# PostgreSQL connection string. The only required setting.
DATABASE_URL=postgres://kosh:kosh@localhost:5432/kosh

# Docker Compose database password. Use a unique value outside local dev.
POSTGRES_PASSWORD=kosh

# Secret used to sign sessions. Generate one with: openssl rand -base64 32
BETTER_AUTH_SECRET=change-me-to-a-long-random-string

# Public URL of the app (used for auth callbacks and links).
APP_URL=http://localhost:3000

# Host address for Docker's published web port. Loopback is the safe default.
# Set to 0.0.0.0 only when you deliberately want direct LAN/public exposure.
# KOSH_BIND_ADDRESS=127.0.0.1

# Optional reserved file-storage directory monitored by deployment health checks.
# Ask Kosh does not currently ingest attachments.
# KOSH_STORAGE_DIR=/var/lib/kosh/storage

# Successful safe migrations retain this many newest database dumps.
# KOSH_BACKUP_RETENTION_COUNT=10

# Optional: enables at-rest encryption (AES-256-GCM) of sensitive columns —
# account masks, UPI ids, bank references (UTR/UPI ref), and free-text notes.
# Generate with: openssl rand -base64 32
# Keep this safe and backed up: if it is lost, encrypted data is unrecoverable.
# When unset, those columns are stored as plaintext (encryption disabled).
# After setting it on an existing database, run `pnpm db:encrypt` once to
# backfill existing rows.
# KOSH_ENCRYPTION_KEY=

# Optional: set to "true" to disable background jobs (recurring transactions,
# budget carry-forward, bill checks, health checks). Jobs run inside the app
# process by default.
# KOSH_DISABLE_JOBS=false

# ── AI assistant (Gemini) + MCP — all optional; Kosh works fully without them ──
# Get a key at https://aistudio.google.com/apikey. When unset or KOSH_AI_ENABLED
# is false, Ask Kosh falls back to its deterministic parser (no data leaves the
# instance).
GEMINI_API_KEY=
GEMINI_MODEL=gemini-2.5-flash
KOSH_AI_ENABLED=false
# Expose Kosh's authenticated MCP server at /api/mcp for external clients.
# Requires per-user scoped tokens (Settings → AI & MCP). Disabled by default.
KOSH_MCP_ENABLED=false
KOSH_MCP_BASE_URL=
# Secret for signing in-app assistant confirmation payloads. Falls back to
# BETTER_AUTH_SECRET when unset. Set to a unique value in production.
KOSH_MCP_AUTH_SECRET=