owpengram-server/.env.example

# Optional local config file for telesrv.
# Copy to .env for local development. Do not commit real tokens or passwords.
# Complete reference:
#   docs/configuration.en.md
#   docs/configuration.zh-CN.md
#
# This file has two parts:
#   1. Everyday settings (below) -- IPs, ports, passwords, login methods,
#      SMTP, links, calls/streaming. These are the ones the server-panel.py
#      TUI shows and lets you edit, grouped the same way as here.
#   2. "Advanced / internal tuning" (further down) -- queue sizes, cache
#      limits, retention windows and similar performance knobs. Sensible
#      defaults are already set; most self-hosters never need to touch this
#      part, so it's left out of the panel to keep that screen readable.

## Server & Network -- Where the server listens and what address it tells clients to connect to.

# Address and port the server listens on for MTProto client connections.
TELESRV_LISTEN=0.0.0.0:2398
# Your server's public IP address.
TELESRV_ADVERTISE_IP=127.0.0.1
# Which "data center" number this server presents itself as. There's only
# ever one physical server, so this normally stays 2 -- no need to change it.
TELESRV_DC=2
# ISO 3166-1 alpha-2 code returned by help.getNearestDc. CN preselects +86.
TELESRV_DEFAULT_COUNTRY_CODE=US

## Phone Login Codes -- How a login code gets to a phone number when someone signs in.

# development: every phone number accepts the same fixed code below (fine
# for local testing, or when only email/Telegram sign-in is used). webhook:
# sends a real random code to TELESRV_OTP_WEBHOOK_URL for actual delivery.
TELESRV_PHONE_CODE_DELIVERY_PROVIDER=development
# The fixed code accepted for every phone number when the provider above is
# "development". Change this if you keep phone login open in that mode.
TELESRV_DEV_AUTH_CODE=12345
# How many digits a real (webhook-delivered) login code has.
TELESRV_PHONE_CODE_LENGTH=5
# How long a login code stays valid after being sent.
TELESRV_AUTH_CODE_TTL=5m
# How many wrong guesses are allowed before a code is rejected outright.
TELESRV_AUTH_CODE_MAX_ATTEMPTS=5
# The message sent from the official system account (777000) into a user's
# own chat on every completed sign-in -- a lightweight security notice, not
# the login code itself. {{server_name}} is replaced with the server's
# configured identity name (or product name if unset). Leave empty to use
# the built-in English copy. The admin panel's Server Settings page can
# override these live, without a restart; these env vars are only the
# fallback for when it hasn't been touched.
TELESRV_WELCOME_MESSAGE_PHONE_TEMPLATE=
TELESRV_WELCOME_MESSAGE_EMAIL_TEMPLATE=
# The message sent from the official system account (777000) that carries the
# actual login code -- one template for every delivery channel (SMS or
# email). Must contain the {{code}} placeholder exactly once (that's where
# the real code is inserted and bolded); {{server_name}} is optional and may
# appear any number of times. Leave empty to use the built-in English copy.
# The admin panel's Server Settings page can override this live, without a
# restart (rejecting a save that doesn't contain {{code}} exactly once); this
# env var is only the fallback for when it hasn't been touched.
TELESRV_LOGIN_CODE_MESSAGE_TEMPLATE=
# Where webhook-delivered codes are POSTed, and the shared secret used to
# sign that request (see docs/otp-delivery.md for the exact payload).
TELESRV_OTP_WEBHOOK_URL=
TELESRV_OTP_WEBHOOK_SECRET=
TELESRV_OTP_WEBHOOK_TIMEOUT=5s

## Email Login & Signup -- Signing in (or registering) with an email address instead of a phone number.

# Lets an existing phone-number account also add an email address for login
# codes. REQUIRE_SETUP forces every account without one to set it up.
TELESRV_LOGIN_EMAIL_ENABLE=false
TELESRV_LOGIN_EMAIL_REQUIRE_SETUP=false
# How many digits an email login code has.
TELESRV_LOGIN_EMAIL_CODE_LENGTH=6
# How an email login code is actually delivered: smtp (send it yourself,
# see the SMTP section below) or webhook (reuses the phone webhook above).
TELESRV_EMAIL_CODE_DELIVERY_PROVIDER=smtp
# Lets people register and log in with just an email address, no phone
# number at all. Uses the same SMTP/webhook delivery as email login above.
TELESRV_EMAIL_SIGNUP_ENABLE=false
# Comma-separated phone-number prefixes randomly assigned as the visible
# "phone number" for email-signup accounts, e.g. "888,380,373". Purely
# cosmetic -- doesn't need a client update to change.
TELESRV_EMAIL_SIGNUP_PHONE_PREFIXES=888

## SMTP (Outgoing Email) -- The mail server used to send login/signup codes by email.

TELESRV_SMTP_HOST=
TELESRV_SMTP_PORT=587
TELESRV_SMTP_USERNAME=
TELESRV_SMTP_PASSWORD=
# Sender address and display name shown on outgoing emails.
TELESRV_SMTP_FROM=
TELESRV_SMTP_FROM_NAME=OwpenGram
# Encryption mode: starttls, tls, or none (use "none" for a local test
# server like Mailpit that doesn't support encryption at all).
TELESRV_SMTP_TLS=starttls
TELESRV_SMTP_TIMEOUT=10s

## Public Links & Branding -- What clients show/open for links, and your product's name.

# Public web address for links this server generates (invite links, sticker
# packs, etc). Use your real domain once you have one, e.g. https://example.com.
TELESRV_PUBLIC_BASE_URL=http://127.0.0.1
# Custom URL scheme (like "owpg://") that public pages use to open your
# patched client. Must match what your client builds were compiled with.
TELESRV_PUBLIC_APP_SCHEME=owpg
# Optional: use "scheme://yourdomain.com/..." links instead of plain
# "scheme://...". Leave empty unless you specifically need this.
TELESRV_PUBLIC_APP_LINK_BASE=
# Address of your web client (if you have one) and the product name shown
# on public landing pages.
TELESRV_PUBLIC_WEB_BASE_URL=https://web.telesrv.net
TELESRV_PUBLIC_APP_NAME=OwpenGram
# Where the "Download" button on public pages links to.
TELESRV_PUBLIC_DOWNLOAD_URL=https://owpengram.org
# Warning text shown on a profile/channel the admin panel flagged as
# scam/fake. Leave empty to use the built-in English text.
TELESRV_SCAM_WARNING=
TELESRV_FAKE_WARNING=
# Usernames a user/channel can never self-service claim (account.updateUsername,
# channels.updateUsername) -- brand-adjacent or staff-sounding words, plus
# your own real handle if you want it protected too. Comma-separated, not
# case-sensitive. The admin panel can still assign any of these on purpose.
TELESRV_RESERVED_USERNAMES=owpengram,admin,administrator,support,staff,moderator,official,root,owner

## Admin Panel -- Login and access for the web-based admin dashboard.

# Secret token shared between the main server and the admin panel process --
# both must use the exact same value, or the admin panel can't save changes.
TELESRV_ADMIN_API_TOKEN=
# Password to log into the admin panel (or use a token below instead; set
# at least one of the two).
TELESRV_ADMIN_UI_PASSWORD=
TELESRV_ADMIN_UI_TOKEN=
# Encrypts the admin panel's login session cookie. Use a random string of
# at least 32 characters; changing it logs everyone out.
TELESRV_ADMIN_SESSION_KEY=
# Address the main server exposes its admin API on. Leave empty to disable
# the admin panel entirely; set to a loopback address (127.0.0.1:...) to
# enable it without exposing it outside this machine.
TELESRV_ADMIN_API_ADDR=
# Address the admin panel's own web UI listens on.
TELESRV_ADMIN_UI_ADDR=127.0.0.1:2600
# Permissions granted to an Admin UI session that logged in with
# TELESRV_ADMIN_UI_PASSWORD / _TOKEN. Comma-separated; "*" means every
# permission and is the default, so enabling RBAC never locks an operator out of
# a panel that worked before. Names are letters/digits/._:- and may end in
# "namespace.*" to grant a whole namespace.
TELESRV_ADMIN_UI_PERMISSIONS=*
# Additional Admin API bearer tokens with a bounded permission set each, so an
# integration gets exactly the rights it needs instead of the unrestricted
# TELESRV_ADMIN_API_TOKEN. Format: "name:token:perm1,perm2" entries separated by
# ';'. A token may not contain ':' or whitespace, names and tokens must be
# unique, and reusing TELESRV_ADMIN_API_TOKEN here is refused; any malformed
# entry fails startup rather than silently granting or dropping rights.
TELESRV_ADMIN_SCOPED_TOKENS=

## Bot API Gateway -- Optional HTTP gateway for bot libraries (e.g. python-telegram-bot).

# Leave empty to disable. Set to an address like 127.0.0.1:2500 to enable.
TELESRV_BOT_API_ADDR=

## Database -- Where the server stores its data.

TELESRV_POSTGRES_DSN=postgres://owpengram:owpengram@127.0.0.1:5432/owpengram?sslmode=disable
TELESRV_REDIS_ADDR=127.0.0.1:6399
TELESRV_REDIS_PASSWORD=
TELESRV_REDIS_DB=0

## Public Web Listener -- Serves public profile pages, avatars, and sticker/emoji pack previews.

# Host:port this listens on (not a URL). Let nginx (or similar) proxy
# public traffic to it rather than exposing this port directly.
TELESRV_PUBLIC_LINK_WEB_ADDR=0.0.0.0:2401

## Telegram Login (OpenID Connect) -- Self-hosted "Log in with Telegram" for third-party sites.

# Keep disabled until you've generated the required key files with:
#   go run ./cmd/telegramloginkeygen -mode init
TELESRV_TELEGRAM_LOGIN_ENABLE=false
# The public HTTPS origin this login provider identifies itself as.
TELESRV_TELEGRAM_LOGIN_ISSUER=https://telesrv.net
# Allow plain HTTP instead of HTTPS (only for local testing).
TELESRV_TELEGRAM_LOGIN_ALLOW_HTTP=false

## Passkey Login (WebAuthn) -- Signing in with a device passkey/fingerprint instead of a code.

# Must match the real public domain you serve this from, or passkey login
# will fail (browsers check this against their own address bar).
TELESRV_PASSKEY_RP_ID=telesrv.net

## Calls -- Voice/video calls (1-to-1 and group), and the relay servers they need to work across networks.

# Turns off the TURN relay for 1-to-1 calls (falls back to direct
# connections only, which fail across most home/mobile networks).
TELESRV_TURN_ENABLE=true
# Port the built-in TURN/STUN relay listens on. Must be open in your firewall.
TELESRV_TURN_UDP_PORT=12400
# Public IP the relay tells clients to connect to. Leave empty to reuse
# TELESRV_ADVERTISE_IP above.
TELESRV_TURN_ADVERTISE_IP=
# Secret used to sign relay credentials. Leave empty for a random one
# generated at startup (fine for a single server instance).
TELESRV_TURN_SECRET=
# Port range the relay hands out for active call media. Must be open in
# your firewall.
TELESRV_TURN_RELAY_MIN_PORT=12500
TELESRV_TURN_RELAY_MAX_PORT=12999
# Turns off the group-call media server (SFU) -- group calls become
# signaling-only, with no actual audio/video.
TELESRV_SFU_ENABLE=true
# Single UDP port the group-call media server listens on. Must be open in
# your firewall.
TELESRV_SFU_UDP_PORT=12399
# Public IP the group-call media server tells clients to connect to. Leave
# empty to reuse TELESRV_ADVERTISE_IP above. Warning: setting this to
# 127.0.0.1 silently breaks calls from real devices.
TELESRV_SFU_ADVERTISE_IP=
# Maximum number of people allowed in one group call.
TELESRV_GROUPCALL_MAX_PARTICIPANTS=32

## Live Streaming -- Broadcasting live video into a channel (RTMP ingest, e.g. from OBS).

TELESRV_LIVESTREAM_ENABLE=true
# TCP address the RTMP ingest listens on for incoming streams.
TELESRV_LIVESTREAM_RTMP_ADDR=:2400
# Path to the ffmpeg executable used to process incoming streams. Leave as
# "ffmpeg" if it's already on your system PATH.
TELESRV_LIVESTREAM_FFMPEG_PATH=ffmpeg

## Maps -- Optional map previews (e.g. for shared locations) in patched clients.

# Mapbox access token. Leave empty to disable map previews.
TELESRV_MAPBOX_TOKEN=

## AI Features -- Optional AI-assisted message composing, business auto-replies, and translation.

# Master switch for the "improve my message" AI button in patched clients.
TELESRV_AI_ENABLED=true
# Auto-reply generator for Business accounts: "echo" just echoes the
# message back (safe default to verify the feature works end-to-end).
TELESRV_BUSINESS_AI_PROVIDER=echo
# Master switch for in-app message/chat translation.
TELESRV_TRANSLATION_ENABLED=true

## Moderation, Verification & Rating -- Toggles for the report-review queue, official/third-party verification, and the account-rating score.

# Reports and moderation-case review are always on; this only gates the
# official platform-checkmark flow applicants file through @verifybot. Rate
# limits and cooldowns for it live in the Advanced section below.
TELESRV_VERIFICATION_ENABLED=true
# Plain user accounts as verification subjects. Off by default: the official
# process verifies a public presence (bot, public channel, public supergroup).
TELESRV_VERIFICATION_ALLOW_USER_TARGETS=false
# Third-party bot verification marks (an icon + description shown before a
# peer's name) -- a separate mechanism from the checkmark above, not the
# platform badge. Its tuning lives in the Advanced section below.
TELESRV_BOT_VERIFICATION_ENABLED=true
# THIS FEATURE IS NOT FULLY FINISHED AND MAY CAUSE UNSTABLE SERVER BEHAVIOR.
# Hides third-party bot verification instead of removing it: the admin panel
# drops its "Third-party marks" nav entry and refuses every underlying route
# with 404 regardless of session permissions, and the built-in @marksbot
# service bot stops responding to messages entirely. Everything stays wired
# up (nothing is deleted), so setting this to false re-enables it. Default
# true -- leave it alone unless you are specifically testing this feature.
TELESRV_HIDE_THIRD_PARTY_VERIFICATION=true
## Storage & Media -- Where uploaded media is stored, and how the server reacts to running low on space.

# Where uploaded media (photos, documents, stickers) is physically stored.
# "s3" (the default) writes to an S3-compatible object store -- out of the
# box that's the self-hosted MinIO container started by
# deploy/docker-compose.yml (see its "minio" service), pre-configured below
# to just work; point TELESRV_S3_* at AWS S3 instead if you'd rather not
# self-host it. "localfs" writes to TELESRV_BLOB_DIR on this machine's disk
# instead -- fully supported, just not the default. Switching backends only
# affects new uploads: existing files stay wherever they were written and
# remain readable/deletable as long as that backend's settings below stay
# filled in (don't blank out the old backend's config right after switching
# away from it, or its files become unreachable).
TELESRV_BLOB_BACKEND=s3
# Only used when TELESRV_BLOB_BACKEND=s3 (or after switching away from s3,
# for as long as old s3-stored files still need to stay reachable).
# Defaults below match deploy/docker-compose.yml's "minio" service exactly.
TELESRV_S3_ENDPOINT=127.0.0.1:9000
TELESRV_S3_REGION=us-east-1
TELESRV_S3_BUCKET=owpengram-media
TELESRV_S3_ACCESS_KEY_ID=owpengram
TELESRV_S3_SECRET_ACCESS_KEY=owpengram123
# Local MinIO runs plain HTTP; set to true for AWS S3 or a MinIO behind TLS.
TELESRV_S3_USE_SSL=false
# MinIO needs this on (bucket in the URL path); AWS S3 does not.
TELESRV_S3_PATH_STYLE=true
# Reject new uploads once storage is nearly full, instead of letting the disk
# fill up. Thresholds are the three fields right below.
TELESRV_STORAGE_LOW_SPACE_GUARD_ENABLE=true
# localfs: reject new uploads once real free disk bytes fall below this; <=0 disables.
TELESRV_STORAGE_MIN_FREE_BYTES=1073741824
# Reject new uploads once total tracked blob bytes would exceed this. The only
# meaningful "low space" signal on the s3 backend (no OS free-space concept);
# optional soft cap on localfs too. <=0 disables.
TELESRV_STORAGE_MAX_TOTAL_BYTES=0
# Reject a single upload once its total assembled size (sum of all its parts)
# would exceed this. <=0 disables this check (the protocol's own part-count
# ceiling of ~4GB still applies). Must not exceed that ceiling.
TELESRV_STORAGE_MAX_UPLOAD_FILE_BYTES=0
# Storage retention sweep mode: "off" (default, nothing auto-deleted --
# storage usage is still tracked and shown in the admin panel either way),
# "orphan" (safe: deletes a document/photo's blob only once it's no longer
# referenced by any message/profile photo/sticker set), or "hard"
# (aggressive: deletes a document/photo's blob once it's old enough,
# REGARDLESS of whether it's still referenced -- old media in active
# conversations will show as unavailable).
TELESRV_STORAGE_RETENTION_MODE=off
# How long a document/photo must have had zero references before the sweep
# deletes it in "orphan" mode above -- or how old the media itself is before
# "hard" mode deletes its bytes regardless of references. Ignored when the
# mode above is "off". The sweep itself runs alongside every other retention
# check on the shared TELESRV_RETENTION_INTERVAL/TELESRV_RETENTION_BATCH
# cadence (Advanced section below).
TELESRV_STORAGE_RETENTION_MAX_AGE=720h
# Optional per-category overrides of the shared age above (Photo/Video/Round
# Video/Gif/Music/Voice/File/Avatar) -- each empty/unset value falls back to
# TELESRV_STORAGE_RETENTION_MAX_AGE. The mode switch above still applies to
# all of them; these only let one category expire sooner or later than the
# rest (e.g. purge voice notes after a week but keep files for a year).
TELESRV_STORAGE_RETENTION_MAX_AGE_PHOTO=
TELESRV_STORAGE_RETENTION_MAX_AGE_VIDEO=
TELESRV_STORAGE_RETENTION_MAX_AGE_ROUND_VIDEO=
TELESRV_STORAGE_RETENTION_MAX_AGE_GIF=
TELESRV_STORAGE_RETENTION_MAX_AGE_MUSIC=
TELESRV_STORAGE_RETENTION_MAX_AGE_VOICE=
TELESRV_STORAGE_RETENTION_MAX_AGE_FILE=
TELESRV_STORAGE_RETENTION_MAX_AGE_AVATAR=
# Once enabled, actively reclaims space once total physical storage exceeds
# TELESRV_STORAGE_MAX_TOTAL_BYTES above: the oldest files (regardless of
# category/age) are purged the same way "hard" retention mode purges blob
# bytes, until back under budget. Independent of the retention mode switch
# above -- can run even when that's "off". Default false: TELESRV_STORAGE_MAX_
# TOTAL_BYTES otherwise only ever blocks new uploads, never reclaims from
# existing ones.
TELESRV_STORAGE_EVICTION_ENABLE=false
# Secret-chat encrypted files (photos/documents sent in a secret chat) are
# opaque ciphertext the server can't inspect -- none of the retention/
# eviction settings above ever touch them, so they otherwise accumulate
# forever. Secret chats are single-device on both ends (no multi-device
# sync), so once the one recipient device that will ever ask for a file has
# downloaded it in full, the server has no further reason to keep it.
# Default true: set to false if you'd rather keep the ciphertext around
# regardless (it still can't be read without the secret chat's own key).
TELESRV_SECRET_CHAT_DELETE_FILE_AFTER_DOWNLOAD=true


# ==============================================================================
# Advanced / internal tuning
#
# Everything below this line is NOT shown in the server-panel.py TUI. These
# are performance/capacity knobs (queue sizes, cache limits, retention
# windows, economy tuning, etc.) with defaults that work fine for a single
# self-hosted server. Edit them here directly if you actually need to.
# ==============================================================================

# RSA key: server identity used in the MTProto key exchange. Auto-generated
# on first run if the file doesn't exist yet.
TELESRV_RSA_KEY=data/server_rsa.pem
# Enforces exact DC-ID matching during key exchange. Leave off (default):
# this server is always a single physical backend, but client forks
# intentionally send DC IDs 1..5 for it, which is expected, not an attack.
TELESRV_STRICT_DC_CHECK=false
# Enables MTProto-over-WebSocket on the same port (for web-based clients),
# and which browser page origins are allowed to open that connection.
TELESRV_WEBSOCKET_ENABLE=true
TELESRV_WEBSOCKET_ALLOWED_ORIGINS=http://localhost:1234,http://127.0.0.1:1234
# pprof debug/profiling endpoint (CPU/heap/goroutine snapshots). Keep this
# on loopback; use an SSH tunnel to reach it remotely. Empty disables it.
TELESRV_DEBUG_ADDR=127.0.0.1:6060

# MTProto admission and shared inbound RPC budgets. Negative connection/handshake limits disable
# that gate; non-positive RPC values fall back to the built-in safe defaults.
TELESRV_MTPROTO_MAX_CONNECTIONS=200000
TELESRV_MTPROTO_MAX_CONNECTIONS_PER_IP=4096
TELESRV_MTPROTO_MAX_CONCURRENT_HANDSHAKES=256
TELESRV_MTPROTO_RPC_MAX_INFLIGHT=32
TELESRV_MTPROTO_RPC_QUEUE_SIZE=64
TELESRV_MTPROTO_RPC_TIMEOUT=30s
TELESRV_MTPROTO_RPC_GLOBAL_WORKERS=256
TELESRV_MTPROTO_RPC_GLOBAL_MAX_TASKS=32768
TELESRV_MTPROTO_RPC_GLOBAL_MAX_BYTES=536870912
# Metadata-only rpc_result receipt budgets: global >= auth >= session. ACK deletes immediately;
# 331s is only the no-ACK horizon. Payloads live solely in the logical-session outbound budget.
TELESRV_MTPROTO_RPC_EXECUTION_MAX_ENTRIES=262144
TELESRV_MTPROTO_RPC_EXECUTION_AUTH_MAX_ENTRIES=32768
TELESRV_MTPROTO_RPC_EXECUTION_SESSION_MAX_ENTRIES=16384
TELESRV_MTPROTO_RPC_EXECUTION_PENDING_PER_AUTH=2048
# Process-wide in-flight transport wire + decrypted plaintext reservation.
TELESRV_MTPROTO_INBOUND_FRAME_GLOBAL_MAX_BYTES=536870912
# Per-connection outbound mailboxes (normal/control) and process-wide resend pending bodies.
TELESRV_MTPROTO_OUTBOUND_QUEUE_SIZE=128
TELESRV_MTPROTO_OUTBOUND_CONTROL_QUEUE_SIZE=32
TELESRV_MTPROTO_OUTBOUND_TRACKED_GLOBAL_MAX_BYTES=536870912
# Concurrent encrypted wire/codec/obfuscation scratch (shared bounded pool, not per connection).
TELESRV_MTPROTO_OUTBOUND_WRITE_GLOBAL_MAX_BYTES=536870912

# Unauthenticated login-code issuance rate limits, by phone number digest and by connection.
TELESRV_AUTH_CODE_PHONE_RATE_LIMIT=5
TELESRV_AUTH_CODE_AUTH_KEY_RATE_LIMIT=20
TELESRV_AUTH_CODE_RATE_WINDOW=10m

# Postgres connection pool sizing.
TELESRV_POSTGRES_MAX_CONNS=50
TELESRV_POSTGRES_MIN_CONNS=16

# Cache linking each temporary encryption key to the permanent account key it
# belongs to (part of Perfect Forward Secrecy). Entries are removed as soon
# as a key is revoked or replaced, so this is just a performance cache.
TELESRV_TEMP_KEY_CACHE_MAX_ENTRIES=262144
TELESRV_TEMP_KEY_CACHE_TTL=30m

# In-memory read caches for channel rows/members/dialogs/boosts, kept fresh
# by database change notifications. Lower values use less RAM.
TELESRV_CHANNEL_ROW_CACHE_MAX=50000
TELESRV_CHANNEL_MEMBER_CACHE_MAX=100000
TELESRV_CHANNEL_DIALOG_CACHE_MAX=100000
TELESRV_CHANNEL_BOOST_CACHE_MAX=100000
TELESRV_CHANNEL_BOOST_CACHE_TTL=10s

# Background delivery workers that push new-message/update notifications to clients.
TELESRV_OUTBOX_WORKERS=4
TELESRV_OUTBOX_BATCH=100
TELESRV_OUTBOX_INTERVAL=200ms
TELESRV_OUTBOX_LEASE_TIMEOUT=30s
# Terminal failed outbox heads are kept briefly for diagnosis, then only the online
# delivery task is removed. The durable update remains available to getDifference.
TELESRV_OUTBOX_POISON_RETENTION=1m
TELESRV_OUTBOX_POISON_CLEANUP_INTERVAL=15s
TELESRV_OUTBOUND_PUSH_TIMEOUT=200ms
# How many messages an account may send per rate-limit window; <=0 disables this limit.
TELESRV_SEND_RATE_LIMIT=30
TELESRV_SEND_RATE_WINDOW=1m
# Rate limit for "catch up on missed updates" requests; <=0 disables it.
TELESRV_CATCHUP_RATE_LIMIT=0
TELESRV_CATCHUP_RATE_WINDOW=1m
# Cap on how many members get individually notified when a large channel changes; <=0 uses the built-in default.
TELESRV_CHANNEL_NUDGE_MAX_TARGETS=0

# Bounded retention/GC. User/channel update rows are only pruned behind protocol-safe floors.
TELESRV_UPDATE_EVENT_RETENTION=168h
TELESRV_BOT_API_UPDATE_RETENTION=24h
TELESRV_ORPHAN_AUTH_KEY_RETENTION=24h
TELESRV_RETENTION_INTERVAL=1h
TELESRV_RETENTION_BATCH=10000
# Cleanup of abandoned (never-finished) file upload fragments.
TELESRV_UPLOAD_PART_TTL=24h
TELESRV_UPLOAD_PART_GC_INTERVAL=30m
TELESRV_UPLOAD_PART_GC_BATCH=10000
TELESRV_UPLOAD_INFLIGHT_MAX_BYTES=4194304000
TELESRV_UPLOAD_INFLIGHT_MAX_PARTS=8000
TELESRV_UPLOAD_INFLIGHT_MAX_FILES=64

# Server-side fetching of external media links and link-preview cards (SSRF-safe fetch + size/rate limits).
TELESRV_EXTERNAL_MEDIA_ENABLE=true
TELESRV_EXTERNAL_MEDIA_MAX_BYTES=10485760
TELESRV_EXTERNAL_MEDIA_RATE_PER_MIN=60
TELESRV_WEBPAGE_PREVIEW_ENABLE=true
TELESRV_WEBPAGE_PREVIEW_MAX_BYTES=5242880
TELESRV_WEBPAGE_PREVIEW_RATE_PER_MIN=300

# Map tile disk cache location (paired with TELESRV_MAPBOX_TOKEN above).
TELESRV_MAPTILE_CACHE_DIR=data/maptiles

# Data directories the server seeds/serves media and content from.
TELESRV_LANGPACK_SEED_DIR=data/langpack
TELESRV_BLOB_DIR=data/blobs
TELESRV_STICKER_SEED_DIR=data/sticker-seed
# Caps how many built-in sticker sets get imported on startup; <=0 means no limit.
TELESRV_STICKER_SEED_MAX_SETS=300
# Sticker set auto-installed for every newly registered account; <=0 disables this.
TELESRV_DEFAULT_STICKER_SET_ID=0
# Drop plain .gif/.mp4 files here and they're imported into the admin-curated
# GIF catalog on startup (@gif serves it in the client's GIF picker) -- no
# export manifest needed, unlike TELESRV_STICKER_SEED_DIR above. Each file is
# imported once (matched by filename); renaming a file re-imports it as a new
# entry. Missing directory is skipped, not an error.
TELESRV_GIF_SEED_DIR=data/gifs
# Admin-editable server name/description/icon (Server Settings in the admin
# panel), served over /owpengram/server-info + /owpengram/server-icon and
# read fresh on every request -- editing them takes effect with no restart.
TELESRV_IDENTITY_DIR=data/identity

# How often the cached free-space/usage gauge behind the low-space guard
# (thresholds now live in the Storage & Media section above) refreshes.
TELESRV_STORAGE_USAGE_REFRESH_INTERVAL=1m

# New-account perks: free Telegram Premium months.
TELESRV_PREMIUM_GRANT_MONTHS=3
TELESRV_PREMIUM_SWEEP_INTERVAL=1m
TELESRV_PREMIUM_SWEEP_BATCH=500

# Origins allowed for WebAuthn/passkey requests; empty means any origin is accepted
# (the server usually can't predict a mobile app's origin ahead of time).
TELESRV_PASSKEY_ALLOWED_ORIGINS=

# Landing URL recorded on a minted collectible (NFT) username when the mint
# command carries no explicit URL. Empty derives
# <TELESRV_PUBLIC_BASE_URL>/nft/username/<username>. A template may carry the
# {username} placeholder; without it the name is appended as the last path
# segment. No external marketplace is contacted.
TELESRV_COLLECTIBLE_USERNAME_URL_TEMPLATE=

# Tuning for official platform verification (applications filed through
# @verifybot); the on/off switch (TELESRV_VERIFICATION_ENABLED) and the
# user-target toggle (TELESRV_VERIFICATION_ALLOW_USER_TARGETS) are in the
# Moderation/Verification/Rating section above.
# How long an applicant must wait before filing the same target again after a
# rejection, measured from the decision so a slow review never shortens it.
# 0 disables the cooldown; must be 0..8760h.
TELESRV_VERIFICATION_REJECT_COOLDOWN=720h
# Applications one applicant may create per window. Either value 0 disables the
# budget; a positive limit requires a positive window.
TELESRV_VERIFICATION_APPLY_RATE_LIMIT=3
TELESRV_VERIFICATION_APPLY_RATE_WINDOW=24h
# @verifybot dialog rate per applicant, independent of how many applications are
# actually created. Either value 0 disables it.
TELESRV_VERIFICATION_BOT_RATE_LIMIT=30
TELESRV_VERIFICATION_BOT_RATE_WINDOW=1m
# Applicant notification worker. A decision commits with its outbox row, never
# with a message send, so delivery is a separate retrying cycle over durable
# rows. Interval must be positive; batch must be 1..500.
TELESRV_VERIFICATION_NOTIFY_INTERVAL=15s
TELESRV_VERIFICATION_NOTIFY_BATCH=50
TELESRV_BROADCAST_WORKER_INTERVAL=3s
TELESRV_BROADCAST_WORKER_LEASE=30s
TELESRV_BROADCAST_MATERIALIZE_BATCH=200
TELESRV_BROADCAST_DELIVERY_BATCH=50
# Applications one applicant may keep open at once; 0 disables the cap, maximum
# is 50.
TELESRV_VERIFICATION_MAX_ACTIVE_PER_USER=3
# System broadcast delivery worker (messages sent from account 777000). Same
# durable-outbox pattern as the verification notifier above.
TELESRV_BROADCAST_WORKER_INTERVAL=3s
TELESRV_BROADCAST_WORKER_BATCH=50

# Tuning for third-party bot verification; the on/off switch
# (TELESRV_BOT_VERIFICATION_ENABLED) is in the Moderation/Verification/Rating
# section above.
# Peers one verifier bot may mark. Verifier status is granted per deployment rather
# than earned per peer, so an unbounded verifier would be an unbounded badge
# printer. 0 disables the service bound and leaves only the storage bound, which is
# also the maximum accepted here (10000).
TELESRV_BOT_VERIFICATION_MAX_PER_VERIFIER=10000
# Verification applications one applicant may file per window, across all verifier
# bots. Either value 0 disables the budget; a positive limit requires a positive
# window. Looser than the official budget on purpose: a deployment can run several
# verifier companies, and filing with a second one is not a retry of the first.
TELESRV_BOT_VERIFICATION_REQUEST_RATE_LIMIT=5
TELESRV_BOT_VERIFICATION_REQUEST_RATE_WINDOW=24h

# Optional Premium feature-preview media export. Missing directory keeps the
# no-video fallback; an existing but incomplete/invalid directory fails startup.
TELESRV_PREMIUM_PROMO_SEED_DIR=data/premium-promo

# 1-to-1 call timing/limits.
TELESRV_CALL_RING_TIMEOUT=90s
TELESRV_CALL_TOMBSTONE_TTL=60s
TELESRV_CALL_MAX_ACTIVE_PER_USER=4
TELESRV_CALL_SIGNALING_MAX_BYTES=65536
TELESRV_CALL_SIGNALING_RATE=50
TELESRV_CALL_EXPIRY_INTERVAL=1s
TELESRV_CALL_TURN_CREDENTIAL_TTL=6h
# Forces calls through the TURN relay even when a direct connection would work (debugging only).
TELESRV_CALL_FORCE_RELAY=false

# Group call housekeeping (participant liveness checks, stale-entry cleanup).
TELESRV_GROUPCALL_CHECK_TTL=45s
TELESRV_GROUPCALL_SWEEP_INTERVAL=10s

# Extra live-streaming options: where the "connect OBS here" URL points (auto-derived if
# empty), the working directory for stream segments, and how many seconds of each stream
# are kept in memory.
TELESRV_LIVESTREAM_RTMP_URL=
TELESRV_LIVESTREAM_WORK_DIR=
TELESRV_LIVESTREAM_SEGMENT_KEEP=32

# Telegram Login (OpenID Connect) advanced settings: local key files (generate with
# `go run ./cmd/telegramloginkeygen -mode init`), token lifetimes, and cleanup.
TELESRV_TELEGRAM_LOGIN_SIGNING_KEYS_FILE=data/telegram-login/signing-keys.json
TELESRV_TELEGRAM_LOGIN_CODE_KEYS_FILE=data/telegram-login/code-keys.json
TELESRV_TELEGRAM_LOGIN_SECRET_PEPPER_FILE=data/telegram-login/client-secret-pepper
TELESRV_TELEGRAM_LOGIN_REQUEST_TTL=5m
TELESRV_TELEGRAM_LOGIN_CODE_TTL=2m
TELESRV_TELEGRAM_LOGIN_ID_TOKEN_TTL=1h
# Trust only the loopback nginx hop in the documented single-host deployment.
TELESRV_TELEGRAM_LOGIN_TRUSTED_PROXY_CIDRS=127.0.0.1/32,::1/128
TELESRV_TELEGRAM_LOGIN_RETENTION=168h
TELESRV_TELEGRAM_LOGIN_SWEEP_INTERVAL=5m
TELESRV_TELEGRAM_LOGIN_SWEEP_BATCH=500

# AI compose provider chain (tried in order; "local" is deterministic and never leaves
# the server) and its limits.
TELESRV_AI_PROVIDERS=local
TELESRV_AI_TIMEOUT=15s
TELESRV_AI_RATE_LIMIT=20
TELESRV_AI_RATE_WINDOW=1m
# When false (default), logs only length/provider/status for AI calls -- never the
# user's actual input or generated text.
TELESRV_AI_LOG_CONTENT=false

# Chat/message translation reuses the remote providers declared above. The
# deterministic "local" AI provider is excluded because it cannot translate.
# Leave TRANSLATION_PROVIDERS empty to use all configured remote AI providers,
# or provide a comma-separated subset such as "openai,gemini".
TELESRV_TRANSLATION_PROVIDERS=
TELESRV_TRANSLATION_TIMEOUT=15s
# Counts translated text items, not RPC envelopes (one RPC may contain 20).
TELESRV_TRANSLATION_RATE_LIMIT=60
TELESRV_TRANSLATION_RATE_WINDOW=1m

# External AI providers are optional. Keep API keys in TELESRV_* variables here;
# the loader rejects non-TELESRV keys from .env files by design.
# TELESRV_AI_OPENAI_KIND=openai_responses
# TELESRV_AI_OPENAI_API_KEY=
# TELESRV_AI_OPENAI_MODEL=
# TELESRV_AI_OPENAI_BASE_URL=
# TELESRV_AI_OPENAI_MAX_OUTPUT_TOKENS=1024
# TELESRV_AI_OPENAI_TEMPERATURE=0.2
# TELESRV_AI_OPENAI_OMIT_TEMPERATURE=false
# TELESRV_AI_OPENAI_THINKING=
# TELESRV_AI_GEMINI_KIND=gemini
# TELESRV_AI_GEMINI_API_KEY=
# TELESRV_AI_GEMINI_MODEL=
# TELESRV_AI_GEMINI_TEMPERATURE=0.2
# TELESRV_AI_ANTHROPIC_KIND=anthropic
# TELESRV_AI_ANTHROPIC_API_KEY=
# TELESRV_AI_ANTHROPIC_MODEL=

# Kimi/Moonshot can be used as an OpenAI-compatible Chat Completions provider.
# TELESRV_AI_PROVIDERS=kimi,local
# TELESRV_AI_KIMI_KIND=openai_chat
# TELESRV_AI_KIMI_API_KEY=
# TELESRV_AI_KIMI_BASE_URL=https://api.moonshot.cn/v1
# TELESRV_AI_KIMI_MODEL=kimi-k2.6
# TELESRV_AI_KIMI_THINKING=disabled
# TELESRV_AI_KIMI_TEMPERATURE=0.6