Secure socket broker with token auth and rooms

Dockers/socket-broker/env.example

@@ -4,13 +4,29 @@
 # WebSocket server port
 WS_PORT=3000
 
-# HTTP API server port
+# HTTP API port (set equal to WS_PORT to serve both on one port)
 API_PORT=8080
 
-# API Key for authentication (REQUIRED for production)
-# This key must be provided in HTTP requests to publish messages
-# Generate a strong, random key for production use
+# API Key for publishing messages (REQUIRED for production)
+# This key is only for backend publishers; do not expose it to clients.
 API_KEY=your-secure-api-key-here
 
+# Shared HMAC secret used to verify short-lived client subscription tokens.
+# Must match SOCKET_TOKEN_SECRET in the Laravel backend.
+SOCKET_TOKEN_SECRET=your-socket-token-secret-here
+
+# Client authentication mode:
+#   off      - no client auth (local development only)
+#   optional - accept valid tokens, allow legacy unauthenticated clients (rollout only)
+#   required - reject unauthenticated clients (production)
+AUTH_MODE=required
+
+# Comma-separated allowed origins. Supports exact origins and *.domain.tld.
+ALLOWED_ORIGINS=https://*.comedykit.be,https://comedykit.be,https://www.comedykit.be,http://localhost:5173,http://localhost:3000,capacitor://localhost,http://localhost,https://localhost
+
+# Subscription limits
+MAX_TOPICS_PER_SOCKET=20
+SUBSCRIBE_RATE_LIMIT=30
+
 # Node environment
-NODE_ENV=production
+NODE_ENV=production