# OwnPilot Configuration
# Copy this file to .env and fill in your values
#
# API keys (OpenAI, Anthropic, etc.) and channel tokens (Telegram)
# are NOT configured here — use the Config Center UI after setup.

# ===========================================
# Server
# ===========================================
PORT=8080
UI_PORT=8199
HOST=127.0.0.1
NODE_ENV=development

# Additional CORS origins (auto-includes http://localhost:UI_PORT)
# CORS_ORIGINS=https://my-domain.com

# Max request body size in bytes (default: 1MB)
# BODY_SIZE_LIMIT=1048576

# ===========================================
# Database (PostgreSQL)
# ===========================================
# These defaults match docker-compose.yml so both paths work out of the box.
#
# Option 1: Full connection URL (overrides individual settings)
# DATABASE_URL=postgresql://ownpilot:ownpilot_secret@localhost:25432/ownpilot

# Option 2: Individual settings
# For "From Source" dev: 127.0.0.1 + exposed port 25432
# For Docker: docker-compose.yml hardcodes host=postgres, port=5432 internally
# Note: use 127.0.0.1 (not "localhost") — on Windows localhost may resolve to ::1
# while Docker publishes the port on IPv4 only, causing silent connection failures.
POSTGRES_HOST=127.0.0.1
POSTGRES_PORT=25432
POSTGRES_USER=ownpilot
POSTGRES_PASSWORD=ownpilot_secret
POSTGRES_DB=ownpilot
# POSTGRES_POOL_SIZE=10
# DB_VERBOSE=false

# ===========================================
# Authentication (DB is primary, env is fallback)
# ===========================================
# Default: api-key. Set AUTH_TYPE=none only for local development.
# AUTH_TYPE=api-key
# API_KEYS=your-secret-key-here
# JWT_SECRET=

# ===========================================
# Rate Limiting (DB is primary, env is fallback)
# ===========================================
# RATE_LIMIT_DISABLED=false
# RATE_LIMIT_WINDOW_MS=60000
# RATE_LIMIT_MAX=500

# ===========================================
# Security & Encryption
# ===========================================
# Required in production for OAuth token encryption (32 bytes hex)
# ENCRYPTION_KEY=

# Data-at-rest encryption key for stored service configs (Config Center
# API keys etc.). Any string works — the AES key is derived via SHA-256.
# If unset, a key is auto-generated at <data>/credentials/data-encryption.key
# on first run. Losing the key (or changing this value) makes existing
# encrypted configs unreadable — they must be re-entered.
# OWNPILOT_ENCRYPTION_KEY=

# Escape hatch: write service configs as plaintext (reads still decrypt)
# OWNPILOT_DISABLE_DATA_ENCRYPTION=0

# Admin API key for debug endpoints (production only)
# ADMIN_API_KEY=

# ===========================================
# Data Storage
# ===========================================
# Override the platform-specific data directory
# Default: ~/.local/share/ownpilot (Linux), ~/Library/Application Support/ownpilot (macOS),
#          %LOCALAPPDATA%/ownpilot (Windows)
# OWNPILOT_DATA_DIR=

# ===========================================
# Logging
# ===========================================
LOG_LEVEL=info

# ===========================================
# Debug (development only)
# ===========================================
# DEBUG_AI_REQUESTS=false
# DEBUG_AGENT=false
# DEBUG_LLM=false
# DEBUG_RAW_RESPONSE=false

# ===========================================
# Sandbox (advanced)
# ===========================================
# ALLOW_HOME_DIR_ACCESS=false
# DOCKER_SANDBOX_RELAXED_SECURITY=false
# MEMORY_SALT=your-random-salt-here