# captatum hosted-flavor environment template.
# Copy to .env.local (gitignored) for local smoke, or inject into the ECS task.
# NEVER commit real values.

NODE_ENV=production
CAPTATUM_FLAVOR=hosted
HOST=127.0.0.1
PORT=3000

# OAuth (hosted) — REQUIRED for the hosted flavor (server fail-fast aborts without these)
OAUTH_ISSUER=
OAUTH_RESOURCE=
OAUTH_SIGNING_PRIVATE_JWK=
OAUTH_CONSENT_SIGNING_SECRET=
OAUTH_SIGNING_KEY_ID=
# Exact connector origins (scheme://host[:port]) or exact URLs. NEVER "*" (rejected).
OAUTH_REDIRECT_ALLOWLIST=

# Cloudflare Access (hosted) — REQUIRED for the hosted flavor. The OAuth consent
# login sits behind a Cloudflare Access app (path /oauth/authorize*) whose identity
# policy holds the email allowlist; the gateway verifies the Access JWT. A hosted
# boot FAILS CLOSED without all four.
CF_ACCESS_ENABLED=true
CF_ACCESS_AUDIENCE=
CF_ACCESS_ISSUER=https://<team>.cloudflareaccess.com
CF_ACCESS_CERTS_URL=https://<team>.cloudflareaccess.com/cdn-cgi/access/certs

# MCP inbound Host/Origin DNS-rebinding protection
MCP_ALLOWED_HOSTS=
MCP_ALLOWED_ORIGINS=
# Reverse-proxy socket peers allowed to supply X-Forwarded-For for OAuth rate
# limits. IP/CIDR allowlist only; required for hosted boot. Broad CIDRs are
# rejected (minimum /24 IPv4, /64 IPv6). Docker Compose overrides this with its
# pinned host-bridge peer; other deployments must set the exact observed peer.
CAPTATUM_TRUSTED_PROXY_CIDRS=
# Generate 32 random bytes as unpadded base64url. Configure Cloudflare to SET
# (overwrite) X-Captatum-Proxy-Auth to this value on the Captatum hostname.
# Required at hosted boot; never expose it to clients, logs, or browser sidecars.
CAPTATUM_PROXY_AUTH_SECRET=

# OAuth-state + stored-client stores (hosted). DEFAULT = two SQLite files, no
# server: CAPTATUM_SQLITE_PATH for mcp-sso state and the derived `<path>.clients`
# companion for DCR/machine clients. The configured path's parent is the private
# state directory: it must be a real directory at mode 0700; both files are 0600.
# One-click deploys (Railway/EC2/Mac Mini) need NO database. v0.20.x is
# SQLite-only and supports exactly one gateway replica.
CAPTATUM_SQLITE_PATH=./data/captatum.sqlite

# Transform (optional). Free models work without a key but rate-limit faster.
OPENROUTER_API_KEY=
# OPENROUTER_BASE_URL=https://openrouter.ai/api/v1
# OLLAMA_BASE_URL=
# OLLAMA_MODEL=llama3.1