# SQLite (default)
DB_URI=sqlite:./db.sqlite
# or Postgres
# DB_URI=postgres://nao:nao@localhost:8888/nao
# Enable SQL query logging (set to 'true' to enable)
# DB_QUERY_LOGGING=true

# Chat app port (optional)
SERVER_PORT=5005

# Docker Postgres
POSTGRES_USER=nao
POSTGRES_PASSWORD=nao
POSTGRES_DB=nao

# Auth
BETTER_AUTH_SECRET= #run `openssl rand -base64 32` to generate
# Public URL of your app (used for authentication, trusted origins, and Slack redirects)
BETTER_AUTH_URL=http://localhost:3000

# LLM providers
OPENAI_API_KEY=sk-123456789
ANTHROPIC_API_KEY=sk-123456789

# Qwen (Alibaba Cloud Model Studio) — the base URL defaults to the Singapore endpoint
# DASHSCOPE_API_KEY=sk-123456789
# DASHSCOPE_BASE_URL=https://dashscope-intl.aliyuncs.com/compatible-mode/v1

# MiniMax
# MINIMAX_API_KEY=your-minimax-api-key
# MINIMAX_BASE_URL=https://api.minimax.io/v1

# Moonshot (Kimi)
# MOONSHOT_API_KEY=sk-123456789
# MOONSHOT_BASE_URL=https://api.moonshot.ai/v1

# Requesty
# REQUESTY_API_KEY=your-requesty-api-key
# REQUESTY_BASE_URL=https://router.requesty.ai/v1

# Any other OpenAI-compatible endpoint (vLLM, LiteLLM, Together, a local server, …).
# The base URL is required, the API key only if the endpoint asks for one. These variables
# configure one endpoint: add further ones in Settings > Project > Models, each under its own name.
# OPENAI_COMPATIBLE_BASE_URL=http://localhost:8000/v1
# OPENAI_COMPATIBLE_API_KEY=sk-123456789

# Azure OpenAI
# AZURE_API_KEY=your-azure-api-key
# Either resource name or base URL — not both:
# AZURE_RESOURCE_NAME=your-resource-name
# AZURE_OPENAI_BASE_URL=https://your-resource.openai.azure.com
# AZURE_API_VERSION=v1
# AZURE_USE_DEPLOYMENT_BASED_URLS=false

# AWS Bedrock
# AWS_REGION=us-east-1
# Pick ONE of the following auth methods:
#   (a) Bearer token
# AWS_BEARER_TOKEN_BEDROCK=your-bearer-token
#   (b) Static IAM credentials
# AWS_ACCESS_KEY_ID=your-access-key
# AWS_SECRET_ACCESS_KEY=your-secret-key
#   (c) Ambient credentials from the AWS SDK chain — IAM task role (ECS),
#       IRSA (EKS), named profile, SSO. Any of these env vars will surface
#       Bedrock as auto-configured:
# AWS_PROFILE=your-profile                       # named profile from ~/.aws/credentials
# AWS_CONTAINER_CREDENTIALS_RELATIVE_URI=...     # set automatically on ECS
# AWS_WEB_IDENTITY_TOKEN_FILE=...                # set automatically on EKS / IRSA
#   (d) EC2 instance profile or default ~/.aws/credentials profile — these
#       leave no env footprint, so opt in explicitly:
# AWS_USE_INSTANCE_CREDENTIALS=true

# Providers to keep out of this deployment entirely (comma-separated kinds, or
# openaiCompatible/<name> for a named instance). A disabled provider never
# auto-registers from ambient credentials — e.g. IRSA on EKS surfaces Bedrock
# on every pod — and is ignored even when configured in the UI or nao_config.yaml.
# DISABLED_PROVIDERS=bedrock,vertex

# App metadata (optional)
APP_VERSION=dev
APP_COMMIT=unknown
APP_BUILD_DATE=

# Cloud mode only: enables the internal backoffice API when set to a 32+ character key.
NAO_BACKOFFICE_API_KEY=

# Context folder (to change for your setup)
NAO_DEFAULT_PROJECT_PATH=/Users/blef/Work/naolabs/chat/example

# Git-based context (Docker only) — fully supported for deployments that pull context from Git.
# Connecting GitHub in Settings > Git is recommended when pull requests should be opened as each user.
# Set NAO_CONTEXT_SOURCE=git to enable, then point NAO_DEFAULT_PROJECT_PATH at a clone target inside the container (e.g. /app/context).
# NAO_CONTEXT_SOURCE=git
# NAO_CONTEXT_GIT_URL=https://github.com/your-org/your-nao-context.git
# NAO_CONTEXT_GIT_BRANCH=main
# Override platform detection for self-hosted GitHub, GitLab, or Bitbucket hosts.
# NAO_CONTEXT_GIT_PLATFORM=gitlab
# Authentication — pick ONE of:
#   (a) HTTPS + personal access token (NAO_CONTEXT_GIT_URL must be https://...)
# NAO_CONTEXT_GIT_TOKEN=ghp_xxx
# Bitbucket repository/workspace access tokens need only NAO_CONTEXT_GIT_TOKEN.
#   (b) SSH deploy key (NAO_CONTEXT_GIT_URL must be git@github.com:org/repo.git)
# NAO_CONTEXT_GIT_SSH_KEY="-----BEGIN OPENSSH PRIVATE KEY-----\n...\n-----END OPENSSH PRIVATE KEY-----"
# Clone only a subfolder of the repo (sparse checkout) — useful for monorepos.
# NAO_CONTEXT_GIT_SUBPATH=analytics/finance

# Permanent storage — durable space where the agent saves files, scoped per user
# per project. Configured once for the whole nao instance. It shows up to the
# agent as the /home folder of the file tree, alongside the project context.
# NAO_STORAGE_BACKEND=local
#
#   (a) local — a directory on disk. Defaults to ./storage.
#       When running more than one replica, every replica MUST mount the same
#       read-write-many volume (NFS, EFS, Filestore, RWX PVC) at this path,
#       otherwise each replica sees a different set of files.
# NAO_STORAGE_LOCAL_PATH=./storage
#
#   (b) s3 — an S3 or S3-compatible bucket (AWS S3, MinIO, Cloudflare R2, …).
#       Recommended for any deployment above one replica.
# NAO_STORAGE_BACKEND=s3
# NAO_STORAGE_S3_BUCKET=my-nao-storage
# NAO_STORAGE_S3_REGION=eu-west-1
# Store everything under a key prefix, to share a bucket with other workloads.
# NAO_STORAGE_S3_PREFIX=nao
# Custom endpoint for S3-compatible providers (needs force path style for MinIO).
# NAO_STORAGE_S3_ENDPOINT=https://minio.internal:9000
# NAO_STORAGE_S3_FORCE_PATH_STYLE=true
# Credentials are optional — when omitted, the default AWS credential chain is
# used, so IAM roles, ECS task roles and EKS/IRSA work with no config.
# NAO_STORAGE_S3_ACCESS_KEY_ID=
# NAO_STORAGE_S3_SECRET_ACCESS_KEY=
#
#   (c) none — permanent storage is off: the agent has no write tool and cannot
#       reach stored files. Nothing already saved is deleted.
# NAO_STORAGE_BACKEND=none
#
# Largest single file that can be written to storage, in megabytes. Applies to
# every backend; a bigger file is rejected before anything is stored.
# NAO_STORAGE_MAX_FILE_SIZE_MB=10

# Default for the MCP endpoint toggle (Settings > MCP Endpoint) while a project
# has no stored settings — lets a fresh deployment come up with external MCP
# clients already able to connect. Once an admin saves the settings in the UI,
# the stored value wins and this is ignored.
# MCP_ENDPOINT_ENABLED=true

# Public base URL external MCP clients connect to, if it differs from
# BETTER_AUTH_URL — e.g. the MCP endpoint is exposed on an internet-facing host
# while the UI stays on a private/VPN-only host. Its /mcp URL is accepted as an
# OAuth token audience, and the protected-resource metadata + WWW-Authenticate
# header advertise whichever host the client used. Leave unset for single-host
# deployments.
# MCP_PUBLIC_URL=https://nao-mcp.example.com

# Zero-downtime deploys behind a load balancer — on SIGTERM, /api/health returns
# 503 for this long while requests are still served, so the load balancer moves
# traffic away; the server then exits once in-flight requests (including chat
# streams) have finished. Set it above your health check interval. Defaults to 0.
# SHUTDOWN_DRAIN_DELAY_MS=10000

# Enterprise license — signed token issued by getnao.
# Accepts either the raw token or a path to a file containing it.
# When unset, the app runs in OSS mode and all EE features (SSO, …) stay off.
# NAO_LICENSE=/etc/nao/license.key
# NAO_LICENSE=eyJhbGciOiJFZERTQSJ9.eyJpc3MiOiJnZXRuYW8iLC...

# Slack integration — declarative alternative to the Settings > Slack form.
# When SLACK_BOT_TOKEN is set, these seed the default project's Slack settings
# on boot. A config saved through the UI is never overwritten (delete it in
# Settings > Slack to hand ownership to the environment); model selection,
# reply mode and auto-created users stay UI-managed either way.
# SLACK_BOT_TOKEN=xoxb-...
# Socket Mode (recommended when nao is not reachable from the internet) — set
# the app-level token; the transport defaults to socket when it is present.
# SLACK_APP_TOKEN=xapp-...
# Webhook mode instead: the signing secret is required and Slack must be able
# to reach BETTER_AUTH_URL/api/webhooks/slack.
# SLACK_SIGNING_SECRET=...
# Optional explicit transport override: socket | webhook
# SLACK_TRANSPORT_MODE=socket

# SMTP server Configuration
SMTP_HOST=              # smtp.yourservice.com
SMTP_SSL=false
SMTP_PORT=              # Default to 587
SMTP_MAIL_FROM=
# Optional SMTP auth username — falls back to SMTP_MAIL_FROM when unset.
# Set this when the login username differs from the "From" address (e.g. AWS SES).
# SMTP_USER=
SMTP_PASSWORD=

# GOOGLE OAuth Configuration
GOOGLE_CLIENT_ID=
GOOGLE_CLIENT_SECRET=
GOOGLE_AUTH_DOMAINS=

# GitHub OAuth app — used for the cloud "import from GitHub" integration
# (cloning user repos) and, optionally, as an SSO login provider.
# Create an OAuth app at https://github.com/settings/developers
GITHUB_CLIENT_ID=
GITHUB_CLIENT_SECRET=
# Set to true to also enable "Sign in with GitHub" using the same OAuth app.
# GITHUB_SSO=false
# When SSO is enabled, restrict login to this comma-separated list of GitHub
# usernames. In CI, the PR author is appended automatically.
GITHUB_ALLOWED_USERS=
# Role assigned to new users (admin, user, or viewer — defaults to user)
# DEFAULT_USER_ROLE=user

# GitLab OAuth app — used for the cloud "import from GitLab" integration
# (cloning user repos) and, optionally, as an SSO login provider.
# Create an OAuth app under User Settings > Applications on your GitLab instance.
GITLAB_CLIENT_ID=
GITLAB_CLIENT_SECRET=
# Set to true to also enable "Sign in with GitLab" using the same OAuth app.
# GITLAB_SSO=false
# When SSO is enabled, restrict login to this comma-separated list of GitLab
# usernames. In CI, the PR author is appended automatically.
GITLAB_ALLOWED_USERS=
# Base URL of your GitLab instance — set this for self-hosted GitLab.
# Defaults to https://gitlab.com.
# GITLAB_BASE_URL=https://gitlab.com
# Override the OAuth callback URL if it can't be derived automatically.
# GITLAB_REDIRECT_URI=

# Microsoft / Azure AD SSO (Enterprise — requires NAO_LICENSE with the 'sso' feature)
# AZURE_AD_CLIENT_ID=
# AZURE_AD_CLIENT_SECRET=
# AZURE_AD_TENANT_ID=
# Map Entra group Object IDs to named nao User Groups in one project or every project (*).
# Default project roles create only missing explicit project memberships; existing roles stay editable.
# AZURE_AD_GROUP_NAO_GROUP_MAPPING= # e.g. a0b1c2d3-e4f5-6789-abcd-ef0123456789:*:Analysts
# Map Entra group Object IDs to organization roles only. Valid roles: admin, user, viewer.
# Group overage is verified with Microsoft Graph during sign-in and denied if verification fails.
# AZURE_AD_GROUP_NAO_ROLE_MAPPING=  # e.g. a0b1c2d3-e4f5-6789-abcd-ef0123456789:admin
# Deprecated: existing deployments may temporarily keep AZURE_AD_GROUP_ROLE_MAPPING, but should rename it.
# Scope used to silently acquire downstream access tokens (e.g. Redshift native IdP).
# Set to the exposed API scope whose audience the downstream resource expects, e.g.
# api://<clientId>/user_impersonation. Defaults to <clientId>/.default.
# AZURE_AD_TOKEN_SCOPE=

# OIDC / SSO Configuration (Enterprise — requires NAO_LICENSE with the 'sso' feature)
# Works with Okta, Auth0, Keycloak, OneLogin, etc.
# See apps/backend/docs/auth-oidc.md for provider-specific setup instructions.
# OIDC_PROVIDER_ID=okta            # Unique ID — defaults to "oidc"
# OIDC_PROVIDER_NAME=Okta          # Button label: "Continue with {name}" — defaults to "SSO"
# OIDC_DISCOVERY_URL=              # e.g., https://dev-xxxxx.okta.com/oauth2/default/.well-known/openid-configuration
# OIDC_CLIENT_ID=
# OIDC_CLIENT_SECRET=
# OIDC_SCOPES=openid,profile,email # Comma-separated — defaults to "openid,profile,email"
# OIDC_AUTH_DOMAINS=               # Comma-separated email domain allowlist (optional)
# OIDC_PKCE=true                   # true (default) or false
# Map identity provider groups to organization roles. Valid roles: admin, user, viewer.
# Organization roles are re-applied on every sign-in; explicit project roles stay unchanged.
# An emitted claim with no valid mapped group denies sign-in; a missing claim leaves roles unchanged.
# The claim must be emitted in the ID token, not only userinfo — see apps/backend/docs/auth-oidc.md.
# OIDC_GROUPS_CLAIM=groups         # Claim holding the group list — defaults to "groups"
# OIDC_GROUP_NAO_ROLE_MAPPING=     # e.g. nao-admins:admin,nao-analysts:user,nao-viewers:viewer
# Deprecated: existing deployments may temporarily keep OIDC_GROUP_ROLE_MAPPING, but should rename it.
# Map OIDC groups to named nao User Groups in one project or every project (*).
# Values cannot contain commas or colons. Project scopes use stable project IDs, not project names.
# OIDC_GROUP_NAO_GROUP_MAPPING=     # e.g. finance-team:*:Analysts,leaders:project-id:Managers
# Maximum OIDC session age in seconds, measured from sign-in. Forces periodic reauthentication.
# SSO_SESSION_MAX_AGE=28800

NOTION_API_KEY=

# Confluence (optional; referenced from nao_config.yaml via env())
CONFLUENCE_BASE_URL=
# Cloud: set the base URL, account email and an API token.
CONFLUENCE_EMAIL=
CONFLUENCE_API_TOKEN=
# Data Center/Server: set the base URL and a personal access token.
CONFLUENCE_PAT=
# Data Center/Server: set the base URL and a username/password.
CONFLUENCE_USERNAME=
CONFLUENCE_PASSWORD=

# ClickHouse (optional; use in nao_config.yaml with env() or for connection)
CLICKHOUSE_HOST=localhost
CLICKHOUSE_PORT=8123
CLICKHOUSE_DATABASE=default
CLICKHOUSE_USER=default
CLICKHOUSE_PASSWORD=admin
CLICKHOUSE_SECURE=false

# Langfuse LLM tracing (optional) — all three must be set to enable export.
# The base URL is required on purpose: it makes the trace destination explicit
# so prompts/responses are never sent to a default endpoint unintentionally.
# LANGFUSE_PUBLIC_KEY=pk-lf-...
# LANGFUSE_SECRET_KEY=sk-lf-...
# LANGFUSE_BASE_URL=https://cloud.langfuse.com # or your self-hosted instance

# Tracking (optional)
POSTHOG_KEY=phc_123
POSTHOG_HOST=https://eu.i.posthog.com
POSTHOG_DISABLED=false # (used to opt-out of tracking)

# Beta feature flags
# Set to true to enable the Automations feature (recurring prompt automations).
# BETA_AUTOMATIONS_ENABLED=false
# Set to true to enable the Context Recommendations feature.
# BETA_CONTEXT_RECOMMENDATIONS_ENABLED=false
# Set to false to disable interactive story filters.
# BETA_STORY_FILTERS_ENABLED=true
# Set to true to expose the task tool, letting the agent delegate work to subagents.
# BETA_SUBAGENTS_ENABLED=false