# newsfeed-api configuration (production). Rendered to /etc/newsfeed/config.toml.
#
# This file contains no secrets — newsfeed uses SQLite (no DB password), and session
# cookies / API tokens are random values hashed at rest (no signing key). It is therefore
# committed as concrete values, not {{PLACEHOLDER}} templates. Env (NEWSFEED_*) still
# overrides any value at runtime.

# Bind the mesh-routable address so the oolon proxy can reach it. firewalld
# (newsfeed-api service) bounds who may connect; TLS terminates at oolon.
bind = "0.0.0.0:22672"

database_path = "/var/lib/newsfeed/newsfeed.db"
session_ttl_days = 30
max_db_connections = 5

# Same-origin in production (oolon serves the SPA and proxies the API), so no CORS.
cors_origins = []

# Cookies are only sent over HTTPS (the browser talks to oolon over TLS).
cookie_secure = true