# Copy to .env. Generate SECRET_KEY_BASE with: openssl rand -base64 48
SECRET_KEY_BASE=replace-me-with-generated-secret

# Local compose defaults. Override in docker-compose.override.yml for a real site.
PHX_HOST=localhost
PUBLIC_URL=http://localhost:4000
# Optional extra restriction on OIDC sign-in. Unset means anyone your identity
# provider authenticates may sign in; it is never the local account's gate.
# ALLOWED_EMAIL_DOMAIN=

# Local sign-in with the bootstrap admin account, no identity provider
# required. On first boot the portal prints the account and a generated
# password once -- look for it in `docker compose logs portal`. Set
# BOOTSTRAP_ADMIN_PASSWORD to choose your own instead.
# DEV_AUTH is the older name for LOCAL_AUTH and still works.
LOCAL_AUTH=true
# BOOTSTRAP_ADMIN_EMAIL=admin@localhost
# BOOTSTRAP_ADMIN_PASSWORD=

# Optional OIDC. Any OpenID Connect provider works (Keycloak, Dex, Google,
# Okta, Entra, ...); endpoints are read from the issuer's discovery
# document. Leave unset to run on local sign-in. An unreachable issuer disables
# OIDC and leaves the portal serving.
# OIDC_ISSUER=
# OIDC_CLIENT_ID=
# OIDC_CLIENT_SECRET=
# OIDC_REDIRECT_URI=http://localhost:4000/auth/oidc/callback

# Trust store for outbound TLS. Only needed on an image with no OS CA bundle.
# OIDC_CACERTFILE=/etc/ssl/certs/ca-certificates.crt

# Optional GitHub poll
# GITHUB_TOKEN=
# GITHUB_ORG=

# Optional fleet-log semantic search: choose a model and save its key per tenant
# at /settings/credentials. See docs/fleet-search.md.

# Hostname this deployment publishes its interactions URL on.
# One URL serves every tenant; the interaction payload names the Discord
# application, and the tenant that claimed it is the one whose stored key
# verifies the request. Listing a hostname here confines it to POST
# /interactions - the portal, /mcp, and /api answer 404 on it. Unset (the
# localhost default) means the portal and the endpoint share one origin.
# Discord public keys are never environment values; tenants store them in the
# portal (see docs/credentials.md).
# DISCORD_INTERACTIONS_HOST=discord.example.com

# Tenant credential encryption: see docs/credentials.md for initial setup,
# fallback derivation, and rotation. Preserve the current key on existing databases.
# CLOAK_KEY=
# CLOAK_KEY_TAG=
# CLOAK_KEYS_RETIRED=

# Agent MCP / ingest
# FIRSTMATE_AGENT_TOKEN=

# Optional routing intel. Read at runtime, never committed.
# AA_API_KEY= (Artificial Analysis benchmark intel; paid API)

# Opt-in build tracking. Unset hides the plate; nothing is collected.
# See docs/build-tracking.md.
# KUBERNETES_TRACKING_ENABLED=true
# DOCKER_TRACKING_ENABLED=true
# BUILDBUDDY_HOST=https://app.buildbuddy.io
# BUILDBUDDY_ORG_API_KEY_FILE=./.local-secrets/buildbuddy_org_api_key

# fm-steer build/deploy tracking (see docs/build-events.md). FIRSTMATE_INSTANCE
# is the portal the CLI writes to; it falls back to the host from
# `fm-steer auth login`, then http://localhost:4000.
# FIRSTMATE_INSTANCE=https://firstmate.example.com
# FIRSTMATE_AGENT_ID=
# FIRSTMATE_MODEL=
# FIRSTMATE_EFFORT=
# Public-edge security. Defaults are right for localhost; see docs/security.md
# before putting this on a public hostname.
#
# Which header carries the client address, and how many proxies to skip when
# reading x-forwarded-for (counted from the right). Unset means use the socket
# peer, which is correct here because nothing sits in front of compose.
# CLIENT_IP_HEADER=x-forwarded-for
# CLIENT_IP_TRUSTED_HOPS=0
# Trust x-forwarded-proto only behind a gateway that overwrites it.
# TRUST_FORWARDED_PROTO=false
#
# CSP starts report-only. Set to "enforce" once the browser console is clean.
# CSP_MODE=report_only
# CSP_REPORT_URI=
#
# Session cookie: production build-time settings, not container boot settings.
# See docs/security.md before rotating salts or changing Secure.
# SESSION_SIGNING_SALT=
# SESSION_ENCRYPTION_SALT=
# SESSION_COOKIE_SECURE=true

# Operator identity on the public /terms and /privacy pages. Set the contact
# before pointing Discord's Developer Portal at those URLs.
# LEGAL_OPERATOR=
# LEGAL_CONTACT_EMAIL=
# LEGAL_GOVERNING_LAW=