# ── LLM ──────────────────────────────────────────────────────────────────────
LLM_API_KEY=sk-or-v1-...
OPENROUTER_API_KEY=sk-or-v1-...

# ── Supabase ──────────────────────────────────────────────────────────────────
SUPABASE_URL=https://your-project.supabase.co
SUPABASE_ANON_KEY=eyJ...
SUPABASE_SERVICE_ROLE_KEY=eyJ...

# ── Qdrant ────────────────────────────────────────────────────────────────────
# REQUIRED (app refuses to start) as soon as WEB_CONCURRENCY>1 or
# MULTI_TENANT=true: the embedded local Qdrant fallback used when this is
# unset does not support multiple workers/replicas and will corrupt data.
QDRANT_URL=http://localhost:6333
QDRANT_API_KEY=

# ── Redis ─────────────────────────────────────────────────────────────────────
REDIS_URL=redis://localhost:6379
# How often (seconds) each worker re-checks Redis for a fresher BM25 index
# before falling back to its in-memory copy. Lower = fresher search results
# across workers, more Redis calls. Default 30.
BM25_REDIS_CHECK_INTERVAL=30

# ── Monitoring ────────────────────────────────────────────────────────────────
# CRITICAL: Generate a strong key: python -c "import secrets; print(secrets.token_urlsafe(32))"
MONITORING_KEY=CHANGE_ME_use_secrets_token_urlsafe_32

# ── App ───────────────────────────────────────────────────────────────────────
APP_URL=http://localhost:8000
ENV=development
APP_ENV=development
PORT=8000
# Number of gunicorn worker processes (see scripts/start.sh). >1 requires
# QDRANT_URL to be set (see Qdrant section above).
WEB_CONCURRENCY=2
# Set to true for real B2B deployments (multiple tenants, likely multiple
# replicas over time). Also gated by scripts/start.sh's MCP_TENANT_ID check.
# Leave unset/false only for single-tenant local dev.
MULTI_TENANT=false

# ── Auth ──────────────────────────────────────────────────────────────────────
ALLOW_GUEST_MODE=false
ALLOW_GUEST_MODE_IN_PROD=false
ALLOW_LOCAL_GUEST_HEADER=true

# ── Enterprise auth ───────────────────────────────────────────────────────────
# Lock this instance to one email domain (e.g. acme.com). Leave empty to allow all.
ALLOWED_EMAIL_DOMAIN=
# Comma-separated emails that have admin access to /api/admin/users
ADMIN_EMAILS=
# Frontend: show "Sign up" toggle on login page
VITE_ALLOW_SELF_REGISTER=false
# Frontend: show Microsoft OAuth button (configure Azure provider in Supabase dashboard)
VITE_MICROSOFT_AUTH_ENABLED=false

# ── CORS ─────────────────────────────────────────────────────────────────────
ALLOWED_ORIGINS=http://localhost:8080,http://127.0.0.1:8080

# ── Langfuse (optionnel) ──────────────────────────────────────────────────────
LANGFUSE_PUBLIC_KEY=
LANGFUSE_SECRET_KEY=
LANGFUSE_HOST=https://cloud.langfuse.com

# ── Sentry (optionnel) ────────────────────────────────────────────────────────
SENTRY_DSN=

# ── Lakera Guard (optionnel) ──────────────────────────────────────────────────
LAKERA_API_KEY=