# AKOS runtime configuration (copy to .env on the node; mode 600; never commit)
DATABASE_URL=postgresql://akos@127.0.0.1:5432/akos
SESSION_SECRET=<64 random hex chars: python3 -c "import secrets;print(secrets.token_hex(32))">
AKOS_PUBLIC_URL=https://akos.spboucher.ai
AKOS_PORT=8520
AKOS_BIND=127.0.0.1,wg1          # loopback + WireGuard address only (never the LAN interface)
AKOS_PROXY_PORT=8521
AKOS_TRUSTED_PROXIES=127.0.0.1,::1,10.67.0.1
AKOS_DATA_DIR=/Users/<user>/apps/akos/data
AKOS_LOG_DIR=/Users/<user>/apps/akos/logs
AKOS_VAULT_BACKEND=keychain       # keychain (macOS) | file (tests only)
AKOS_KEYCHAIN_SERVICE=akos
AKOS_ADMIN_EMAIL=<bootstrap admin email>      # used once, when the users table is empty
AKOS_ADMIN_PASSWORD=<bootstrap admin password>
AKOS_RATE_LIMIT_PER_MINUTE=300
AKOS_EXECUTE_TIMEOUT=30
AKOS_MAX_RESPONSE_BYTES=26214400
AKOS_WORKER_CONCURRENCY=3
AKOS_BACKUP_DIR=/Users/<user>/backups/akos
AKOS_BACKUP_REMOTE=M3U96b:~/backups/akos
AKOS_SANDBOX=1
AKOS_SECURE_COOKIES=1
AKOS_ENV=production