example.env

# Rails API URL used for server-to-server requests
API_HOST=http://apiserver:3000
# Public OnTrack URL used for browser redirects
APP_HOST=https://ontrack.example.com

PORT=3001
# Internal API port, called only by OnTrack's Rails API. Keep it off the public proxy
# and unpublished on the host.
INTERNAL_PORT=3003

LTI_KEY=unset
# Authenticates backend-only NRPS diagnostics and course-data refreshes.
# Rails should send this value in the x-internal-key request header.
LTI_INTERNAL_SYNC_KEY=

PLATFORM_URL=https://moodle.example.com
# Optional: links OnTrack back to the LMS course. {COURSE_ID} is replaced with the LTI context id.
# Moodle: https://moodle.example.com/course/view.php?id={COURSE_ID}
# Canvas: https://canvas.example.com/courses/{COURSE_ID}
PLATFORM_COURSE_URL=
PLATFORM_NAME=Moodle Testing
# Retrieve the Client ID from Moodle after adding OnTrack as an external tool
PLATFORM_CLIENT_ID=unset
PLATFORM_AUTHENTICATION_ENDPOINT=hhttps://moodle.example.com/mod/lti/auth.php
PLATFORM_ACCESS_TOKEN_ENDPOINT=https://moodle.example.com/mod/lti/token.php
PLATFORM_AUTHCONFIG_METHOD=JWK_SET
PLATFORM_AUTHCONFIG_KEY=https://moodle.example.com/mod/lti/certs.php

DB_HOST=localhost:27017
DB_NAME=ltidb
DB_USER=user
DB_PASS=password

# Must match LTI_SHARED_API_SECRET in the Rails API. Use `openssl rand -hex 32`.
LTI_SHARED_API_SECRET=

# Per-client limits. Launch/login requests use the lower limit; authenticated
# LTI API operations use the higher limit.
LTI_RATE_LIMIT_WINDOW_MS=60000
LTI_LAUNCH_RATE_LIMIT_MAX=20
LTI_API_RATE_LIMIT_MAX=120

LTI_COOKIES_SECURE=true
LTI_COOKIES_SAMESITE=strict