2026-01-05 20:27:06 -08:00
|
|
|
# MacroPad Relay Server Configuration
|
|
|
|
|
# Copy this file to .env and adjust values as needed
|
|
|
|
|
|
|
|
|
|
# Server
|
|
|
|
|
PORT=3000
|
|
|
|
|
HOST=0.0.0.0
|
|
|
|
|
NODE_ENV=production
|
|
|
|
|
|
|
|
|
|
# Security
|
|
|
|
|
BCRYPT_ROUNDS=10
|
|
|
|
|
|
2026-07-17 10:15:23 -07:00
|
|
|
# Session ID length (default: 12 characters)
|
|
|
|
|
SESSION_ID_LENGTH=12
|
2026-01-05 20:27:06 -08:00
|
|
|
|
2026-07-17 10:15:23 -07:00
|
|
|
# Minimum password length enforced on session creation
|
|
|
|
|
MIN_PASSWORD_LENGTH=6
|
|
|
|
|
|
|
|
|
|
# Maximum number of concurrent sessions
|
|
|
|
|
MAX_SESSIONS=1000
|
|
|
|
|
|
|
|
|
|
# Prune sessions unused for this many days
|
|
|
|
|
SESSION_TTL_DAYS=90
|
|
|
|
|
|
|
|
|
|
# HTTP rate limiting (15 minute window, 300 requests per window)
|
|
|
|
|
RATE_LIMIT_WINDOW_MS=900000
|
|
|
|
|
RATE_LIMIT_MAX=300
|
|
|
|
|
|
|
|
|
|
# WebSocket upgrade rate limiting (per IP)
|
|
|
|
|
WS_UPGRADE_WINDOW_MS=60000
|
|
|
|
|
WS_UPGRADE_MAX=60
|
|
|
|
|
|
|
|
|
|
# Auth brute-force protection
|
|
|
|
|
AUTH_MAX_SOCKET_FAILURES=5
|
|
|
|
|
AUTH_LOCKOUT_MAX_ATTEMPTS=10
|
|
|
|
|
AUTH_LOCKOUT_WINDOW_MS=900000
|
|
|
|
|
AUTH_LOCKOUT_DURATION_MS=900000
|
|
|
|
|
|
|
|
|
|
# Allowed origins for CORS + WebSocket (comma-separated). Empty = same-host only.
|
|
|
|
|
# ALLOWED_ORIGINS=https://macropad.example.com
|
|
|
|
|
|
|
|
|
|
# Trust reverse proxy (number of hops, or true/false). Default: 1
|
|
|
|
|
TRUST_PROXY=1
|
2026-01-05 20:27:06 -08:00
|
|
|
|
|
|
|
|
# WebSocket timeouts (in milliseconds)
|
|
|
|
|
PING_INTERVAL=30000
|
|
|
|
|
REQUEST_TIMEOUT=30000
|
|
|
|
|
|
|
|
|
|
# Logging (error, warn, info, debug)
|
|
|
|
|
LOG_LEVEL=info
|
|
|
|
|
|
|
|
|
|
# Data directory (default: ./data)
|
|
|
|
|
# DATA_DIR=/path/to/data
|
