# API Server configuration
# Copy to .env and adjust. The server also reads plain environment variables.

# Address the API Server listens on
API_ADDR=:8080

# PocketBase base URL (no trailing slash). The API Server is the only thing that
# talks to PocketBase; it proxies /api/auth/* to this address, which is never
# exposed to clients. (Legacy PB_URL is still honoured for backward compat.)
POCKETBASE_URL=http://10.2.1.10:8026

# CORS allowed origins for the Web App (comma separated, or * for any)
CORS_ALLOW_ORIGINS=*

# Superuser service account — used ONLY for admin user-management
# (list/create/delete users under Settings → User management). Every such call
# still verifies the *caller* has role=admin first. Leave unset to disable those
# endpoints (they return 503); the rest of the server is unaffected.
POCKETBASE_ADMIN_EMAIL=admin@dji.local
POCKETBASE_ADMIN_PASSWORD=change-me