# Rendered by .gitea/workflows/deploy.yaml from the QUANTUS_INNER_HASH Gitea
# secret and rsynced to /etc/quantus-node/node.env (0640 root:quantus-node).
# The rendered file is never committed (generic.md §6).
#
# 32-byte wormhole preimage, 0x-prefixed — the node derives the reward address
# from it and logs that address on startup. Generated by
# script/infra-setup.sh --mint-reward-key.
QUANTUS_INNER_HASH={{QUANTUS_INNER_HASH}}

# Multiaddr other nodes should dial to reach this one, as a complete flag, or
# empty for a node with no public ingress. Behind NAT this is required — libp2p
# would otherwise advertise a 10.x address nobody outside can reach.
# Prefer a /dns4/ name over a literal address so a WAN IP change needs no
# redeploy (architecture public-dns.md uses per-site indirection names).
#   --public-addr /dns4/<site-indirection-name>/tcp/30333
QUANTUS_PUBLIC_ADDR={{QUANTUS_PUBLIC_ADDR}}

# Chain spec. Deliberately configuration rather than a value baked into the unit:
# Planck is a testnet, and switching to mainnet should be one line in the
# workflow env, not an edit to a static asset. The miner credential path
# (<base-path>/chains/<chain>/) follows from the same value.
QUANTUS_CHAIN={{QUANTUS_CHAIN}}

# Bootnodes, rendered as complete flags: each address is dialled (--bootnodes)
# and held as a reserved peer (--reserved-nodes) so the connection to the
# foundation's nodes is never evicted. Empty = the spec's own bootNodes only.
QUANTUS_BOOTNODES={{QUANTUS_BOOTNODES}}

# JSON-RPC exposure. Empty = loopback only. A complete flag string opens it:
#   --rpc-external --rpc-methods safe --rpc-cors all --rpc-rate-limit 300 \
#   --rpc-rate-limit-whitelisted-ips 127.0.0.1/32
# `safe` still permits author_submitExtrinsic (signed, so no key exposure) and
# every state read; it blocks author_rotateKeys, system_addReservedPeer and the
# rest of the unsafe set. Never `unsafe` on a validator.
QUANTUS_RPC_EXPOSE={{QUANTUS_RPC_EXPOSE}}