# ==============================================================================
# NyankoFace environment configuration
# Copy this file to `.env` and adjust values before running `docker compose up -d`
# ==============================================================================

# --- Admin bootstrap (used by the `seed` service to create the first Forgejo admin) ---
NYANKOFACE_ADMIN_USER=nyankoface-admin
NYANKOFACE_ADMIN_PASSWORD=nyankoface1234
ZAI_AGENT_CONFIG=./maintenance-agent/zai.example.env
ZAI_ANTHROPIC_BASE_URL=https://api.z.ai/api/anthropic
MAINTENANCE_MODEL=glm-5.2
MAINTENANCE_ALLOWED_OWNER=nyankoface
MAINTENANCE_GOAL_TIMEOUT_SECONDS=3600
MAINTENANCE_MAX_WORKERS=2
MAINTENANCE_AUTO_MERGE=true
# Repositories with the `humanless` topic enter autonomous development and
# recurring maintenance. Add `humanless-ui` when browser evidence is required.
MAINTENANCE_HUMANLESS_ENABLED=false
MAINTENANCE_HUMANLESS_TOPIC=humanless
MAINTENANCE_HUMANLESS_SCAN_SECONDS=300
MAINTENANCE_HUMANLESS_INTERVAL_MINUTES=1440
MAINTENANCE_HUMANLESS_RETRY_MINUTES=60
MAINTENANCE_HUMANLESS_MAX_ATTEMPTS=3
MAINTENANCE_HUMANLESS_STALE_SECONDS=900
MAINTENANCE_AUTO_ISSUE_ENABLED=true
MAINTENANCE_AUTO_ISSUE_TOPIC=humanless-issues
MAINTENANCE_AUTOMATIC_RETRY_MAX_ATTEMPTS=3
# Classify new Issues and pull requests, then apply only allowlisted labels.
# Set dry-run to true when tuning the allowlist or confidence threshold.
MAINTENANCE_AUTO_LABEL_ENABLED=true
MAINTENANCE_AUTO_LABEL_DRY_RUN=false
MAINTENANCE_AUTO_LABEL_ALLOWED=bug,enhancement,documentation,question,good first issue
MAINTENANCE_AUTO_LABEL_CONFIDENCE=0.85
NYANKOFACE_ADMIN_EMAIL=admin@example.com

# --- Forgejo behavior ---
# Display name used by both the portal and Forgejo. Defaults to NyankoFace when
# unset or blank.
APP_NAME=NyankoFace

# Closed self-registration is the secure default. Admins invite enterprise users.
DISABLE_REGISTRATION=true

# Private repositories remain inside Forgejo's native ACL by default. Do not
# enable private Spaces unless the runner is protected by an isolated network.
NYANKOFACE_ALLOW_PRIVATE_SPACES=false

# --- Public URL of the whole platform (gateway entrypoint) ---
NYANKOFACE_PORT=8090
NYANKOFACE_HTTPS_PORT=8443
# For access from another LAN device, replace localhost with this PC's LAN IP.
# HTTP on port 8090 is useful for mobile webviews that reject local certificates.
PUBLIC_BASE_URL=https://localhost:8443
# Optional exact Forgejo URL for split public/internal routing.
# Keep unset for normal /git publishing so Compose derives PUBLIC_BASE_URL/git/.
# If set explicitly, the URL must be reachable by both browsers and Forgejo
# Actions job containers for artifact upload/download.
# FORGEJO_ROOT_URL=https://nyankoface.example/git/

# --- PostgreSQL (Forgejo, metrics, and maintenance jobs use separate databases) ---
POSTGRES_USER=nyankoface
POSTGRES_PASSWORD=change-this-postgres-password
NYANKOFACE_PIPELINE_DB_SCHEMA=nyankoface_pipeline

# --- Frontend metadata cache (5 minutes by default) ---
README_CACHE_TTL_SECONDS=300
# Public knowledge catalog cache. Private repositories never enter this cache.
KNOWLEDGE_CACHE_TTL_SECONDS=60
# Emit structured server phase timings (API/DB/Forgejo/Markdown) when set to 1.
NYANKOFACE_PERFORMANCE_LOG=0

# --- Space capacity (least-recently-used Space is stopped before the next launch) ---
MAX_RUNNING_SPACES=24
# Zero keeps CPU Spaces running until capacity management or a manual stop.
IDLE_TIMEOUT_MINUTES=0
NYANKOFACE_SPACE_DEPLOY_TIMEOUT_SECONDS=540
# Per-Forgejo-token limit for the cookie-free Space Variables/Secrets API.
NYANKOFACE_SPACE_API_RATE_LIMIT_PER_MINUTE=60
NYANKOFACE_PIPELINE_API_RATE_LIMIT_PER_MINUTE=60
NYANKOFACE_PIPELINE_RECONCILE_INTERVAL_SECONDS=60
NYANKOFACE_ACTIONS_RUNNER_CAPACITY=2
NYANKOFACE_ACTIONS_JOB_CPUS=2
NYANKOFACE_ACTIONS_JOB_MEMORY=4g
NYANKOFACE_ACTIONS_JOB_PIDS_LIMIT=512
# Timeout for importing or building repositories from remote Git sources.
HF_CLONE_TIMEOUT_SECONDS=300
# Remote GPU workers stay disabled until a worker is enrolled and reachable
# on the trusted LAN. Repositories need both `space` and `gpu` topics.
NYANKOFACE_GPU_WORKERS_ENABLED=false
NYANKOFACE_GPU_WORKER_LEASE_SECONDS=90
NYANKOFACE_GPU_WORKER_STALE_SECONDS=120
# Optional official MCP Server (`docker compose --profile mcp ...`). Copy the
# example registry outside Git and keep plaintext tokens in client secret stores.
# Registry directory is mounted read-only so atomic host-side rotation/revocation
# is visible to the next MCP request without recreating the container.
NYANKOFACE_MCP_STATE_DIR=./secrets/nyankoface-mcp
# Source this value before running the root-owned offline token operator. It
# matches the unprivileged GID in nyankoface-mcp/Dockerfile.
NYANKOFACE_MCP_REGISTRY_READER_GID=10001
NYANKOFACE_MCP_FORGEJO_USER_TOKEN_FILE=./secrets/nyankoface-mcp-forgejo-user-token
NYANKOFACE_MCP_JSON_RESPONSE=false
NYANKOFACE_MCP_ALLOWED_ORIGINS=
NYANKOFACE_MCP_CONFIRMATION_TTL_SECONDS=300
NYANKOFACE_MCP_IDEMPOTENCY_TTL_SECONDS=86400
NYANKOFACE_MCP_AUDIT_RETENTION_SECONDS=7776000