# Open Brain — example environment file
# Copy to `.env` (next to docker-compose.yml) and fill in real values.
# The real .env holds secrets: chmod 600 it and NEVER commit it (.gitignore
# already excludes it). Every value below is a placeholder — replace it.

# ─── Postgres ────────────────────────────────────────────────────
POSTGRES_USER=openbrain
POSTGRES_PASSWORD=change-me-long-random-string
POSTGRES_DB=openbrain
# Where docker-compose stores the Postgres data dir on the host.
POSTGRES_DATA_DIR=./data/postgres
# Connection target for the librarian / API (defaults shown).
PG_HOST=127.0.0.1
PG_PORT=5432

# ─── MinIO / S3 (object store for artifact bytes) ────────────────
# Root admin creds. For day-to-day access, mint scoped IAM users.
MINIO_ROOT_USER=openbrain-root
MINIO_ROOT_PASSWORD=change-me-long-random-string
MINIO_DATA_DIR=./data/minio
# S3 endpoint. Point this at the compose MinIO, or an external one.
MINIO_ENDPOINT=http://127.0.0.1:9000
MINIO_REGION=us-east-1
# Optional: load MinIO creds from a separate chmod-600 file instead of
# this .env (the file uses the same KEY=value format).
# MINIO_CREDS_FILE=/path/to/.minio-creds

# ─── Buckets ─────────────────────────────────────────────────────
# All five buckets are named <prefix><suffix>. Change the prefix to
# namespace your deployment. MUST match scripts/bucket-init.sh.
OPENBRAIN_BUCKET_PREFIX=obrain-

# ─── Document tree (the "wiki") ──────────────────────────────────
# Optional — only the wiki-reindex command and wiki endpoints use these.
OPENBRAIN_VAULT=./vault
OPENBRAIN_WIKI_DIR=./vault/wiki
# Incremental reindex checkpoint location.
# OPENBRAIN_WIKI_CHECKPOINT=~/.local/openbrain/wiki-reindex-state.json

# ─── Optional "workspace" layer (live now-file + session notes) ──
# Point these at your own scratch/handoff files. Unset → endpoints empty.
# OPENBRAIN_WORKSPACE_NOW=./vault/NOW.md
# OPENBRAIN_SESSIONS_DIR=./vault/sessions

# ─── Embedding provider (pluggable) ──────────────────────────────
# Default impl is Google Gemini embeddings. Set to "none" to disable
# embeddings entirely (register/recall work without semantic search).
OPENBRAIN_EMBED_PROVIDER=gemini
OPENBRAIN_EMBED_MODEL=gemini-embedding-001
OPENBRAIN_EMBED_DIMS=1024
# API key for the embedding provider (or set GEMINI_KEY_FILE to a JSON
# file with a {"GEMINI_API_KEY": "..."} field).
GEMINI_API_KEY=your-embedding-provider-key-here
# GEMINI_KEY_FILE=/path/to/key.json

# ─── API server ──────────────────────────────────────────────────
OPENBRAIN_API_HOST=0.0.0.0
OPENBRAIN_API_PORT=8088
# Bearer tokens → caller identity (JSON). Roles: admin | inbox | reader.
# With no token, callers get reader access — put a real perimeter in front
# if you bind to a public interface.
OPENBRAIN_API_TOKENS={"replace-with-a-long-random-token":{"name":"admin","roles":["admin"]},"another-long-random-token":{"name":"inbox-writer","roles":["inbox"]}}