# Application runtime configuration. Copy from config.example.yaml and fill in real values.
# All secrets (DB password, SFTP user hashes/keys) live here - keep it out of version control.

server:
  host: 127.0.0.1      # bind address; Apache proxies f.zikai.wang -> here
  port: 6867           # internal port; MUST match the Apache ProxyPass target
  workers: 1           # uvicorn worker count

database:
  host: 127.0.0.1
  port: 3306
  user: zikai_filesvc
  password: "CHANGE_ME"        # generated/overwritten by setup.sh provisioning
  database: zikai_filesvc      # independent new database (not shared with other apps)
  pool_size: 5
  pool_recycle: 1800

storage:
  upload_dir: ./uploads        # where uploaded files are written (shared with SFTP)
  chunk_bytes: 1048576         # 1 MiB streaming chunk for HTTP upload (keeps RAM flat)
  sha256_on_upload: true       # compute sha256 while streaming to disk

sftp:
  enabled: true
  host: 0.0.0.0                # SFTP cannot go through Apache's HTTP proxy, expose directly
  port: 2022                   # open this port in the firewall for external SFTP clients
  host_key_path: ./keys/ssh_host_ed25519_key
  authorized_keys_path: ./keys/authorized_keys
  # Each user may authenticate by password (bcrypt hash) and/or by a public key listed
  # in authorized_keys_path. Generate a bcrypt hash with:
  #   python -c "import bcrypt;print(bcrypt.hashpw(b'yourpass',bcrypt.gensalt()).decode())"
  users:
    - username: uploader
      password_hash: "CHANGE_ME_BCRYPT_HASH"
      # public keys for this user go in keys/authorized_keys (one key per line, OpenSSH format)

docs:
  # /docs, /redoc and /openapi.json are protected with HTTP Basic Auth.
  # Password is stored as plaintext here -- this file is root-owned and lives
  # only on this server; comparison is constant-time. No hashing needed.
  enabled: true
  username: admin
  password: "CHANGE_ME"
  realm: "zikai docs"