server:
  # Bind locally by default; change as needed for LAN/public access.
  listen_addr: "127.0.0.1:8080"

limits:
  # Conservative default limits suitable for small scratch usage.
  max_upload_size: "5MB"
  default_ttl: "30m"

storage:
  # Directory used for scratch files + metadata index.
  data_dir: "./data"
  cleanup_interval: "30s"

security:
  # Empty means all source IPs can write.
  # Add explicit IPs/CIDRs to lock down POST /api/scratch.
  allowed_ips: []
  trust_proxy_headers: false

  rate_limit:
    enabled: true
    requests_per_minute: 20
    burst: 5