# Nimbus environment — copy to .env and fill in. NEVER commit the real .env.
# Loaded via `node --env-file-if-exists=.env` (and by docker compose `env_file`).
#
# Grouped by what you actually need:
#   [REQUIRED]        — the app won't work without these
#   [FEATURE: …]      — only needed to turn on that feature; skip to leave it off
#   [PUBLIC HOSTING]  — only when Nimbus is reachable from outside localhost
#
# ══════════════════════════════════════════════════════════════════════════════
# [REQUIRED] Security
# ══════════════════════════════════════════════════════════════════════════════
# Master key for encrypting cloud credentials at rest (AES-256-GCM). Base64 32 bytes.
# Generate: node -e "console.log(require('crypto').randomBytes(32).toString('base64'))"
NIMBUS_ENC_KEY=

# ══════════════════════════════════════════════════════════════════════════════
# [REQUIRED] AI model — the Nimbus agent's brain. Your provider, your key, your billing.
# ══════════════════════════════════════════════════════════════════════════════
LLM_PROVIDER=openrouter            # openrouter | databricks
LLM_MODEL=                         # e.g. anthropic/claude-sonnet-4.5 (openrouter) or your endpoint
# OpenRouter (simplest — one key, any model):
OPENROUTER_API_KEY=
# Databricks (alternative primary):
DATABRICKS_HOST=
DATABRICKS_TOKEN=
DATABRICKS_MODEL=

# ══════════════════════════════════════════════════════════════════════════════
# [FEATURE: Rent a machine] Fly.io — provision cloud machines that run coding agents.
# Set FLY_API_TOKEN to enable it; leave blank to disable the feature entirely.
# NOTE: rented machines need NO public URL — the worker loop runs inside THIS server
# and drives the Fly machine via Fly's API. The person renting supplies their own
# coding-agent key (Claude OAuth token / OpenRouter key) per rental in the UI.
# ══════════════════════════════════════════════════════════════════════════════
FLY_API_TOKEN=
FLY_ORG=personal                   # your Fly org slug
FLY_REGION=iad                     # default machine region
FLY_APP=                           # Fly app that hosts rented machines (default: nimbus-rented)
FLY_MACHINE_IMAGE=                 # base image (default: node:20)

# ══════════════════════════════════════════════════════════════════════════════
# [FEATURE: GitHub / cloud connections] — optional integrations
# ══════════════════════════════════════════════════════════════════════════════
COMPOSIO_API_KEY=                  # GitHub (and other app) connections
GITHUB_TOKEN=                      # optional — higher GitHub rate limits + private repo clone
GOOGLE_OAUTH_CLIENT_ID=            # GCP "Connect with Google" (keyless OAuth); has a public default
GOOGLE_OAUTH_CLIENT_SECRET=

# ══════════════════════════════════════════════════════════════════════════════
# App config
# ══════════════════════════════════════════════════════════════════════════════
AGENT_PORT=8788
# [PUBLIC HOSTING] Your public app URL. Used for GCP OAuth redirects + generated links.
# Docker single-container: http://localhost:8788 (or your real domain in production).
APP_URL=http://localhost:8788
ALLOW_SIGNUP=true                  # set false on public deploys to close registration
AGENT_DAILY_LIMIT=50               # per-user daily cap on expensive agent/cloud actions
CORS_ORIGINS=                      # comma-separated allowlist; empty = same-origin only
DOCS_HOST=                         # extra host to serve docs from (besides docs.*)
OPS_SCAN_MINUTES=                  # >0 enables the scheduled incident scan
# [PUBLIC HOSTING] Public base URL for inbound webhooks (incident scanning). Optional.
WEBHOOK_BASE=

# ── Connecting your OWN machine (laptop/CI) for repairs — NOT an env var here ──────
# That machine runs the @nimbus/cli worker and POLLS this server, so IT needs to know
# where Nimbus lives (this server does not need to reach it):
#   nimbus start <worker-key> --url https://your-nimbus-host   (default: http://localhost:8788)