# HTTP Server Configuration
PORT=8931
# Playwright Configuration
PLAYWRIGHT_BROWSER=chromium
PLAYWRIGHT_HEADLESS=true
# Browser launch arguments (space-separated, e.g., for Cloud Run: --no-sandbox --disable-setuid-sandbox)
# PLAYWRIGHT_BROWSER_ARGS=--no-sandbox --disable-setuid-sandbox --disable-dev-shm-usage
# Logging
LOG_LEVEL=info
# Authentication (2025 MCP Standard - Streamable-HTTP requires authentication)
# Option 1: Direct token (for development/testing)
# AUTH_TOKEN=your-secure-token-here
# Option 2: GCP Secret Manager (recommended for production)
# AUTH_SECRET_NAME=playwright-mcp-auth-token
# GCP_PROJECT_ID=your-project-id
# Optional: Session Management
# MAX_SESSIONS=10
# SESSION_TIMEOUT=3600
# Optional: CORS Configuration
# CORS_ORIGIN=*
# Security Configuration (Phase 1 - Beta Testing)
# Rate limiting: 100 requests per 15 minutes per IP
RATE_LIMIT_WINDOW_MS=900000 # 15 minutes in milliseconds
RATE_LIMIT_MAX=100 # Max requests per window
# Request timeout: 30 seconds
REQUEST_TIMEOUT_MS=30000
# Max concurrent browser operations: 5
MAX_CONCURRENT_BROWSERS=5
# URL whitelist (comma-separated, optional - leave empty to allow all HTTP(S) URLs)
# Examples:
# ALLOWED_DOMAINS=google.com,wikipedia.org,example.com
# ALLOWED_DOMAINS=.example.com # Allows example.com and all subdomains
