TZ=Asia/Shanghai
# Default local access. For NAS LAN access set this to the NAS LAN IP (recommended)
# or explicitly 0.0.0.0. No router, reverse proxy or firewall rules are modified.
WEB_BIND=127.0.0.1
WEB_PORT=18787
KOKONNA_MOCK=true
KOKONNA_WRITE_ENABLED=false
KOKONNA_API_KEY=
FRAME_FLOW_TOKEN=
# Optional secret files mounted read-only through your own Compose override:
# KOKONNA_API_KEY_FILE=/run/secrets/kokonna_api_key
# FRAME_FLOW_TOKEN_FILE=/run/secrets/frame_flow_token
CORS_ALLOWED_ORIGINS=
IMAGE_URL_ALLOWED_HOSTS=
BUILD_COMMIT=development
BUILD_TIME=unknown

# Optional read-only NAS photo mount; use deploy/docker-compose.photos.yml.
# NAS_PHOTOS_DIR=/volume2/photo
# PHOTO_ROOT=/photos
# Optional WebDAV credential reference; prefer a secret file under /config.
# FRAME_FLOW_SOURCE_CLOUD_FILE=/config/webdav-cloud.secret

# Optional existing group with photo read permission; does not change NAS ACLs.
# NAS_PHOTOS_GID=101

# Optional Synology Photos shared-space people filter. Configure a pinned NAS endpoint.
# Login in the photo-source editor; only the session is saved in /config (mode 0600).
SYNOLOGY_PHOTOS_URL=
SYNOLOGY_PHOTOS_CERT_SHA256=

# Build-only mirror hosts; official defaults work outside mainland China.
# For mainland NAS builds: source ./deploy/build-cn.env before build-verify.sh.
DEBIAN_MIRROR=deb.debian.org
DEBIAN_SECURITY_MIRROR=deb.debian.org