# --- Backend ---
FLASK_ENV=development
SECRET_KEY=change-me

# Local dev / CI only. Leave UNSET in production: with it off, the app refuses
# to boot on an unset/default SECRET_KEY (which would make cookies forgeable and
# at-rest encryption worthless). Setting it true downgrades that to a warning.
DEV_MODE=true

# Optional dedicated key for at-rest column encryption. Unset = derive the
# encryption key from SECRET_KEY (the default). Set it to rotate the encryption
# key independently of the cookie-signing key; when you change it, re-encrypt
# existing data with `OLD_ENCRYPTION_KEY_SECRET=<prev> python -m app.scripts.rotate_encryption_key`.
# ENCRYPTION_KEY_SECRET=

# Where the wiki git repo lives. Relative paths are resolved against the
# repo root (see `app/config.py`), so this works regardless of the launch
# cwd. Compose overrides this to `/data/wiki` for in-container runs.
WIKI_DIR=./local_data/wiki

# App state + task queues live in the same Postgres (pgmq for the queues).
# This URL is for **host** runs — the compose Postgres service publishes
# 5432 to 127.0.0.1, and `postgres`/`postgres` are the credentials it boots
# with. Inside compose containers the `environment:` block overrides
# DATABASE_URL to use the internal hostname `postgres`.
DATABASE_URL=postgresql://postgres:postgres@localhost:5432/agent_wiki

# Per-queue max backlog. New enqueues fail fast with a 503 when a queue is
# at this size. Default 1000; applies to all three pgmq queues.
MAX_QUEUE_SIZE=1000

# Threads the web process offloads short-lived blocking work onto (DB reads,
# git calls) via `asyncio.to_thread`. Default 64.
WEB_THREAD_POOL_SIZE=64

# Browser-facing origin the backend advertises (launcher URIs, redirect
# targets, email links, MCP tool-result URLs) — REQUIRED, never inferred
# from request headers.
# Host dev (launch.json) = the Next dev server (http://localhost:3000);
# docker compose app profile = the nginx port (http://localhost:8090);
# deployments = the real external URL. No trailing slash.
PUBLIC_BASE_URL=http://localhost:3000

# Host port nginx publishes when running the compose app profile. Keep
# PUBLIC_BASE_URL in sync with it.
# AGENT_WIKI_PORT=8090

# --- Auth ---
# basic | oidc
AUTH_MODE=basic

# Comma-separated email whitelist for signup. Empty = anyone can sign up.
# Domain wildcards allowed: ALLOWED_EMAILS=*@onyx.app,specific@example.com
ALLOWED_EMAILS=

OIDC_ISSUER=
OIDC_CLIENT_ID=
OIDC_CLIENT_SECRET=
OIDC_REDIRECT_URI=

# --- LLM ---
# Provider, model, and API keys are configured at runtime via the admin page
# (Admin → LLM tab). They are stored in the app database, not in env vars.

# --- Frontend ---
NEXT_PUBLIC_API_BASE=/api
# Required for host-native dev (launch.json / bun run dev). Next.js proxies
# /api/* here; without it the rewrite falls back to http://backend:8080 which
# only resolves inside Docker and causes 500s on the frontend.
BACKEND_URL=http://localhost:8080