# rc-notifications-bun — environment configuration
#
# Where to forward incoming RingCentral webhook payloads. The proxy POSTs the
# body+headers verbatim. RC's validation handshake (the Validation-Token GET/POST)
# is handled locally and never forwarded.
RC_DOWNSTREAM_URL=

# Optional: when set, the proxy computes HMAC-SHA256(body) and forwards it as
# the X-RC-Webhook-Signature header. Downstream uses this to verify integrity.
# RC_WEBHOOK_SECRET=

# Strongly recommended (acts as inbound auth on the public Funnel endpoint).
# Set this to the same `verificationToken` you configured on the RingCentral
# webhook subscription. The proxy rejects non-handshake requests whose
# `Verification-Token` header doesn't match, returning 401. If unset, all
# POSTs are forwarded (legacy behaviour).
# RC_EXPECTED_VERIFICATION_TOKEN=

# Port to listen on (default 18803, fronted by Tailscale Funnel at /rc).
# PORT=18803