# Application runtime configuration. Copy from config.example.yaml and fill in real values.
# All secrets (DB password, SFTP user hashes/keys) live here - keep it out of version control.

server:
  host: 127.0.0.1      # bind address; Apache proxies f.zikai.wang -> here
  port: 6867           # internal port; MUST match the Apache ProxyPass target
  workers: 1           # uvicorn worker count

database:
  host: 127.0.0.1
  port: 3306
  user: zikai_filesvc
  password: "CHANGE_ME"        # generated/overwritten by setup.sh provisioning
  database: zikai_filesvc      # independent new database (not shared with other apps)
  pool_size: 5
  pool_recycle: 1800

storage:
  upload_dir: ./uploads        # where uploaded files are written (shared with SFTP)
  chunk_bytes: 1048576         # 1 MiB streaming chunk for HTTP upload (keeps RAM flat)
  sha256_on_upload: true       # compute sha256 while streaming to disk
  chunk_session_dir: ./.work   # 分片上传会话暂存目录（相对 upload_dir），拼接在此完成
  chunk_session_ttl_seconds: 300  # 被放弃会话的存活秒数；后台 reaper 据此清理临时文件

sftp:
  enabled: true
  host: 0.0.0.0                # SFTP cannot go through Apache's HTTP proxy, expose directly
  port: 2022                   # open this port in the firewall for external SFTP clients
  host_key_path: ./keys/ssh_host_ed25519_key
  authorized_keys_path: ./keys/authorized_keys
  # Each user may authenticate by password (bcrypt hash) and/or by a public key listed
  # in authorized_keys_path. Generate a bcrypt hash with:
  #   python -c "import bcrypt;print(bcrypt.hashpw(b'yourpass',bcrypt.gensalt()).decode())"
  users:
    - username: uploader
      password_hash: "CHANGE_ME_BCRYPT_HASH"
      # public keys for this user go in keys/authorized_keys (one key per line, OpenSSH format)

docs:
  # /docs, /redoc and /openapi.json are protected with HTTP Basic Auth.
  # Password is stored as plaintext here -- this file is root-owned and lives
  # only on this server; comparison is constant-time. No hashing needed.
  enabled: true
  username: admin
  password: "CHANGE_ME"
  realm: "zikai docs"

tunnel:
  # 反向隧道：user 端通过 SSH 反向转发把本地服务暴露到 server，server 再经
  # HTTP 路由 /api/userPort/{userName} 对公网提供访问。disabled 时 SSH 拒绝转发请求。
  enabled: false
  users:
    - username: tunneluser
      password_hash: "CHANGE_ME_BCRYPT_HASH"   # bcrypt，生成方式同 sftp.users
      tunnel_port: 9001   # server 侧 SSH remote forward 绑定的本地端口
      local_port: 8080    # user 端要暴露的本地服务端口（仅记录用）

whiteboard:
  # 共享白板：/whiteboard/{id} 公开访问并实时协作（WebSocket）；管理页 /whiteboard-admin
  # 与 /api/admin/whiteboards 走 docs 同款 Basic Auth。
  # 心跳：客户端每 heartbeat_interval_seconds 发一次 ping；连续丢失 heartbeat_miss_threshold
  # 次判失活，服务端关闭并移除该连接。
  heartbeat_interval_seconds: 3
  heartbeat_miss_threshold: 5
  max_board_id_length: 64      # board_id 合法字符 [a-zA-Z0-9_-]，长度上限
  list_limit: 100              # 管理页单次列表上限