Configuration

DATABASE_URL=postgresql://user:password@localhost:5432/timetiles
PAYLOAD_SECRET=your-secret-key   # openssl rand -base64 32
NEXT_PUBLIC_PAYLOAD_URL=https://your-domain.com

NODE_ENV=production              # development, production, test
NEXT_PUBLIC_SITE_URL=https://...  # If different from NEXT_PUBLIC_PAYLOAD_URL
DEFAULT_LOCALE=en                # en or de

UPLOAD_DIR=uploads               # Base directory (subfolders: /media, /import-files)
UPLOAD_TEMP_DIR=/tmp             # Temporary files during upload
DATA_EXPORT_DIR=.exports         # User data export output

LOG_LEVEL=info                   # trace, debug, info, warn, error, fatal, silent
LOG_FILE=/var/log/timetiles/app.log  # Optional file logging

EMAIL_SMTP_HOST=smtp.example.com
EMAIL_SMTP_PORT=587
EMAIL_SMTP_USER=your-user
EMAIL_SMTP_PASS=your-password
EMAIL_FROM_ADDRESS=noreply@timetiles.io
EMAIL_FROM_NAME=TimeTiles

SSRF_DNS_CHECK=true              # DNS validation for SSRF protection (recommended in production)
ALLOW_PRIVATE_URLS=true          # Allow RFC 1918 addresses (development only!)

SCRAPER_RUNNER_URL=http://localhost:4000
SCRAPER_API_KEY=your-api-key-min-16-chars

cp config/timetiles.example.yml config/timetiles.yml

CONFIG_DIR=./config

rateLimits:
  FILE_UPLOAD:
    windows:
      - { limit: 1, windowMs: 5000, name: burst } # 1 per 5 seconds
      - { limit: 5, windowMs: 3600000, name: hourly } # 5 per hour
      - { limit: 20, windowMs: 86400000, name: daily } # 20 per day
  API_GENERAL:
    windows:
      - { limit: 5, windowMs: 1000, name: burst }
      - { limit: 50, windowMs: 3600000, name: hourly }
  REGISTRATION:
    windows:
      - { limit: 3, windowMs: 60000, name: burst }
      - { limit: 10, windowMs: 3600000, name: hourly }
      - { limit: 20, windowMs: 86400000, name: daily }

quotas:
  2: # Regular users
    maxEventsPerImport: 20000
    maxTotalEvents: 100000
  3: # Trusted users
    maxFileUploadsPerDay: 100

trustLevelRateLimits:
  0: # Untrusted — very restrictive
    FILE_UPLOAD:
      windows:
        - { limit: 1, windowMs: 60000, name: burst }
        - { limit: 1, windowMs: 3600000, name: hourly }
    API_GENERAL:
      windows:
        - { limit: 1, windowMs: 1000, name: burst }
        - { limit: 10, windowMs: 3600000, name: hourly }

batchSizes:
  duplicateAnalysis: 5000
  schemaDetection: 10000
  eventCreation: 1000
  databaseChunk: 1000

cache:
  urlFetch:
    dir: /tmp/url-fetch-cache
    maxSizeBytes: 104857600 # 100 MB
    defaultTtlSeconds: 3600 # 1 hour
    maxTtlSeconds: 2592000 # 30 days
    respectCacheControl: true # Honor RFC 7234 headers

account:
  deletionGracePeriodDays: 30