# Generate independent random values; use URL-safe characters for the database password.
ASTRA_API_TOKEN=
ASTRA_INTERNAL_TOKEN=
POSTGRES_PASSWORD=
ASTRA_ENABLE_GITHUB=false
# Optional PAT is sent per scan as github_token; it is never stored. Do not put tokens in git URLs.
# GITHUB_TOKEN is the server-side fallback used when a scan sends no token: it lifts the
# 60-request/hour anonymous GitHub limit and reaches private repositories. Keep it out of git.
GITHUB_TOKEN=
# Registry fan-out and HTTP connection pool size. Raise for large lockfiles, lower if npm rate-limits.
ASTRA_REGISTRY_WORKERS=16
# Per-scan and per-fetch budgets. Raise both for very large repositories (scan caps at 30m, fetch at 10m).
ASTRA_SCAN_TIMEOUT=5m
ASTRA_FETCH_TIMEOUT=90s
ASTRA_ENABLE_DEMO=true
# Shared by intelligence (Explain) and Compose web (voice STT/TTS/ask proxies under /api/voice). Never sent to the browser.
# Laptop `make web`: put SARVAM_API_KEY in apps/web/.env.local.
SARVAM_API_KEY=
SARVAM_MODEL=sarvam-105b-conversations
# Compose web talks to core on the backend network. Local `make web` still uses 127.0.0.1:8080.
# Postgres scan snapshots: keep completed/failed/partial for 30 days and the 500 newest.
# queued/running are never deleted. Set either value to 0 to disable that limit.
# ASTRA_SCAN_RETENTION_AGE=720h
# ASTRA_SCAN_RETENTION_COUNT=500
# Verifier (Compose) talks to the host Docker engine. Never mount this socket into core.
# Colima: ASTRA_DOCKER_SOCK=$HOME/.colima/default/docker.sock
# ASTRA_DOCKER_SOCK=/var/run/docker.sock
# ASTRA_VERIFY_IMAGE=node:22-alpine