# emagg environment configuration.
# Copy this file to `.env` and fill in real values. `.env` is gitignored.

# REQUIRED. At-rest encryption key for stored IMAP passwords (AES-256-GCM).
# Generate a 32-byte key, e.g.:  openssl rand -hex 32
# The app refuses to start if this is missing.
EMAGG_ENCRYPTION_KEY=replace-with-32-byte-hex-key-from-openssl-rand-hex-32

# OPTIONAL. Composio API key for Gmail/Zoho connectors.
# Leave blank to run without provider sync.
COMPOSIO_API_KEY=

# OPTIONAL. Per-provider Composio auth-config ids (the managed OAuth "app" per
# provider) used by the account connect flow. Referenced indirectly so switching
# to our own OAuth client later is a config change, not a code change. With no
# live Composio creds the connect endpoints simply report "not configured".
COMPOSIO_GMAIL_AUTH_CONFIG_ID=
COMPOSIO_ZOHO_AUTH_CONFIG_ID=

# OPTIONAL. IITB IMAP bootstrap (the walking-skeleton account).
# When IITB_IMAP_USER and IITB_IMAP_PASSWORD are both set and no IITB account
# exists yet, one is created on boot with the password encrypted at rest. The
# password is read from env once here, never committed, and stored encrypted.
# Leave user/password blank to skip the bootstrap (e.g. in CI).
IITB_IMAP_USER=
IITB_IMAP_PASSWORD=
IITB_IMAP_HOST=imap.iitb.ac.in
IITB_IMAP_PORT=993

# OPTIONAL. Allow insecure IMAP TLS. Defaults to false (secure: certificates are
# verified). Set to true only for old servers (e.g. IITB) whose certificates are
# self-signed or otherwise unverifiable, where the default secure connection
# fails. When true, the connection stays TLS-encrypted but certificate
# VERIFICATION is disabled (server identity is not checked), and a warning is
# logged. Applies to both the sync connector and the account-setup test login;
# never affects Gmail/Zoho.
IMAP_ALLOW_INSECURE_SSL=false

# OPTIONAL. Path to the SQLite database file (created on first run).
EMAGG_DB_PATH=./data/emagg.sqlite

# OPTIONAL. Server bind address and port (local-first: 127.0.0.1 only).
HOST=127.0.0.1
PORT=3001