# helexa-upstream.example.toml — mesh-level account/authorization authority
#
# Copy to helexa-upstream.toml and adjust. Env overrides use the UPSTREAM_
# prefix with __ separators, e.g. UPSTREAM_DB__URL=postgres://...

[server]
# Plaintext listener; edge nginx terminates TLS (consistent with the stack).
listen = "0.0.0.0:8090"

[db]
# PostgreSQL connection URL. Required.
url = "postgres://helexa:helexa@localhost/helexa_upstream"
# max_connections = 16

[grant]
# Flat free token grant every email-verified account receives (the floor of
# the hybrid allocation; single-use top-up codes extend it).
# free_token_grant = 1000000

[abuse]
# When this many accounts share one registration fingerprint, all are
# silently deactivated (no notice to the user).
# fingerprint_account_threshold = 5

# -- Client auth: credentials operators' cortexes present to /authz/v1.
# Each token maps to an operator_id (served-usage attribution). When no
# tokens are configured the authz surface is OPEN (dev only). Distinct from
# end-user API keys, which ride inside the resolve request body.
# [[client_auth.tokens]]
# token = "replace-with-a-strong-shared-secret"
# operator_id = "lair-cafe"

[authz]
# Open reservations older than this are swept (released), self-healing a
# reservation whose settle/release from a cortex was lost.
# reservation_ttl_secs = 120
# sweep_interval_secs = 60

[auth]
# HMAC secret for signing web-session JWTs. MUST be overridden in prod via
# UPSTREAM_AUTH__JWT_SECRET; the built-in default is dev-only.
# jwt_secret = "change-me"
# session_ttl_secs = 604800        # 7 days
# email_token_ttl_secs = 86400     # 24 hours
# Frontend base URL used to build verify/reset links in emails.
app_base_url = "https://helexa.ai"

[email]
# "log" (dev: logs the link) or "smtp".
provider = "log"
# smtp_url = "smtp://user:pass@smtp.example.com:587"
from_addr = "helexa <no-reply@helexa.ai>"
