# Copy to deploy/.env and edit. BIND_ADDR is the only laptop-vs-server listen switch.
# Never set BIND_ADDR to 0.0.0.0, ::, or empty — deploy/up.sh refuses those before compose starts.

BIND_ADDR=127.0.0.1

# A VPN belongs on the HOST, not in this file. Run Tailscale/WireGuard there and set BIND_ADDR to
# its interface address. The privacy guarantee was never "a VPN container exists" — it is
# "BIND_ADDR is not a wildcard".

# Real DSH UI. Build with deploy/build-dsh.sh (injects the synapse plugin), then set:
# DSH_IMAGE=synapse-dsh:local
# SYNAPSE_MCP_HTTP_URL=http://127.0.0.1:3000/mcp
# SYNAPSE_MCP_TOKEN=
# OPENCODE_GO_API_KEY=

# Optional. Leave unset to keep the dsh-stub placeholder on :8080.
# DSH_IMAGE=