; CouchDB config for Obsidian LiveSync.
; Obsidian talks to CouchDB from an app:// origin, so CORS must allow it explicitly --
; a wildcard origin is not permitted alongside credentials.

[couchdb]
single_node = true
max_document_size = 50000000

[chttpd]
require_valid_user = true
; ...but leave /_up open, so the Prometheus blackbox probe can health-check it
; without credentials. Everything else still returns 401 to anonymous callers.
require_valid_user_except_for_up = true
max_http_request_size = 4294967296
bind_address = 0.0.0.0

[chttpd_auth]
require_valid_user = true
authentication_redirect = /_utils/session.html

[httpd]
WWW-Authenticate = Basic realm="couchdb"
enable_cors = true

[cors]
credentials = true
; Obsidian desktop is app://obsidian.md; mobile uses capacitor://localhost.
origins = app://obsidian.md,capacitor://localhost,http://localhost
methods = GET,PUT,POST,HEAD,DELETE
headers = accept,authorization,content-type,origin,referer,x-csrf-token