# ── QRESPONDER configuration ────────────────────────────────────────────────
# Copy to .env and fill in. The .env file is gitignored — never commit secrets.

# Which provider the core loop talks to:
#   anthropic | openai | gemini | deepseek | local | mock
LLM_PROVIDER=anthropic

# ── Cloud provider keys (server-side only — never sent to the browser) ───────
# Set any you want; the UI's live model picker lists models for configured ones.
ANTHROPIC_API_KEY=
ANTHROPIC_MODEL=claude-opus-4-8
OPENAI_API_KEY=
GEMINI_API_KEY=
DEEPSEEK_API_KEY=

# ── OpenAI-compatible path (Ollama / vLLM / LM Studio / OpenAI / OpenRouter) ─
# Local is just a different base URL. Examples:
#   Ollama   : LLM_BASE_URL=http://localhost:11434/v1  LLM_API_KEY=ollama   LLM_MODEL=llama3.1
#   vLLM/LMS : LLM_BASE_URL=http://localhost:8000/v1   LLM_API_KEY=any      LLM_MODEL=<served>
#   OpenAI   : LLM_BASE_URL=https://api.openai.com/v1  LLM_API_KEY=sk-...   LLM_MODEL=gpt-4o
LLM_BASE_URL=http://localhost:11434/v1
LLM_API_KEY=ollama
LLM_MODEL=llama3.1

# ── Knowledge base ──────────────────────────────────────────────────────────
KB_MODE=in_context                     # in_context | retrieval (Phase 1)

# ── Embeddings + reranker (Phase 1, local-first / offline) ──────────────────
EMBEDDING_MODEL=all-MiniLM-L6-v2
RERANKER_MODEL=BAAI/bge-reranker-base
TOP_N_RETRIEVE=20
TOP_K_CONTEXT=5
RRF_K=60

# ── Limits / behavior ───────────────────────────────────────────────────────
MAX_KB_CHARS=150000
VERIFY_FAITHFULNESS=true
BATCH_SIZE=12

# ── Source connectors (OPTIONAL) — register a one-time OAuth app per provider ─
# Server-side only; the client SECRET and the resulting tokens NEVER reach the
# browser. Redirect URI for every provider: <this server>/api/oauth/callback
# If your server isn't at http://127.0.0.1:8000, set OAUTH_REDIRECT_BASE to match.
# See docs/connectors.md for exactly what to register + the live-verify checklist.
OAUTH_REDIRECT_BASE=http://127.0.0.1:8000
# Max documents/pages a single connector sync pulls per source (default 2000).
CONNECTOR_MAX_ITEMS=2000
# Notion (Public OAuth integration → notion.so/my-integrations)
NOTION_CLIENT_ID=
NOTION_CLIENT_SECRET=
# Google Drive (Google Cloud Console OAuth client, Drive API, scope drive.readonly)
GOOGLE_CLIENT_ID=
GOOGLE_CLIENT_SECRET=
# Confluence (Atlassian developer console, OAuth 2.0 3LO)
CONFLUENCE_CLIENT_ID=
CONFLUENCE_CLIENT_SECRET=
# Microsoft — SharePoint + OneDrive (Entra ID app, MS Graph, Files.Read.All/Sites.Read.All)
MICROSOFT_CLIENT_ID=
MICROSOFT_CLIENT_SECRET=

# ── Hosting (OPTIONAL — the default is local-only, no auth, 127.0.0.1) ────────
# Set a long random token to require auth on the app + API when you expose it on a
# network. Leave BLANK for the local default. Generate: openssl rand -hex 24
QRESPONDER_AUTH_TOKEN=
# For the one-command HTTPS stack (docker-compose.hosted.yml): your domain + an
# email for Let's Encrypt. Point a DNS A record at the VM first. See docs/hosting.md.
QR_DOMAIN=
QR_ACME_EMAIL=