config.yaml

server:
  host: "0.0.0.0"
  port: 7860
  mode: "release"

database:
  host: "${DATABASE_HOST}"
  # Use direct connection port 5432 (not PgBouncer 6543)
  # PgBouncer transaction mode does not support advisory locks needed for migrations
  port: 5432
  user: "${DATABASE_USER}"
  password: "${DATABASE_PASSWORD}"
  dbname: "${DATABASE_NAME}"
  sslmode: "require"
  max_open_conns: 20
  max_idle_conns: 5
  conn_max_lifetime_minutes: 10
  conn_max_idle_time_minutes: 3

redis:
  host: "${REDIS_HOST}"
  port: 6379
  password: "${REDIS_PASSWORD}"
  db: 0
  enable_tls: true

jwt:
  secret: "${JWT_SECRET}"
  expire_hour: 24

totp:
  encryption_key: "${TOTP_ENCRYPTION_KEY}"

default:
  admin_email: "${ADMIN_EMAIL}"
  admin_password: "${ADMIN_PASSWORD}"
  user_concurrency: 5
  user_balance: 0
  api_key_prefix: "sk-"
  rate_multiplier: 1.0

log:
  level: "info"
  format: "console"
  output:
    to_stdout: true
    to_file: false

run_mode: "standard"

security:
  url_allowlist:
    enabled: false
    allow_insecure_http: false
    allow_private_hosts: false