# =============================================================================
# UniFi MCP Ecosystem — Environment Configuration
# =============================================================================
# Copy this file to .env and fill in your values.
# Load this trusted file explicitly in your launcher, such as Docker Compose
# env_file or: uv run --env-file /absolute/path/to/.env --with unifi-network-mcp unifi-network-mcp
# Servers do not automatically discover or load .env or config/config.yaml.
# For custom YAML, export CONFIG_PATH=/absolute/path/to/trusted-config.yaml.

# ---------------------------------------------------------------------------
# Shared credentials (used by all servers if server-specific vars not set)
# ---------------------------------------------------------------------------
UNIFI_HOST=192.168.1.1
UNIFI_USERNAME=admin
UNIFI_PASSWORD=your-password-here
# Or keep the secret out of the environment with UNIFI_PASSWORD_FILE=<path>, or
# UNIFI_PASSWORD_COMMAND=<absolute argv, not run through a shell>. Both are
# honoured from the real process environment (docker compose env_file, an
# exported variable, the MCP client's env block). Use an absolute path and
# ensure the launcher and any explicitly loaded env file are trusted.
# See docs/credential-providers.md.
UNIFI_PORT=443
UNIFI_VERIFY_SSL=false
# UNIFI_API_KEY=                      # UniFi API key for selected capabilities

# ---------------------------------------------------------------------------
# Network server overrides (optional — falls back to shared UNIFI_* above)
# ---------------------------------------------------------------------------
# UNIFI_NETWORK_HOST=192.168.1.1
# UNIFI_NETWORK_USERNAME=admin
# UNIFI_NETWORK_PASSWORD=
# UNIFI_NETWORK_PORT=443
# UNIFI_NETWORK_VERIFY_SSL=false
# UNIFI_NETWORK_API_KEY=              # Experimental — see above
# UNIFI_NETWORK_CONTROLLER_TYPE=auto
UNIFI_NETWORK_SITE=default

# ---------------------------------------------------------------------------
# Protect server overrides (optional — falls back to shared UNIFI_* above)
# ---------------------------------------------------------------------------
# UNIFI_PROTECT_HOST=192.168.1.1
# UNIFI_PROTECT_USERNAME=admin
# UNIFI_PROTECT_PASSWORD=
# UNIFI_PROTECT_PORT=443
# UNIFI_PROTECT_VERIFY_SSL=false
# UNIFI_PROTECT_API_KEY=              # Protect API key for selected settings capabilities

# ---------------------------------------------------------------------------
# Access server overrides (optional — falls back to shared UNIFI_* above)
# ---------------------------------------------------------------------------
# UNIFI_ACCESS_HOST=192.168.1.1
# UNIFI_ACCESS_USERNAME=admin
# UNIFI_ACCESS_PASSWORD=
# UNIFI_ACCESS_PORT=443
# UNIFI_ACCESS_VERIFY_SSL=false
# UNIFI_ACCESS_API_KEY=
# UNIFI_ACCESS_API_PORT=12445

# ---------------------------------------------------------------------------
# MCP server settings (shared by all servers)
# ---------------------------------------------------------------------------
UNIFI_TOOL_REGISTRATION_MODE=lazy
UNIFI_MCP_LOG_LEVEL=INFO
# HTTP is opt-in and unauthenticated; keep it on loopback for local clients.
# Docker Compose enables HTTP on the container network and publishes host ports
# on 127.0.0.1. Remote clients must use an authenticated proxy or Cloud Relay.
# UNIFI_MCP_HTTP_ENABLED=false
# UNIFI_MCP_HOST=127.0.0.1
# UNIFI_MCP_HTTP_FORCE=true           # Enable HTTP outside container PID 1

# MCP structured response content policy: adaptive (default), compat, or compact.
# Adaptive classifies requests by the canonical protocolVersion advertised during
# MCP initialization. MCP 2025-06-18 or later receives concise text plus full
# structuredContent; earlier, missing, or malformed revisions retain full text.
# UNIFI_MCP_CONTENT_MODE=adaptive
# UNIFI_NETWORK_MCP_CONTENT_MODE=adaptive
# UNIFI_PROTECT_MCP_CONTENT_MODE=adaptive
# UNIFI_ACCESS_MCP_CONTENT_MODE=adaptive

# ---------------------------------------------------------------------------
# Permission Mode (default: confirm)
# Controls how mutations are handled: confirm requires preview-then-confirm, bypass executes immediately
# ---------------------------------------------------------------------------
# UNIFI_TOOL_PERMISSION_MODE=confirm
# UNIFI_NETWORK_TOOL_PERMISSION_MODE=bypass   # Per-server override

# ---------------------------------------------------------------------------
# Policy Gates (default: unset = allowed)
# Hard boundaries that disable specific actions. Most specific wins.
# ---------------------------------------------------------------------------
# UNIFI_POLICY_DELETE=false                           # Disable deletes globally
# UNIFI_POLICY_NETWORK_UPDATE=true                    # Enable updates on network server
# UNIFI_POLICY_NETWORK_NETWORKS_UPDATE=false           # Disable network category updates

# ---------------------------------------------------------------------------
# Response redaction policy (default: true)
# Redacts secret-bearing fields before returning tool/API responses.
# Set the global value or a server-specific override to false only for trusted
# local administration workflows that require raw secret values.
# ---------------------------------------------------------------------------
# UNIFI_REDACT_SENSITIVE_FIELDS=true
# UNIFI_NETWORK_REDACT_SENSITIVE_FIELDS=true
# UNIFI_PROTECT_REDACT_SENSITIVE_FIELDS=true
# UNIFI_ACCESS_REDACT_SENSITIVE_FIELDS=true
# UNIFI_API_REDACT_SENSITIVE_FIELDS=true

# ---------------------------------------------------------------------------
# Protect event streaming
# ---------------------------------------------------------------------------
# PROTECT_EVENT_BUFFER_SIZE=100
# PROTECT_EVENT_BUFFER_TTL=300
# PROTECT_WEBSOCKET_ENABLED=true
# PROTECT_SMART_DETECTION_MIN_CONFIDENCE=50

# ---------------------------------------------------------------------------
# Access event streaming
# ---------------------------------------------------------------------------
# ACCESS_EVENT_BUFFER_SIZE=100
# ACCESS_EVENT_BUFFER_TTL=300
# ACCESS_WEBSOCKET_ENABLED=true

# ---------------------------------------------------------------------------
# Network event streaming (feeds unifi_recent_events)
# ---------------------------------------------------------------------------
# UNIFI_NETWORK_EVENT_BUFFER_SIZE=100
# UNIFI_NETWORK_EVENT_BUFFER_TTL=300
# UNIFI_NETWORK_WEBSOCKET_ENABLED=true

# ── Cloud relay (optional) ───────────────────────
# UNIFI_RELAY_URL=https://your-worker.workers.dev
# UNIFI_RELAY_TOKEN=your-relay-token
# UNIFI_RELAY_LOCATION_NAME=Home Lab
# UNIFI_RELAY_SERVERS=http://localhost:3000
# UNIFI_RELAY_REFRESH_INTERVAL=300