config.yaml.example

app:
  name: Elo Ranking System
  club_name: My Dart Club
  environment: development
  debug: true
  timezone: Europe/Berlin
  # Date format for display. Options:
  #   dd/MM/yyyy  (default, e.g. 25/07/2026)
  #   MM/dd/yyyy  (e.g. 07/25/2026)
  #   yyyy-MM-dd  (e.g. 2026-07-25)
  #   dd.MM.yyyy  (e.g. 25.07.2026)
  date_format: dd/MM/yyyy
  base_url: ""  # Public URL for QR code behind reverse proxy, e.g. https://darts.example.com

elo:
  default_rating: 1200
  k_factor: 32

ranking:
  inactivity_months: 3

statistics:
  high_finish_min: 100
  high_finish_max: 170
  low_darts_min: 9
  low_darts_max: 21
  best_of_legs: 5  # Must be odd: 1, 3, 5, 7, 9...

legal:
  contact_company: Company
  contact_name: Max Mustermann
  contact_street: Musterstrasse 1
  contact_city: 11111 Musterstadt
  contact_email: max.Mustermann@Muster.mu

system_user:
  username: system
  password: change_me

security:
  # MUST be a strong, unique secret. The app refuses to start outside
  # development while this is a default/placeholder (fail-fast).
  jwt_secret: change_me  # Generate with: openssl rand -hex 32
  jwt_algorithm: HS256
  access_token_lifetime_minutes: 480
  cookie_secure: true  # Set to false for local HTTP development
  cookie_httponly: true
  cookie_samesite: strict  # Use 'lax' for local development if needed
  # Disable CSRF / rate limiting ONLY for local development; keep enabled in
  # production.
  csrf_enabled: true
  rate_limit_enabled: true
  # Comma-separated IPs of trusted reverse proxies (e.g. 127.0.0.1). When set,
  # X-Forwarded-For is honored for rate limiting and audit IPs. Leave empty to
  # always use the direct socket peer.
  trusted_proxies: ""

storage:
  data_dir: /data
  upload_dir: /uploads

audit:
  # Audit log retention in days. Entries older than this are pruned on
  # application startup (0 or negative disables pruning).
  retention_days: 365