA_HOST=127.0.0.1       # Loopback only; set to an explicit private LAN IP for home network use
PORTA_PORT=3170
PORTA_CORS_ORIGINS=        # Required for a public host, e.g. https://porta.example.com

# ── Cloudflare deployment (used by pnpm dev:cloud / pnpm deploy) ──
# PORTA_TUNNEL_NAME=       # cloudflared tunnel name (e.g. my-porta-tunnel)
# PORTA_CF_PROJECT=        # Cloudflare Pages project name (e.g. porta)

# ── Public web dev server (used by pnpm dev / the Windows tunnel recipe) ──
PORTA_WEB_PORT=3070        # Must match the watchdog origin port and cloudflared ingress service
# PORTA_ALLOWED_HOSTS=     # Exact public hostname(s), comma-separated; no scheme or path
#                          # Example: porta.example.com
# For a public host, set PORTA_CORS_ORIGINS above to its full https:// origin.

# ── Access control (REQUIRED before exposing the dev server publicly) ──
# When PORTA_REQUIRE_AUTH is 1/true/yes/on, every request (page, /api, WebSocket) must present the
# token below or it is rejected (fail-closed). Sign in once via
#   https://<your-host>/?access_token=<PORTA_ACCESS_TOKEN>   (sets an HttpOnly cookie).
# Any other non-empty PORTA_REQUIRE_AUTH value is rejected as a configuration error.
# Use at least 32 characters. Generate a token with:
#   node -e "console.log(require('crypto').randomBytes(32).toString('base64url'))"
# PORTA_REQUIRE_AUTH=1
# PORTA_ACCESS_TOKEN=

# ── Web (build-time, production only) ──
# VITE_API_BASE=           # Absolute API URL (e.g. https://api.example.com)
#                          # Leave unset for local dev — Vite's proxy handles /api/* routing