# Optional local config file for telesrv.
# Copy to .env for local development. Do not commit real tokens or passwords.
# Complete reference / 完整参数手册:
#   docs/configuration.en.md
#   docs/configuration.zh-CN.md

TELESRV_LISTEN=0.0.0.0:2398
TELESRV_ADVERTISE_IP=127.0.0.1
TELESRV_DC=2
# ISO 3166-1 alpha-2 code returned by help.getNearestDc. CN preselects +86.
TELESRV_DEFAULT_COUNTRY_CODE=CN
# Single-backend default: accept any client wire DC label during key exchange.
TELESRV_STRICT_DC_CHECK=false
TELESRV_DEV_AUTH_CODE=12345
TELESRV_AUTH_CODE_TTL=5m
TELESRV_AUTH_CODE_MAX_ATTEMPTS=5
# Unauthenticated login-code issuance uses the same limits for existing and
# unknown phones. Phone numbers are SHA-256 digested before becoming Redis keys.
TELESRV_AUTH_CODE_PHONE_RATE_LIMIT=5
TELESRV_AUTH_CODE_AUTH_KEY_RATE_LIMIT=20
TELESRV_AUTH_CODE_RATE_WINDOW=10m

# MTProto admission and shared inbound RPC budgets. Negative connection/handshake limits disable
# that gate; non-positive RPC values fall back to the built-in safe defaults.
TELESRV_MTPROTO_MAX_CONNECTIONS=200000
TELESRV_MTPROTO_MAX_CONNECTIONS_PER_IP=4096
TELESRV_MTPROTO_MAX_CONCURRENT_HANDSHAKES=256
TELESRV_MTPROTO_RPC_MAX_INFLIGHT=32
TELESRV_MTPROTO_RPC_QUEUE_SIZE=64
TELESRV_MTPROTO_RPC_TIMEOUT=30s
TELESRV_MTPROTO_RPC_GLOBAL_WORKERS=256
TELESRV_MTPROTO_RPC_GLOBAL_MAX_TASKS=8192
TELESRV_MTPROTO_RPC_GLOBAL_MAX_BYTES=536870912
# Metadata-only rpc_result receipt budgets: global >= auth >= session. ACK deletes immediately;
# 331s is only the no-ACK horizon. Payloads live solely in the logical-session outbound budget.
TELESRV_MTPROTO_RPC_EXECUTION_MAX_ENTRIES=262144
TELESRV_MTPROTO_RPC_EXECUTION_AUTH_MAX_ENTRIES=32768
TELESRV_MTPROTO_RPC_EXECUTION_SESSION_MAX_ENTRIES=16384
TELESRV_MTPROTO_RPC_EXECUTION_PENDING_PER_AUTH=2048
# Process-wide in-flight transport wire + decrypted plaintext reservation.
TELESRV_MTPROTO_INBOUND_FRAME_GLOBAL_MAX_BYTES=536870912
# Per-connection outbound mailboxes (normal/control) and process-wide resend pending bodies.
TELESRV_MTPROTO_OUTBOUND_QUEUE_SIZE=128
TELESRV_MTPROTO_OUTBOUND_CONTROL_QUEUE_SIZE=32
TELESRV_MTPROTO_OUTBOUND_TRACKED_GLOBAL_MAX_BYTES=536870912
# Concurrent encrypted wire/codec/obfuscation scratch (shared bounded pool, not per connection).
TELESRV_MTPROTO_OUTBOUND_WRITE_GLOBAL_MAX_BYTES=536870912

# OTP delivery routing. "development" preserves the fixed phone code. "webhook"
# generates a random SMS code and sends it with the versioned protocol documented
# in docs/otp-delivery.md. For an existing account, both modes first create the
# durable 777000 message; Webhook is an additional delivery channel for that code.
TELESRV_PHONE_CODE_DELIVERY_PROVIDER=development
TELESRV_PHONE_CODE_LENGTH=5
TELESRV_OTP_WEBHOOK_URL=
TELESRV_OTP_WEBHOOK_SECRET=
TELESRV_OTP_WEBHOOK_TIMEOUT=5s

# Optional login-email verification. EMAIL_CODE_DELIVERY_PROVIDER may be smtp
# or webhook. Existing-account login codes are also mirrored into 777000 before
# provider delivery; setup/change codes are provider-only. REQUIRE_SETUP forces
# accounts without a login email to set one during the phone login flow.
TELESRV_LOGIN_EMAIL_ENABLE=false
TELESRV_LOGIN_EMAIL_REQUIRE_SETUP=false
TELESRV_LOGIN_EMAIL_CODE_LENGTH=6
TELESRV_EMAIL_CODE_DELIVERY_PROVIDER=smtp
TELESRV_SMTP_HOST=
TELESRV_SMTP_PORT=587
TELESRV_SMTP_USERNAME=
TELESRV_SMTP_PASSWORD=
TELESRV_SMTP_FROM=
TELESRV_SMTP_FROM_NAME=telesrv
TELESRV_SMTP_TLS=starttls
TELESRV_SMTP_TIMEOUT=10s

# Client-visible telesrv links. This is an HTTP(S) URL, not a listen address.
# Production uses https://telesrv.net. For local link/deeplink smoke tests use
# http://127.0.0.1:2401. Invalid schemes, credentials, query strings, fragments,
# or a missing host fail startup instead of silently falling back.
TELESRV_PUBLIC_BASE_URL=https://telesrv.net

# Public landing pages auto-open this custom scheme. It must match the scheme
# registered by every patched client build; tg/http/https are rejected.
TELESRV_PUBLIC_APP_SCHEME=telesrv

# Optional host-based app-link root for multi-server clients. When set, public
# links use e.g. owpg://example.com/oauth and owpg://example.com/username while
# the scheme above remains accepted for existing/in-flight links. The value
# must be exactly <custom-scheme>://<host>, without port/path/query/fragment.
TELESRV_PUBLIC_APP_LINK_BASE=

# Web client target and display brand used by public landing pages.
TELESRV_PUBLIC_WEB_BASE_URL=https://weba.telesrv.net
TELESRV_PUBLIC_APP_NAME=telesrv

# Profile warning text injected into getFullUser/getFullChannel About for peers
# flagged SCAM/FAKE from the admin panel. Empty keeps built-in English defaults.
# Clients cannot localize server text, so set your audience language here. The
# stored bio/description is never overwritten; the warning is re-applied from the
# flag on every read and survives the owner editing their description.
TELESRV_SCAM_WARNING=
TELESRV_FAKE_WARNING=

# Admin API / Admin UI 配置
#
# TELESRV_ADMIN_API_TOKEN 是主服务 (cmd/telesrv) 暴露 Admin REST API 的鉴权 token，
# 也是 Admin UI (cmd/telesrv-admin) 调用 Admin API 时使用的凭证。
# 重要：主服务与 Admin UI 必须使用完全相同的 TELESRV_ADMIN_API_TOKEN，否则管理后台无法执行写操作。
TELESRV_ADMIN_API_TOKEN=

# TELESRV_ADMIN_UI_PASSWORD 是登录管理后台的密码；
# 也可改用 TELESRV_ADMIN_UI_TOKEN，二者至少填一个。
TELESRV_ADMIN_UI_PASSWORD=
TELESRV_ADMIN_UI_TOKEN=

# TELESRV_ADMIN_SESSION_KEY 用于加密 Admin UI 的登录 session cookie。
# 生产环境请使用至少 32 字节的强随机字符串，修改后会导致已登录会话失效。
TELESRV_ADMIN_SESSION_KEY=

# 主服务 Admin API 默认关闭；Admin UI 写操作需要同时配置强 token 并显式开启该 loopback 监听地址。
TELESRV_ADMIN_API_ADDR=

# Admin UI 监听地址，默认值通常无需修改；RTMP ingest 保留 2400。
TELESRV_ADMIN_UI_ADDR=127.0.0.1:2600

# Permissions granted to an Admin UI session that logged in with
# TELESRV_ADMIN_UI_PASSWORD / _TOKEN. Comma-separated; "*" means every
# permission and is the default, so enabling RBAC never locks an operator out of
# a panel that worked before. Names are letters/digits/._:- and may end in
# "namespace.*" to grant a whole namespace.
TELESRV_ADMIN_UI_PERMISSIONS=*

# Additional Admin API bearer tokens with a bounded permission set each, so an
# integration gets exactly the rights it needs instead of the unrestricted
# TELESRV_ADMIN_API_TOKEN. Format: "name:token:perm1,perm2" entries separated by
# ';'. A token may not contain ':' or whitespace, names and tokens must be
# unique, and reusing TELESRV_ADMIN_API_TOKEN here is refused; any malformed
# entry fails startup rather than silently granting or dropping rights.
TELESRV_ADMIN_SCOPED_TOKENS=

TELESRV_POSTGRES_DSN=postgres://telesrv:telesrv@127.0.0.1:5432/telesrv?sslmode=disable
TELESRV_REDIS_ADDR=127.0.0.1:6399
TELESRV_REDIS_PASSWORD=
TELESRV_REDIS_DB=0

# Bounded retention/GC. User/channel update rows are only pruned behind protocol-safe floors.
TELESRV_UPDATE_EVENT_RETENTION=168h
TELESRV_BOT_API_UPDATE_RETENTION=24h
TELESRV_ORPHAN_AUTH_KEY_RETENTION=24h
# Terminal failed outbox heads are kept briefly for diagnosis, then only the online
# delivery task is removed. The durable update remains available to getDifference.
TELESRV_OUTBOX_POISON_RETENTION=1m
TELESRV_OUTBOX_POISON_CLEANUP_INTERVAL=15s
TELESRV_RETENTION_INTERVAL=1h
TELESRV_RETENTION_BATCH=10000

# PFS temp->perm binding cache; write-side revoke/rebind invalidates entries precisely.
TELESRV_TEMP_KEY_CACHE_MAX_ENTRIES=262144
TELESRV_TEMP_KEY_CACHE_TTL=30m

# Optional. Enables Mapbox-backed map previews and TDesktop map picker config.
TELESRV_MAPBOX_TOKEN=
TELESRV_MAPTILE_CACHE_DIR=data/maptiles

TELESRV_LANGPACK_SEED_DIR=data/langpack
TELESRV_OFFICIAL_GIFTS_DIR=data/official-gifts
# Star Gift expiry/auction worker. TON values are handled by the local ledger;
# no wallet, Fragment or chain node endpoint is configured or contacted.
TELESRV_STARGIFT_SWEEP_INTERVAL=15s
TELESRV_STARGIFT_SWEEP_BATCH=1000
# Internal nanoton granted once per user on first local-ledger access.
TELESRV_STARGIFT_TON_STARTING_GRANT=10000000000
TELESRV_STARGIFT_TRANSFER_STARS=25
TELESRV_STARGIFT_DROP_DETAILS_STARS=25
TELESRV_STARGIFT_OFFER_MIN_STARS=1
TELESRV_STARGIFT_STARS_PROCEEDS_PERMILLE=1000
TELESRV_STARGIFT_TON_PROCEEDS_PERMILLE=1000
TELESRV_STARGIFT_EXPORT_DELAY=0s
TELESRV_STARGIFT_TRANSFER_DELAY=0s
TELESRV_STARGIFT_RESELL_DELAY=0s
TELESRV_STARGIFT_CRAFT_DELAY=0s
TELESRV_STARGIFT_CRAFT_CHANCE_PERMILLE=250

# Local admin-only composite account rating. It is not projected into Telegram's
# userFull.stars_rating fields. Disabling it refuses local rating writes.
TELESRV_RATING_ENABLED=true
# A local rating increase is parked for this long before it becomes the visible
# admin level; a decrease always applies immediately. 0 applies every change at once.
TELESRV_RATING_PENDING_DELAY=24h
# Background recompute worker: the rating derives from signals owned by other
# subsystems, so freshness is a worker property rather than a write-path one.
TELESRV_RATING_RECOMPUTE_INTERVAL=15m
TELESRV_RATING_RECOMPUTE_BATCH=500
TELESRV_RATING_STALE_AFTER=6h
# Integer composite weights; the defaults below are exactly the shipped domain
# formula. Penalties are magnitudes that the formula subtracts, so every value is
# non-negative and a negative one fails startup.
TELESRV_RATING_WEIGHT_STARS_RECEIVED_PERMILLE=1000
TELESRV_RATING_WEIGHT_STARS_SPENT_PERMILLE=250
TELESRV_RATING_WEIGHT_MESSAGE_SENT=1
TELESRV_RATING_WEIGHT_ACCOUNT_AGE_DAY=2
TELESRV_RATING_WEIGHT_GIFT_RECEIVED=25
TELESRV_RATING_WEIGHT_MODERATION_CASE=150
TELESRV_RATING_WEIGHT_SCAM_PENALTY=5000
TELESRV_RATING_WEIGHT_FAKE_PENALTY=5000
# Upper bound of the activity component so activity alone cannot outweigh Stars
# and moderation; 0 leaves it uncapped.
TELESRV_RATING_ACTIVITY_CAP=5000

# Landing URL recorded on a minted collectible (NFT) username when the mint
# command carries no explicit URL. Empty derives
# <TELESRV_PUBLIC_BASE_URL>/nft/username/<username>. A template may carry the
# {username} placeholder; without it the name is appended as the last path
# segment. No external marketplace is contacted.
TELESRV_COLLECTIBLE_USERNAME_URL_TEMPLATE=

# Official platform verification: applications filed through the built-in
# @verifybot and decided in the admin panel. An approval flips the platform
# verified flag on the target peer and nothing else; it is not the third-party
# bot verification icon. Disabling refuses every verification use case, while
# peers already carrying the badge keep it.
TELESRV_VERIFICATION_ENABLED=true
# Plain user accounts as verification subjects. Off by default: the official
# process verifies a public presence (bot, public channel, public supergroup).
TELESRV_VERIFICATION_ALLOW_USER_TARGETS=false
# How long an applicant must wait before filing the same target again after a
# rejection, measured from the decision so a slow review never shortens it.
# 0 disables the cooldown; must be 0..8760h.
TELESRV_VERIFICATION_REJECT_COOLDOWN=720h
# Applications one applicant may create per window. Either value 0 disables the
# budget; a positive limit requires a positive window.
TELESRV_VERIFICATION_APPLY_RATE_LIMIT=3
TELESRV_VERIFICATION_APPLY_RATE_WINDOW=24h
# @verifybot dialog rate per applicant, independent of how many applications are
# actually created. Either value 0 disables it.
TELESRV_VERIFICATION_BOT_RATE_LIMIT=30
TELESRV_VERIFICATION_BOT_RATE_WINDOW=1m
# Applicant notification worker. A decision commits with its outbox row, never
# with a message send, so delivery is a separate retrying cycle over durable
# rows. Interval must be positive; batch must be 1..500.
TELESRV_VERIFICATION_NOTIFY_INTERVAL=15s
TELESRV_VERIFICATION_NOTIFY_BATCH=50
# Applications one applicant may keep open at once; 0 disables the cap, maximum
# is 50.
TELESRV_VERIFICATION_MAX_ACTIVE_PER_USER=3

# Third-party bot verification (core.telegram.org/api/bots/verification): a
# verifier bot marks peers with its OWN icon and description, which clients render
# before the name. This is NOT the platform checkmark above: the operator grants
# verifier status to a bot, and the two mechanisms never read each other's state.
# Disabling refuses every third-party mutation (grants, revocations, applications,
# icon catalogue edits) while the marks already granted keep rendering -- blanking
# one verifier's badges is what its per-verifier kill switch is for.
TELESRV_BOT_VERIFICATION_ENABLED=true
# Peers one verifier bot may mark. Verifier status is granted per deployment rather
# than earned per peer, so an unbounded verifier would be an unbounded badge
# printer. 0 disables the service bound and leaves only the storage bound, which is
# also the maximum accepted here (10000).
TELESRV_BOT_VERIFICATION_MAX_PER_VERIFIER=10000
# Verification applications one applicant may file per window, across all verifier
# bots. Either value 0 disables the budget; a positive limit requires a positive
# window. Looser than the official budget on purpose: a deployment can run several
# verifier companies, and filing with a second one is not a retry of the first.
TELESRV_BOT_VERIFICATION_REQUEST_RATE_LIMIT=5
TELESRV_BOT_VERIFICATION_REQUEST_RATE_WINDOW=24h

TELESRV_BLOB_DIR=data/blobs
TELESRV_STICKER_SEED_DIR=data/sticker-seed
# Optional Premium feature-preview media export. Missing directory keeps the
# no-video fallback; an existing but incomplete/invalid directory fails startup.
TELESRV_PREMIUM_PROMO_SEED_DIR=data/premium-promo

# Optional public-link Web listener for /<username>, profile avatars,
# sticker/custom emoji sets, and shared folders. This is a host:port bind
# address without a URL scheme. It is not replaced by TELESRV_PUBLIC_BASE_URL.
# Production should keep it on loopback and reverse-proxy the documented routes
# through nginx; public canonical URLs use TELESRV_PUBLIC_BASE_URL.
TELESRV_PUBLIC_LINK_WEB_ADDR=127.0.0.1:2401

# Self-hosted Telegram Login / OpenID Connect. The provider is mounted on the
# public-link listener above. Keep disabled until all three local key files
# have been generated with `go run ./cmd/telegramloginkeygen -mode init`.
TELESRV_TELEGRAM_LOGIN_ENABLE=false
TELESRV_TELEGRAM_LOGIN_ISSUER=https://telesrv.net
# Set true to permit an HTTP issuer and HTTP registered origins/redirect URIs
# on any hostname or IP address. HTTPS remains the default when false.
TELESRV_TELEGRAM_LOGIN_ALLOW_HTTP=false
TELESRV_TELEGRAM_LOGIN_SIGNING_KEYS_FILE=data/telegram-login/signing-keys.json
TELESRV_TELEGRAM_LOGIN_CODE_KEYS_FILE=data/telegram-login/code-keys.json
TELESRV_TELEGRAM_LOGIN_SECRET_PEPPER_FILE=data/telegram-login/client-secret-pepper
TELESRV_TELEGRAM_LOGIN_REQUEST_TTL=5m
TELESRV_TELEGRAM_LOGIN_CODE_TTL=2m
TELESRV_TELEGRAM_LOGIN_ID_TOKEN_TTL=1h
# Trust only the loopback nginx hop in the documented single-host deployment.
TELESRV_TELEGRAM_LOGIN_TRUSTED_PROXY_CIDRS=127.0.0.1/32,::1/128
TELESRV_TELEGRAM_LOGIN_RETENTION=168h
TELESRV_TELEGRAM_LOGIN_SWEEP_INTERVAL=5m
TELESRV_TELEGRAM_LOGIN_SWEEP_BATCH=500

# AI compose for TDesktop/Android input box rewrite/polish.
# The local provider is deterministic and does not call external services.
TELESRV_AI_ENABLED=true
TELESRV_AI_PROVIDERS=local
TELESRV_AI_TIMEOUT=15s
TELESRV_AI_RATE_LIMIT=20
TELESRV_AI_RATE_WINDOW=1m
TELESRV_AI_LOG_CONTENT=false

# Chat/message translation reuses the remote providers declared above. The
# deterministic "local" AI provider is excluded because it cannot translate.
# Leave TRANSLATION_PROVIDERS empty to use all configured remote AI providers,
# or provide a comma-separated subset such as "openai,gemini".
TELESRV_TRANSLATION_ENABLED=true
TELESRV_TRANSLATION_PROVIDERS=
TELESRV_TRANSLATION_TIMEOUT=15s
# Counts translated text items, not RPC envelopes (one RPC may contain 20).
TELESRV_TRANSLATION_RATE_LIMIT=60
TELESRV_TRANSLATION_RATE_WINDOW=1m

# External providers are optional. Keep API keys in TELESRV_* variables here;
# the loader rejects non-TELESRV keys from .env files by design.
# TELESRV_AI_OPENAI_KIND=openai_responses
# TELESRV_AI_OPENAI_API_KEY=
# TELESRV_AI_OPENAI_MODEL=
# TELESRV_AI_OPENAI_BASE_URL=
# TELESRV_AI_OPENAI_MAX_OUTPUT_TOKENS=1024
# TELESRV_AI_OPENAI_TEMPERATURE=0.2
# TELESRV_AI_OPENAI_OMIT_TEMPERATURE=false
# TELESRV_AI_OPENAI_THINKING=
# TELESRV_AI_GEMINI_KIND=gemini
# TELESRV_AI_GEMINI_API_KEY=
# TELESRV_AI_GEMINI_MODEL=
# TELESRV_AI_GEMINI_TEMPERATURE=0.2
# TELESRV_AI_ANTHROPIC_KIND=anthropic
# TELESRV_AI_ANTHROPIC_API_KEY=
# TELESRV_AI_ANTHROPIC_MODEL=

# Kimi/Moonshot can be used as an OpenAI-compatible Chat Completions provider.
# TELESRV_AI_PROVIDERS=kimi,local
# TELESRV_AI_KIMI_KIND=openai_chat
# TELESRV_AI_KIMI_API_KEY=
# TELESRV_AI_KIMI_BASE_URL=https://api.moonshot.cn/v1
# TELESRV_AI_KIMI_MODEL=kimi-k2.6
# TELESRV_AI_KIMI_THINKING=disabled
# TELESRV_AI_KIMI_TEMPERATURE=0.6

# Business automation reply provider:
# echo (default/empty), template/quick_reply/quick-reply, or
# ai/compose_ai/ai_compose/aicompose/kimi to reuse TELESRV_AI_PROVIDERS.
# Custom provider names such as "ollama" are selected through TELESRV_AI_PROVIDERS;
# use TELESRV_BUSINESS_AI_PROVIDER=ai for those.
TELESRV_BUSINESS_AI_PROVIDER=echo