# RepoPulse UI port. The registered Unraid deployment publishes 1254 -> 8000.
REPOPULSE_PORT=1254

# Directory containing repositories. From a repository checkout, '..' scans sibling repositories.
# On the Unraid deploy runner this resolves to /mnt/cache/appdata/gitea-deploy-runners/sources.
REPOPULSE_SOURCE_ROOT=..

# Local Compose uses a checkout-relative bind mount. The production Compose
# deployment defaults to the named `repopulse_data` volume when this is unset,
# keeping SQLite state outside the exact-source tree that deployments replace.
REPOPULSE_DATA_ROOT=./data

# Keep only one repository scan active per application process by default.
REPOPULSE_MAX_CONCURRENT_SCANS=1
REPOPULSE_JOB_LEASE_SECONDS=900

# Transparent bounded analysis limits. Values are clamped by the backend.
REPOPULSE_SCAN_MAX_FILES=10000
REPOPULSE_SCAN_MAX_TEXT_BYTES=2000000
REPOPULSE_SCAN_MAX_TOTAL_TEXT_BYTES=50000000
REPOPULSE_SCAN_MAX_FINDINGS=2000
REPOPULSE_SCAN_MAX_SECRET_FINDINGS=20

# Retain compact history while limiting detailed report payload retention.
REPOPULSE_HISTORY_PER_REPOSITORY=200
REPOPULSE_FULL_REPORTS_PER_REPOSITORY=30
REPOPULSE_REPORT_RETENTION_DAYS=365

# Optional server-side Gitea connector. Never put this token in frontend code.
REPOPULSE_GITEA_URL=
REPOPULSE_GITEA_TOKEN=
REPOPULSE_GITEA_BRANCH_WORKERS=4
REPOPULSE_GITEA_WEBHOOK_SECRET=
REPOPULSE_GITEA_SYNC_INTERVAL_SECONDS=300
REPOPULSE_REPOSITORY_CACHE=/data/repos
REPOPULSE_MAX_QUEUED_SCANS=100

# Optional mutation boundary for deployments that are not already protected by
# an authenticated reverse proxy. Send the same value as X-RepoPulse-Token.
REPOPULSE_OPERATOR_TOKEN=