APP_BASE_URL=https://updates.example.com
ADMIN_EMAIL=admin@example.com
ADMIN_PASSWORD=change-this-before-production
APP_LOG_LEVEL=INFO

# The app stores session tokens in SQLite, so there is no separate SESSION_SECRET
# in the current architecture.
APP_READ_TIMEOUT=30s
APP_READ_HEADER_TIMEOUT=5s
APP_WRITE_TIMEOUT=60s
APP_IDLE_TIMEOUT=120s
APP_MAX_HEADER_BYTES=1048576
APP_LOGIN_RATE_LIMIT_PER_MINUTE=10
APP_LOGIN_RATE_LIMIT_BURST=5
APP_CLIENT_RATE_LIMIT_PER_MINUTE=120
APP_CLIENT_RATE_LIMIT_BURST=60