# Required (PAT mode only — see AUTH_MODE below)
GITLAB_PERSONAL_ACCESS_TOKEN=

# Transport / bind
GITLAB_API_URL=https://gitlab.com/api/v4
PORT=3000
# HOST defaults to 127.0.0.1 (loopback only). Set to 0.0.0.0 to expose to
# the network — but only with AUTH_MODE=oauth, otherwise startup refuses.
HOST=127.0.0.1
USE_SSE=false
USE_STREAMABLE_HTTP=false

# Auth
# AUTH_MODE=pat   — single static GITLAB_PERSONAL_ACCESS_TOKEN; loopback only.
# AUTH_MODE=oauth — per-connection Authorization: Bearer; required for any
#                   network-exposed bind (HOST != 127.0.0.1).
AUTH_MODE=pat

# Misc
GITLAB_READ_ONLY_MODE=false
# Empty defaults to '*' only when AUTH_MODE=pat AND bind is loopback.
# Network-exposed binds need an explicit comma-separated allowlist.
CORS_ALLOW_ORIGINS=
HEALTHZ_MAX_SESSIONS=10000