BOT_TOKEN=your_bot_token_here
DATABASE_URL=sqlite:///data/duty_teller.db
MINI_APP_BASE_URL=
# HTTP_HOST=127.0.0.1  # use 0.0.0.0 to bind all interfaces
HTTP_PORT=8080

# Access: roles are assigned in the DB by an admin via /set_role. When a user has no role in DB,
# ADMIN_USERNAMES and ADMIN_PHONES act as fallback for admin only. ALLOWED_* are not used for access.
ALLOWED_USERNAMES=
ADMIN_USERNAMES=admin1,admin2

# Optional: admin fallback by phone (user sets phone via /set_phone). Comma-separated; digits only for comparison.
# ALLOWED_PHONES=
# ADMIN_PHONES=79001111111

# Dev only: set to 1 to allow /api/duties and /api/calendar-events without Telegram initData.
# Insecure — never use in production.
# MINI_APP_SKIP_AUTH=1

# Optional: URL of a public ICS calendar (e.g. holidays). Days from this calendar are highlighted on the duty grid; click "i" for summary.
# EXTERNAL_CALENDAR_ICS_URL=https://example.com/holidays.ics

# Timezone for the pinned duty message in groups (e.g. Europe/Moscow).
# DUTY_DISPLAY_TZ=Europe/Moscow

# When the pinned duty message is updated on schedule, re-pin so members get a notification (default: 1). Set to 0 or false to disable.
# DUTY_PIN_NOTIFY=1

# Log level for backend and Mini App console logs: DEBUG, INFO, WARNING, ERROR. Default: INFO.
# LOG_LEVEL=INFO

# Single source of language for bot, API, and Mini App (en or ru). Default: en. No auto-detection.
# DEFAULT_LANGUAGE=en

# Reject Telegram initData older than this (seconds). 0 = do not check (default).
# INIT_DATA_MAX_AGE_SECONDS=0

# Comma-separated CORS origins; leave unset for *.
# CORS_ORIGINS=
