GITEA_URL=http://gitea:3000
GITEA_BOT_USER=rfc-bot
GITEA_BOT_TOKEN=tier1-bot-token-PLACEHOLDER
GITEA_ORG=wiggleverse
META_REPO=ohm-content
REGISTRY_REPO=rfc-registry
DEFAULT_PROJECT_ID=ohm
OAUTH_CLIENT_ID=tier1-oauth-client-PLACEHOLDER
OAUTH_CLIENT_SECRET=tier1-oauth-secret-PLACEHOLDER
APP_URL=http://localhost:8080
SECRET_KEY=tier1-not-secret
DATABASE_PATH=/data/rfc-app.db
OWNER_GITEA_LOGIN=owner
GITEA_WEBHOOK_SECRET=tier1-webhook-secret
ENABLED_MODELS=claude
SMTP_HOST=mailpit
SMTP_PORT=1025
SMTP_STARTTLS=false
EMAIL_FROM=rfc@example.test
EMAIL_FROM_NAME=RFC Tier1
EMAIL_ENABLED=true
TURNSTILE_REQUIRED=false
# Tier-1/e2e: disable the per-email OTC request cooldown so a test can sign the
# same account in more than once across specs without 429s.
OTC_REQUEST_COOLDOWN_SECONDS=0
# Tier-1/e2e drives the auth endpoints repeatedly from one IP; lift the per-IP
# sliding-window budgets well above a single suite run (prod leaves these unset
# and keeps the secure defaults).
RATELIMIT_OTC_REQUEST_MAX=1000
RATELIMIT_VERIFY_MAX=1000