# Deployment Configuration
# Copy this file to .env and fill in your values

# Required: Encryption key for sensitive data at rest (use: openssl rand -hex 32)
ENCRYPTION_KEY=your-encryption-key-here

# Required: Secret key for JWT signing (use: openssl rand -hex 32)
SECRET_KEY=your-secret-key-here

# Required in production: HMAC secret for signing delegation payloads sent to
# agents and verifying their callbacks. MUST be set to a strong random value
# (use: openssl rand -hex 32). If unset in non-dev mode the app refuses to start.
# NOTE: this is being superseded by per-agent Ed25519 keys; legacy agents still
# rely on it during the dual-signing transition window.
HIVE_SIGNING_SECRET=your-hive-signing-secret-here

# Required in production: Redis URL for shared state (JWT denylist, distributed
# rate limits, callback replay-nonce store). In DEV_MODE an in-memory fallback
# is used so a local single-instance run needs no Redis.
REDIS_URL=redis://localhost:6379/0

# Required in production: PostgreSQL password (used by docker-compose.prod.yml).
# The prod compose file runs Postgres 16 with user/db "hive".
POSTGRES_PASSWORD=your-postgres-password-here

# Required in production: Database URL. Defaults to local SQLite for dev.
# Prod uses Postgres via docker-compose.prod.yml.
DATABASE_URL=sqlite+aiosqlite:///./agent_marketplace.db

# Set DEV_MODE=1 for local development only. Allows insecure SECRET_KEY default,
# non-secure cookies, and the Redis in-memory fallback. NEVER enable in prod.
DEV_MODE=0

# Token lifetimes
ACCESS_TOKEN_EXPIRE_MINUTES=15
REFRESH_TOKEN_EXPIRE_DAYS=30

# Set COOKIE_SECURE=1 in production (https) so refresh cookies are Secure-only.
# Defaults to 0 in dev so http://localhost works.
COOKIE_SECURE=1

# Comma-separated list of allowed CORS origins
ALLOWED_ORIGINS=http://localhost:8000

# Optional: Git branch to deploy (default: main)
GIT_BRANCH=main

# Optional: Remote host (default set in deploy.sh)
# REMOTE_HOST=root@187.127.140.125

# Optional: Remote port (default: 8080)
# REMOTE_PORT=8080

# ── OpenClaw agent deployment ───────────────────────────────────────────────
# How OpenClaw agents are deployed when calling POST /api/agents/deploy-openclaw
#   local  → deploy on the local Docker daemon (falls back to mock if no Docker)
#   vps    → deploy to a remote VPS over SSH (requires the vars below)
#   auto   → vps when OPENCLAW_VPS_HOST + OPENCLAW_VPS_SSH_KEY_PATH are set, else local
OPENCLAW_DEPLOY_MODE=auto

# Remote VPS deployment (only needed when OPENCLAW_DEPLOY_MODE=vps or auto)
# OPENCLAW_VPS_HOST=187.127.140.125
# OPENCLAW_VPS_SSH_KEY_PATH=/path/to/ssh/key
# OPENCLAW_VPS_SSH_USER=root
# OPENCLAW_VPS_SSH_PORT=22

# Local/network settings used when deploying on the local Docker daemon
# OPENCLAW_PORT_START=9000
# HIVE_DOMAIN=hive.yourdomain.com
# HOST_IP=127.0.0.1