# Concentus — optional local overrides
#
# THE DESKTOP APP NEEDS NONE OF THIS. Install it and run it; there is nothing to configure.
# Everything that used to live here and had to be set — the database URL and password, the
# encryption key, the CORS origins, the container's port — is either gone or worked out by the
# app itself:
#
#   * the database is embedded and starts with the app, in your app-data folder
#   * the credential encryption key is generated on first launch into your OS keyring
#   * the UI is served by the backend, so there is no second origin to allow
#
# This file is for the other case: running `apps/backend` by hand during development, where the
# `desktop` profile is not active and those defaults do not apply. Copy it to `.env` in the repo
# root — it is gitignored — and set only the lines you actually need. A real environment variable
# always wins over this file.
#
# Every setting the backend understands is documented, with its reasoning, in
# apps/backend/src/main/resources/application.properties. This is the short list of the ones
# worth overriding.

# --- Running the backend by hand ------------------------------------------------------------
# Without the `desktop` profile there is no embedded database, so point these at a PostgreSQL you
# started yourself. Unreachable is survivable — the stores log and report themselves unavailable
# rather than failing startup — but stored credentials and mail triggers will not work.
# PERSIST_DB_URL=jdbc:postgresql://localhost:5432/concentus
# PERSIST_DB_USER=concentus
# PERSIST_DB_PASSWORD=

# Key that seals stored credentials (mailbox passwords, API tokens) and secret settings at rest.
# Optional: without it they are stored as typed and the app says so. The desktop app generates
# and keeps its own in the OS keyring. 32 random bytes, base64:  openssl rand -base64 32
# Changing or losing it does not break anything: credentials sealed under the old key show as
# LOCKED and are fixed by entering each value again. Installations sharing a database must share
# the key.
# CONCENTUS_SECRET_KEY=

# Where flows, agents and the database directory live. Defaults to ./data beside the backend.
# APP_DATA_DIR=./data

# --- Execution ------------------------------------------------------------------------------
# auto (default): an API key means cloud, otherwise the local claude CLI on your subscription.
# ANTHROPIC_AUTH_MODE=auto
# ANTHROPIC_API_KEY=

# Only needed if the claude CLI is somewhere unusual. The desktop app resolves this itself,
# through a login shell, because a desktop launcher does not inherit your shell's PATH.
# CLAUDE_COMMAND=

# Directories agents may be pointed at as context folders, comma-separated. The desktop app
# defaults this to your home directory; running by hand it is empty, which rejects every folder
# until you opt in.
# LOCAL_CONTEXT_ROOTS=

# --- Self-hosted models ---------------------------------------------------------------------
# Any server speaking OpenAI's /chat/completions — Ollama, llama.cpp, vLLM, LM Studio.
# Mind the /v1 suffix; Ollama serves it at :11434/v1, not at the root.
# LOCAL_MODEL_BASE_URL=http://localhost:11434/v1
# LOCAL_MODEL_API_KEY=

# --- Mail-triggered flows (Microsoft 365) ----------------------------------------------------
# The Entra app registration used to sign mailboxes in. Neither value is a secret.
# MAIL_MICROSOFT_TENANT_ID=
# MAIL_MICROSOFT_CLIENT_ID=