env.example

# WordLight — environment configuration
# Copy this file to .env and fill in your own values:
#   cp .env.example .env

# --- HTTP redirect port ---------------------------------------------------
# WordLight now runs over HTTPS by default (see HTTPS_PORT below) — this
# port just redirects any plain "http://" request to the HTTPS equivalent,
# so an old bookmark or a typed URL without "https://" still lands
# somewhere useful. Default 3000 works with no extra setup.
#
# To use port 80 instead (so a typed URL doesn't need ":3000" before it
# redirects), you must first grant Node permission to bind to ports below
# 1024. Run this ONE-TIME command on the Pi before setting PORT=80 below:
#
#   sudo setcap 'cap_net_bind_service=+ep' $(which node)
#
# This is optional. If you skip it and leave PORT=3000 (or unset), the
# server works exactly the same — just with :3000 in the URL before the
# redirect happens.
#
# Note: if Node is ever upgraded via apt (replacing the binary), the
# capability is lost and the setcap command above needs to be run again —
# this affects HTTPS_PORT below too, if you've set it to 443.
PORT=3000

# --- HTTPS port (the real app lives here) ----------------------------------
# This is where browsers and QR codes actually connect. Default 3443 works
# with no extra setup. WordLight generates its own self-signed certificate
# automatically on first run (see the "HTTPS certificate" section of
# README.md) — no manual certificate setup needed.
#
# Because the certificate is self-signed, each new device will show a
# one-time "connection not private" warning the first time it connects —
# this is expected on a private venue network, not a sign anything is
# wrong. Tapping through it (usually "Advanced" → "Proceed") is a one-time
# step per device.
#
# To use port 443 instead (so URLs and QR codes don't need ":3443"), run
# the SAME setcap command described under PORT above, then set
# HTTPS_PORT=443 below.
HTTPS_PORT=3443

# --- Disable HTTPS entirely (optional) --------------------------------------
# Set to "false" to run plain HTTP only, on the PORT above — an intentional
# choice, not just what happens automatically if certificate generation
# fails. Useful if HTTPS ever causes a problem you haven't tracked down
# yet, or if you'd simply rather not deal with the one-time browser
# security warning on new devices. Wake Lock (keeping audience phone
# screens from auto-locking) will be unavailable in this mode.
#
# Defaults to enabled — leave this commented out or set to "true" for
# normal HTTPS operation, which is recommended.
# HTTPS_ENABLED=false

# --- OSC (Open Sound Control) port ----------------------------------------
# UDP port for lighting/sound board integration. No special permissions
# needed — this is always above 1024.
OSC_PORT=3001

# --- Admin credentials -----------------------------------------------------
# Used to log in to /controller, /editor, and /logging.
# CHANGE THESE before using this in production.
ADMIN_USERNAME=admin
ADMIN_PASSWORD=change-me

# --- Session secret ---------------------------------------------------------
# Used to sign session cookies. Generate a real random value with:
#   node -e "console.log(require('crypto').randomBytes(32).toString('hex'))"
SESSION_SECRET=change-this-to-a-long-random-string