# Copy this file to .env and fill in real values. Never commit .env to git.

# Get from console.anthropic.com → API Keys
ANTHROPIC_API_KEY=

# ── Google OAuth2 ─────────────────────────────────────────────────────────────
# Download an OAuth2 *Web Application* client secret from Google Cloud Console:
#   APIs & Services → Credentials → Create Credentials → OAuth client ID → Web application
# Add your Cloudflare Tunnel callback URL as an authorised redirect URI:
#   https://oauth.yourdomain.com/oauth/callback
# Then download the JSON and save it as credentials.json in the project root.
# It is mounted read-only by Docker and gitignored — never commit it.
GOOGLE_CLIENT_SECRETS_FILE=credentials.json

# Full public HTTPS URL that Google redirects to after the user authorises.
# Must exactly match the URI registered in Google Cloud Console (above).
# With Cloudflare Tunnel this will be your tunnel's public hostname:
#   https://oauth.yourdomain.com/oauth/callback
# For local testing without Cloudflare, use ngrok or set it to localhost
# (Google only allows localhost for http, not arbitrary IPs).
OAUTH_REDIRECT_URI=

# Port the OAuth callback server (uvicorn/FastAPI) listens on inside the container.
# cloudflared routes traffic from your public hostname to http://agent:<this port>.
# Must match the service URL configured in the Cloudflare Tunnel dashboard.
OAUTH_CALLBACK_PORT=8080

# ── Cloudflare Tunnel ──────────────────────────────────────────────────────────
# Provides a persistent HTTPS URL for the OAuth callback without opening firewall ports.
# Setup steps:
#   1. Create a free Cloudflare account at dash.cloudflare.com.
#   2. Add a domain (or use a free *.pages.dev subdomain — no purchase required).
#   3. Zero Trust → Networks → Tunnels → Create a tunnel → Cloudflared.
#   4. Copy the token shown during "Install connector" and paste it below.
#   5. In the tunnel dashboard → Public Hostnames → Add a hostname:
#        Subdomain : oauth         (or any prefix)
#        Domain    : yourdomain.com
#        Service   : http://agent:8080
#   6. Your callback URL is now https://oauth.yourdomain.com/oauth/callback
#      — use it for both OAUTH_REDIRECT_URI above and Google Cloud Console.
CLOUDFLARE_TUNNEL_TOKEN=

# ── Google Docs ────────────────────────────────────────────────────────────────
# Optional: Google Doc ID for the diary shortcut (append_diary tool).
# Open the doc in your browser; the ID is the long string in the URL:
#   docs.google.com/document/d/<THIS_PART>/edit
# Leave blank to disable — users can use append_google_doc with a picked doc instead.
GOOGLE_DIARY_DOC_ID=

# ── Discord ───────────────────────────────────────────────────────────────────
# Get your bot token from Discord Developer Portal → Your App → Bot → Token.
DISCORD_BOT_TOKEN=

# Optional allowlist — comma-separated Discord user IDs that may use the bot.
# To get a user ID: enable Developer Mode in Discord settings, then right-click
# a user → Copy User ID.
# Leave blank to allow anyone who DMs the bot.
ALLOWED_DISCORD_USER_IDS=