# zm-api environment, read by the OpenRC init script and the systemd unit.
# Overrides /etc/zm-api/{base,prod}.toml: APP_ prefix, __ between sections.
APP_PROFILE=prod
APP_CONFIG_DIR=/etc/zm-api
APP_STATIC_DIR=/usr/share/zm-api/static
APP_LOG_DIR=/var/log/zm-api
RUST_LOG=info

# Behind the ZoneMinder web server's /zm/api/v3 proxy: listen on loopback only.
# Clear this to expose zm-api directly, and then also set
# APP_SERVER__MIDDLEWARE__TRUST_PROXY_HEADERS=false
APP_SERVER__ADDR=127.0.0.1
APP_SERVER__PORT=8080
# The proxy serves zm-api under /zm (zoneminder's web server examples), so the
# links zm-api writes (streams, media links, search, Swagger UI) start with it.
# Empty when zm-api is reached at the site root.
APP_SERVER__PUBLIC_PREFIX=/zm

# Database: zm.conf's ZM_DB_* (and conf.d) unless set here (APP_DB__HOST, ...).
# localhost means the server's Unix socket, as for ZoneMinder: the first of
# /run/mysqld/mysqld.sock and the other standard paths found, else TCP. Set a
# socket elsewhere here (or as ZM_DB_HOST=localhost:/path/to/socket):
# APP_DB__SOCKET=/run/mysqld/mysqld.sock

# Browser origins allowed to call the API (CORS), comma-separated. Not needed
# when the UI is served from the same origin as the API.
# APP_SERVER__ALLOWED_ORIGINS=https://zm.example.com

# Passive: serve the API only and leave zmdc.pl in charge of the daemons.
# zm-api-takeover flips this (it drives systemd; under OpenRC stop zoneminder,
# set true here and restart zm-api by hand).
APP_DAEMON__ENABLED=false
APP_DAEMON__SOCKET_NAME=zmdc.sock
APP_DAEMON__ENABLE_SOCKET_IPC=true
APP_DAEMON__ENABLE_WATCHDOG=true
# ZM_PATH_SOCKS / ZM_PATH_BIN are read from /etc/zm/zm.conf; override here.
# APP_DAEMON__SOCKET_PATH=/run/zm
# APP_DAEMON__SCRIPT_PATH=/usr/bin

# JWT signing keys, generated by emerge --config www-misc/zm-api
APP_SECRET__PRIVATE_ACCESS_KEY=/var/lib/zm-api/keys/private_access_rsa_key.pem
APP_SECRET__PUBLIC_ACCESS_KEY=/var/lib/zm-api/keys/public_access_rsa_key.pem
APP_SECRET__PRIVATE_REFRESH_KEY=/var/lib/zm-api/keys/private_refresh_rsa_key.pem
APP_SECRET__PUBLIC_REFRESH_KEY=/var/lib/zm-api/keys/public_refresh_rsa_key.pem