# GlycemicGPT Environment Configuration
# Copy this file to .env and update values

# ===================
# Docker Deployment
# ===================

# Image version to deploy (default: latest)
# IMAGE_TAG=0.1.2

# Port configuration (optional)
# API_PORT=8000
# WEB_PORT=3000

# Host bind address for the dev Postgres/Redis ports. Default 127.0.0.1
# (loopback only -- reachable from host tools, not the LAN). Set to 0.0.0.0
# only if you must reach the database/cache from another machine.
# DB_BIND_HOST=127.0.0.1
# REDIS_BIND_HOST=127.0.0.1

# API URL for the web container to reach the backend (internal network)
# Only needed if your API service is not named "api" (default: http://api:8000)
# API_URL=http://<api-service-host>:8000

# CORS origins for direct API access (mobile app, external clients)
# Web browser requests are proxied through Next.js and don't need CORS.
# CORS_ORIGINS=["http://localhost:3000"]

# ===================
# Database
POSTGRES_USER=glycemicgpt
POSTGRES_PASSWORD=glycemicgpt
POSTGRES_DB=glycemicgpt

# Redis
# Built-in: set a password (optional for dev, recommended for prod)
REDIS_PASSWORD=
# The default REDIS_URL uses the bundled Redis container.
# Override with a full URL to use an external Redis/Valkey instance:
# REDIS_URL=redis://:<your-redis-password>@valkey.example.com:6379/0
REDIS_URL=redis://redis:6379/0

# Security (generate with: openssl rand -hex 32)
SECRET_KEY=change-me-in-production-use-openssl-rand-hex-32
# Optional: separate key for credential encryption (falls back to SECRET_KEY)
# ENCRYPTION_KEY=

# AI sidecar auth -- shared bearer key between the API and the sidecar.
# Empty is tolerated ONLY by the local dev stack (docker-compose.yml sets
# SIDECAR_ALLOW_UNAUTHENTICATED=true; the sidecar is not published to the
# host there). Production templates require a value. Generate with:
# openssl rand -hex 32
SIDECAR_API_KEY=

# Logging (json or text)
LOG_FORMAT=json

# Error monitoring (Sentry) -- OPTIONAL, OFF by default.
# Leave GLYCEMICGPT_SENTRY_DSN empty to disable: with no DSN the platform sends
# nothing. The project sets this ONLY in its own dev/CI/staging; it is never
# baked into a distributed build. Self-hosters may set their OWN Sentry DSN to
# send their deployment's errors to their OWN account. See PRIVACY.md.
# GLYCEMICGPT_SENTRY_DSN=
# GLYCEMICGPT_SENTRY_ENVIRONMENT=development
# The ai-sidecar reports to its OWN Sentry project (a separate DSN):
# GLYCEMICGPT_SIDECAR_SENTRY_DSN=
# GLYCEMICGPT_SIDECAR_SENTRY_ENVIRONMENT=development
# The web app reports SERVER-SIDE only to its OWN Sentry project. This is NOT a
# NEXT_PUBLIC_ var, so the DSN is never shipped to the browser bundle:
# GLYCEMICGPT_WEB_SENTRY_DSN=
# GLYCEMICGPT_WEB_SENTRY_ENVIRONMENT=development

# AI Provider (claude or openai)
AI_PROVIDER=claude
ANTHROPIC_API_KEY=
OPENAI_API_KEY=

# Telegram Bot
TELEGRAM_BOT_TOKEN=

# Session
SESSION_EXPIRE_HOURS=24

# Backup
BACKUP_SCHEDULE=0 2 * * *
BACKUP_RETENTION_DAYS=30