# vault-cortex — remote quickstart (Obsidian Sync)
# Copy to .env and fill in values, then: docker compose up -d

# Required ──────────────────────────────────────────────────

# Bearer token for MCP authentication.
# Generate one: openssl rand -hex 32
MCP_AUTH_TOKEN=

# Public URL that MCP clients use to reach this server.
# Used as the OAuth issuer URL in discovery metadata.
# Examples: https://vault.example.com, http://203.0.113.10:8000
PUBLIC_URL=

# Obsidian Sync auth token. Generate once with:
#   docker run --rm -it --entrypoint get-sync-token \
#     ghcr.io/aliasunder/vault-cortex:remote
OBSIDIAN_AUTH_TOKEN=

# Exact name of your Obsidian vault (case-sensitive).
VAULT_NAME=

# Optional ──────────────────────────────────────────────────

# Only if your vault has end-to-end encryption enabled.
# VAULT_PASSWORD=

# Your IANA timezone — affects daily note resolution and memory timestamps.
# TZ=America/New_York

# Enable or disable the embedding pipeline (default: true).
# When true, notes are chunked and embedded via a local ONNX model
# (bge-small-en-v1.5) for hybrid search — FTS5 keyword + vector semantic
# similarity fused via RRF. First startup is slow (~5min for 700 notes);
# subsequent starts are fast via content-hash caching.
# Set to false to disable model download and use FTS5 search only.
EMBEDDING_ENABLED=true

# Reranking mode for hybrid search results (default: blended).
# "blended" uses a cross-encoder to refine result ordering with
# position-aware score blending (~200ms added latency).
# "none" skips reranking for lower latency.
# Only takes effect when EMBEDDING_ENABLED=true.
RERANK_MODE=blended

# Windows bind-mount mode (default: false).
# Set to true when your vault is on a Windows drive (Docker Desktop).
# Enables polling for the file watcher and rename-based moves across
# the Docker Desktop/WSL2 bridge.
WINDOWS_MODE=false

# Largest file vault_read_file will read, in bytes (default: 52428800 = 50 MiB).
# Reading a larger file returns an error instead of content.
MAX_FILE_BYTES=52428800

# Byte budget for images returned by vault_read_file, in binary bytes before
# base64 encoding (default: 49152 = 48 KiB, sized for Claude Code's response cap).
# Images exceeding the budget are downscaled/recompressed to fit. Raise it for clients
# that accept larger tool responses.
MAX_IMAGE_OUTPUT_BYTES=49152

# Maximum number of PDF pages to render as images when raw: true is set on
# vault_read_file (default: 5). The per-page byte budget is MAX_IMAGE_OUTPUT_BYTES
# divided evenly across the rendered pages. Fewer pages = higher quality each.
MAX_PDF_RENDER_PAGES=5

# Enable or disable the memory layer (default: true).
# Set to false to hide memory tools and skip About Me/ creation.
MEMORY_ENABLED=true
# Enable or disable file tools — vault_read_file and vault_list_files (default: true).
# Set to false when Obsidian Sync has attachment syncing disabled.
FILE_TOOLS_ENABLED=true
# Run the server in read-only mode (default: false).
# Set to true to hide every tool that changes the vault — clients can only
# read and search. The memory folder is not auto-created in this mode.
READONLY_MODE=false
# Hide individual tools by name, comma-separated (default: none hidden).
# Names match the README tools table: https://github.com/aliasunder/vault-cortex#tools
# Subtractive only — it cannot re-enable a tool another setting hides; an
# unknown tool name stops the server at startup so typos surface immediately.
# DISABLED_TOOLS=vault_delete_note,vault_move_note
# Memory folder name in your vault (default: About Me).
MEMORY_DIR=About Me

# Daily notes folder and filename format (default: read from the
# vault's .obsidian/daily-notes.json, synced to the server via SYNC_CONFIGS
# below; falls back to "Daily Notes" and YYYY-MM-DD). Folder is any
# vault-relative path (Journal, Planner/Daily); format takes the same tokens
# as Obsidian's date format setting.
# DAILY_NOTES_FOLDER=Journal
# DAILY_NOTES_FORMAT=YYYY-MM-DD

# Comma-separated folders protected from deletion (default: MEMORY_DIR plus
# the daily notes folder — DAILY_NOTES_FOLDER when set, otherwise "Daily Notes").
# A custom folder set only in daily-notes.json is not auto-protected.
# PROTECTED_PATHS=About Me,Daily Notes

# Comma-separated folders excluded from orphan detection (default: the daily
# notes folder — DAILY_NOTES_FOLDER when set, otherwise "Daily Notes" — plus
# Templates and MEMORY_DIR).
# ORPHAN_EXCLUDE_FOLDERS=Daily Notes,Templates,About Me

# URL shown in OAuth discovery metadata
# (default: https://github.com/aliasunder/vault-cortex).
# SERVICE_DOCUMENTATION_URL=https://github.com/youruser/your-fork

# Host port to expose (default: 8000).
PORT=8000

# Log verbosity: debug | info | warn | error (default: info).
LOG_LEVEL=info

# Directory for persistent log files inside the container (default: /data/logs).
# Set to empty to disable file logging (logs still go to stdout either way).
LOG_DIR=/data/logs

# Days to retain persistent log files before cleanup (default: 30).
LOG_RETENTION_DAYS=30

# User/group IDs for obsidian-sync (default: 1000).
PUID=1000
PGID=1000

# Device name shown in Obsidian Sync settings.
DEVICE_NAME=vault-cortex

# Obsidian Sync conflict resolution: merge | conflict (default: merge).
# 'merge' integrates changes automatically; 'conflict' writes a separate conflict file.
CONFLICT_STRATEGY=merge

# Sync direction: bidirectional | pull-only | push-only (default: bidirectional).
SYNC_MODE=bidirectional

# Obsidian settings categories to sync into the server's .obsidian/ folder
# (default: the two the server reads — daily notes settings and community
# plugin settings such as the Tasks plugin's format; "none" disables).
# A category only syncs after your desktop pushes it: Obsidian Settings →
# Sync → "Vault configuration sync" (per device). Some community plugins
# keep API keys in their settings — server tools never read .obsidian/,
# but synced settings do live on the server volume. Values: app,
# appearance, appearance-data, hotkey, core-plugin, core-plugin-data,
# community-plugin, community-plugin-data — comma-separated.
SYNC_CONFIGS=core-plugin-data,community-plugin-data