# ── Database ──
# Postgres with the pgvector extension. docker-compose provides this.
DATABASE_URL=postgres://reqsolve:reqsolve@localhost:5432/reqsolve

# ── App ──
NODE_ENV=development
# Public origin, used for links in emails / password resets.
APP_URL=http://localhost:3000

# ── AI (optional) ──
# The AI provider is normally chosen in-app under Settings → AI settings: pick one
# provider (Anthropic, OpenAI, Gemini, Mistral, Azure, Groq, xAI, DeepSeek,
# OpenRouter, Together, Ollama, a custom OpenAI-compatible endpoint, or Microsoft
# 365 Copilot) and enter one API key — it powers every AI feature. The vars below
# are only fallbacks when nothing is configured in-app.
#
# Leave ANTHROPIC_API_KEY empty to run without AI. All AI features then show a
# clear "AI not configured" state; everything else works fully.
ANTHROPIC_API_KEY=
# Fallback model + OpenAI-compatible base URL when not set in-app (empty = use the
# selected provider's default model / documented endpoint).
AI_MODEL=
AI_BASE_URL=
# Per-task models for the native Anthropic path (sensible defaults shown).
AI_MODEL_FAST=claude-haiku-4-5-20251001
AI_MODEL_SMART=claude-sonnet-4-6

# Embeddings: Ollama BGE-M3 (1024-dim, multilingual) — the only provider.
# The bundled Ollama service (docker compose) serves this; point elsewhere here
# if you host it separately. After changing the model, run `npm run db:reembed`.
OLLAMA_BASE_URL=http://localhost:11434
OLLAMA_EMBED_MODEL=bge-m3

# ── Email channel (optional) ──
# Mailboxes are connected in the app under Admin · Email (any IMAP/SMTP provider,
# or "Connect Gmail" via OAuth). These env vars are only the server-level settings.
#
# Auto-poll interval for inbound mail, in seconds (minimum 15; 0/empty = off, use
# the "Sync now" button instead). The poller starts on first app use.
EMAIL_POLL_SECONDS=60
#
# Gmail sign-in (needed for "Connect Gmail" — both the HTTPS Gmail API transport
# and the IMAP-over-OAuth option). Create an OAuth 2.0 Client (type: Web
# application) in Google Cloud Console and add the redirect URI:
#   ${APP_URL}/api/email/oauth/callback
# Tip: mark the OAuth app "Internal" in your Workspace to skip Google verification.
GOOGLE_CLIENT_ID=
GOOGLE_CLIENT_SECRET=

# ── Attachments ──
# Where uploaded files are stored (local disk). Defaults to ./data/uploads.
UPLOADS_DIR=
# Max upload size per file, in MB.
ATTACHMENT_MAX_MB=25

# ── Secret encryption (REQUIRED to store any secret) ──
# Encrypts mail passwords, OAuth tokens and the Anthropic API key at rest
# (AES-256-GCM). It is REQUIRED before you can save any of those secrets: the
# app refuses to store them in plaintext and returns a clear error until this is
# set. Generate one with: openssl rand -base64 32
# Keep it stable — rotating it makes previously stored secrets unreadable.
ENCRYPTION_KEY=

# ── Rate-limit proxy trust (security) ──
# Number of reverse proxies in front of ReqSolve. Rate limiting reads the client IP
# this many hops from the RIGHT of X-Forwarded-For, so a client can't spoof the
# left-most entry to bypass login/reset/web-form throttles. Default 1 (one proxy,
# e.g. nginx/Traefik). Set 0 ONLY if the app is exposed directly (then XFF is not
# trusted). Run ReqSolve behind a proxy that overwrites X-Forwarded-For.
TRUSTED_PROXY_HOPS=1