# NovaRoute environment contract
# This file reflects actual runtime usage in the current codebase.

# Required
JWT_SECRET=change-me-to-a-long-random-secret
INITIAL_PASSWORD=change-me
DATA_DIR=/var/lib/novaroute

# Recommended runtime variables
# Isolated default ports to avoid conflict with OmniRoute (20128/20127).
PORT=20126
NODE_ENV=production

# Recommended security and ops variables
API_KEY_SECRET=endpoint-proxy-api-key-secret
MACHINE_ID_SALT=endpoint-proxy-salt
ENABLE_REQUEST_LOGS=false
OBSERVABILITY_ENABLED=true
# Cookie security follows the actual request protocol automatically:
# HTTP -> regular cookie, HTTPS (behind proxy/Caddy) -> Secure cookie.
# Set to "false" to force-disable Secure even behind a TLS proxy.
AUTH_COOKIE_SECURE=
# Emergency break-glass password: when set, it always grants dashboard access
# regardless of the stored password. Leave empty in normal operation.
ADMIN_MASTER_PASSWORD=
# The gateway (/v1) requires an API key by default. Set to "false" only for an
# instance you intend to leave open; even then anonymous calls are accepted from
# loopback/private networks only, unless NR_ALLOW_ANONYMOUS_REMOTE_API=1.
REQUIRE_API_KEY=true
# NR_ALLOW_ANONYMOUS_REMOTE_API=1
# Bearer token for GET /api/metrics (Prometheus exposition). Without it the
# endpoint still works, but only for a dashboard session or a manage-scoped key.
# METRICS_TOKEN=

# OpenTelemetry tracing. Off unless an endpoint is set; no SDK is required,
# spans are exported as OTLP/HTTP JSON.
# OTEL_EXPORTER_OTLP_ENDPOINT=http://collector:4318
# OTEL_EXPORTER_OTLP_HEADERS=x-api-key=abc,team=core
# OTEL_SERVICE_NAME=novaroute

# Cloud sync variables
# BASE_URL must point to this running instance so internal sync jobs can call
# /api/sync/cloud.
#
# CLOUD_URL is the remote your settings sync TO. It ships empty on purpose: this
# file used to default it to a domain IRNova does not own, and copying this file
# to .env then enabling cloud sync would have pushed your settings there. Leave
# it blank unless you are pointing it at a host you control. Cloud sync also
# stays off until you enable it in the dashboard.
# Server-side preferred variables:
BASE_URL=http://localhost:20126
CLOUD_URL=
# Backward-compatible/public variables:
NEXT_PUBLIC_BASE_URL=http://localhost:20126
NEXT_PUBLIC_CLOUD_URL=

# Optional outbound proxy variables for upstream provider calls
# Lowercase variants are also supported: http_proxy, https_proxy, all_proxy, no_proxy
# HTTP_PROXY=http://127.0.0.1:7890
# HTTPS_PROXY=http://127.0.0.1:7890
# ALL_PROXY=socks5://127.0.0.1:7890
# NO_PROXY=localhost,127.0.0.1

# Optional SearXNG endpoint for the built-in unauthenticated web-search provider.
# SEARXNG_URL=http://searxng:8080/search

# Currently unused by application runtime (kept as reference)
# INSTANCE_NAME=NovaRoute