# OminiConnect Portal (the binary loads this file from the **repo root** as `../../.env`)
PORTAL_BASE_URL=http://localhost:9000
# When using Nango Connect + a public tunnel, set Nango’s `NANGO_SERVER_URL` (in third_party/nango/.env) to this
# same **origin** (e.g. https://mymac.gpt4people.online) so OAuth uses `…/oauth/callback`. Register that URL in
# LinkedIn (not `/oauth/<connector-id>/callback`).
# Optional listen port (default 9000). `make dev` refuses to start if this port is already in use.
# PORTAL_LISTEN_PORT=9000

# OminiConnect portal database (sqlx Any: SQLite or Postgres).
# Leave DATABASE_URL unset to use SQLite at `omini_connect/portal/portal.db` (stable path regardless of cwd).
# When Nango already uses local Postgres, use a **second database** on the same server (not the same DB as Nango).
#   createdb -h 127.0.0.1 -U nango omini_connect_portal
#   # or: psql -U postgres -c "CREATE DATABASE omini_connect_portal OWNER nango;"
# DATABASE_URL=postgres://nango:nango@127.0.0.1:5432/omini_connect_portal
#
# If you still have an older Postgres database named `omni_portal`, either keep using it in
# DATABASE_URL unchanged, or rename it (disconnect all clients first), e.g.:
#   psql -U postgres -c 'ALTER DATABASE omni_portal RENAME TO omini_connect_portal;'

# -----------------------------------------------------------------------------
# Nango (self-hosted, Option B) — OminiConnect talks to Nango over HTTP
# -----------------------------------------------------------------------------
# NANGO_BASE_URL — Nango **API** base URL (same as SERVER_PORT in Nango .env).
#   Native dev (no Docker): http://localhost:3003
NANGO_BASE_URL=http://localhost:3003
#
# NANGO_BROWSER_API_URL — optional public **origin** for Nango Connect UI (`apiURL` query param).
#   Use when only PORTAL_BASE_URL is reachable from the internet (single tunnel to port 9000).
#   Set to the same origin as PORTAL_BASE_URL (no path), e.g. NANGO_BROWSER_API_URL=https://your-host.example
#   The portal reverse-proxies `/connect/*`, `/integrations`, `/providers/*`, `/oauth/connect/*`,
#   `GET /oauth/callback`, and `/__omini/nango-hq/*` (legacy) → `NANGO_BASE_URL`. A trailing `/__omini/nango-hq`
#   suffix is stripped automatically.
#   When `apiURL` is the portal origin and Nango is on a different origin, the portal appends
#   `websocketsPath=wss://<portal>/_nango_auth_ws` (or `ws://...` for HTTP) so the browser uses
#   the portal's WebSocket bridge instead of trying to reach local Nango directly.
#   Override only if you expose Nango's WebSocket endpoint yourself, e.g.:
#     NANGO_BROWSER_WEBSOCKET_URL=wss://your-host.example/_nango_auth_ws
# NANGO_BROWSER_WEBSOCKET_URL=
#   Leave unset for the automatic portal bridge when needed; direct Nango WebSocket is used only when
#   the browser API origin and Nango origin are equivalent (e.g. both localhost).
#   The SPA sends `connect_api_base` = `window.location.origin` so local `http://localhost:9000` works
#   even when this points at a public URL for production.
# NANGO_BROWSER_API_URL=
#
# NANGO_SECRET_KEY — Nango **environment** API secret (Bearer): one value for the whole portal process,
#   not one key per end-user OAuth connection. Nango issues connection_id per link; the portal uses this
#   secret only to call Nango’s HTTP API (sessions, list connections, proxy, etc.).
#   There is no fixed “magic number” shared by all installs — Nango stores a random UUID per environment.
#   **Without the Nango UI:** use ./scripts/sync_nango_secret_to_omini_env.sh (reads Postgres using
#   third_party/nango/.env + NANGO_ENCRYPTION_KEY; seeds a dev account if the DB has no environments).
#   **CI / Kubernetes:** same script with `--print` writes only the secret to stdout, e.g.
#     kubectl create secret generic omini-nango --from-literal=NANGO_SECRET_KEY="$(./scripts/sync_nango_secret_to_omini_env.sh --print)"
#   (run from a Job/init step that can reach Nango’s Postgres and has the Nango .env or equivalent env vars).
#   Manual: Nango UI → Environment → API keys (not LinkedIn/provider client secrets).
#
# Two OminiConnect → two Nango URLs: you need two (NANGO_BASE_URL, NANGO_SECRET_KEY) pairs (one identity per Nango).
#   To simplify ops: run **one** Nango and use **separate Nango environments** (each has its own API key) so every
#   OminiConnect uses the same base URL but a different secret per stage/tenant; or drive both pairs from IaC
#   (Helm values, Terraform) so nothing is hand-pasted per replica.
#
# Kubernetes (many different keys): the portal only reads env vars — configure **one Secret (or ref) per
#   Deployment/Helm release** (e.g. `envFrom.secretRef` or `valueFrom.secretKeyRef`). “Automatic” sync is
#   usually **External Secrets Operator** (pull from AWS Secrets Manager, GCP SM, Vault) or **Sealed Secrets /
#   SOPS** in GitOps — not a feature inside this binary. Replicas of the **same** deployment share one Secret.
#
# -----------------------------------------------------------------------------
# How to run OminiConnect + Nango together (no Docker)
# -----------------------------------------------------------------------------
# 1) Install Node 22+, Rust, PostgreSQL locally. Create **two** databases (same instance is fine), e.g.:
#      createuser nango && psql -U postgres -c "ALTER USER nango WITH PASSWORD 'nango';"
#      createdb -O nango nango
#      createdb -O nango omini_connect_portal
#    Nango uses NANGO_DATABASE_URL in third_party/nango/.env (script defaults to .../nango).
#    OminiConnect uses DATABASE_URL above → point at .../omini_connect_portal when you want Postgres for the portal.
#    Or set before running the script:  export NANGO_DATABASE_URL='postgresql://.../nango'
#
# 2) Repo root:
#      cp .env.example .env
#      # edit DATABASE_URL if using Postgres; set NANGO_* after first Nango UI login
#      make dev
#    First run does `npm ci` + `npm run ts-build` under third_party/nango (slow once).
#
# 3) NANGO_SECRET_KEY: `make dev` auto-writes it from the Nango DB when empty, or run `./scripts/sync_nango_secret_to_omini_env.sh`.
#    Manual path: Nango UI → Environment → API keys, then paste into .env and restart if needed.
#
# Optional — Nango via Docker instead:  make dev-nango-docker
#
NANGO_SECRET_KEY=

# -----------------------------------------------------------------------------
# Nango vendored mode: trust OminiConnect as internal caller
# -----------------------------------------------------------------------------
# Single-source config: `third_party/nango/.env` is linked to this repo-root `.env`.
# Put Nango runtime vars here as well (used by `npm run dev:watch:web` in third_party/nango):
#   NANGO_AUTH_MODE=external_trust
#   OMINICONNECT_INTERNAL_KEY=<same-value-as-below>
#   NANGO_ENCRYPTION_KEY=<required by Nango; random 32-byte base64>
#   NANGO_DATABASE_URL=postgresql://nango:nango@127.0.0.1:5432/nango
#   RECORDS_DATABASE_URL=postgresql://nango:nango@127.0.0.1:5432/nango
#
#   If Nango logs show "Unable to acquire a connection" (Knex) or periodic `failed_to_update_otlp_routes`:
#   - Use a direct PostgreSQL URL for Nango (not `pool_mode=transaction` poolers — see Nango self-host docs).
#   - Tune the Knex pool (upstream `.env.example` names; set in this same `.env` / `third_party/nango/.env`):
#       NANGO_DB_POOL_MIN=0
#       NANGO_DB_POOL_MAX=30
#     Raise `max_connections` in PostgreSQL if the portal + Nango + other tools share one server.
#   - Ensure Postgres is reachable (`pg_isready`) and not hitting connection limits.
#
#   SERVER_PORT=3003
#   # Public origin Nango uses for OAuth callbacks. With a tunnel, this must be the tunnel origin
#   # so providers see `https://your-host.example/oauth/callback` (not localhost).
#   NANGO_SERVER_URL=https://your-host.example
#   NANGO_PUBLIC_SERVER_URL=https://your-host.example
#   NANGO_PUBLIC_CONNECT_URL=http://localhost:3009
#   CONNECT_UI_PORT=3009
#   FLAG_SERVE_CONNECT_UI=true
#   NANGO_DEV_SKIP_EMAIL_VERIFICATION=true
#   # For Google managed-auth return URL, point public server URL to OminiConnect portal:
#   # NANGO_PUBLIC_SERVER_URL=http://localhost:9000
#   # Enable managed auth in Nango + WorkOS credentials:
#   # FLAG_MANAGED_AUTH_ENABLED=true
#   # WORKOS_API_KEY=...
#   # WORKOS_CLIENT_ID=...
#
# Optional headers sent by OminiConnect to vendored Nango:
# - NANGO_OMINICONNECT_INTERNAL_KEY: shared secret forwarded as `x-omini-internal-key`
# - NANGO_ENVIRONMENT_ID: Nango environment id forwarded as `x-nango-environment-id`
#
# NANGO_OMINICONNECT_INTERNAL_KEY=change-me
# NANGO_ENVIRONMENT_ID=1

# OminiConnect auth is Nango-backed in this setup:
# - POST /auth/signup -> Nango /api/v1/account/signup + local session mirror
# - POST /auth/login  -> Nango /api/v1/account/signin + local session mirror
#
# Cookie normalization for same-domain module deployment:
# NANGO_BRIDGE_COOKIE_PATH=/
# NANGO_BRIDGE_COOKIE_SAMESITE=Lax
# NANGO_BRIDGE_COOKIE_SECURE=true
# Optional explicit cookie domain (blank means host-only):
# NANGO_BRIDGE_COOKIE_DOMAIN=