# Copy this file to .env before running AgentForge outside local evaluation.
# Replace every value marked "change-me" in a real deployment.

APP_ENV=development
APP_PORT=80
LOG_LEVEL=INFO

POSTGRES_DB=agentforge
POSTGRES_USER=agentforge
POSTGRES_PASSWORD=change-me-postgres-password
POSTGRES_PORT=5432
DATABASE_URL=postgresql+asyncpg://agentforge:change-me-postgres-password@postgres:5432/agentforge

REDIS_URL=redis://redis:6379/0
REDIS_PORT=6379

# OAuth application credentials as a provider-keyed JSON object. Google credentials can be
# configured once under "google" and reused by Gmail, Docs, Calendar, Sheets, and Drive.
OAUTH_CLIENTS={"google":{"client_id":"","client_secret":""},"slack":{"client_id":"","client_secret":""}}
OAUTH_STATE_TTL_SECONDS=600
# Set this when the externally visible API URL differs from the backend request URL.
# The provider name and /callback are appended to this value.
OAUTH_CALLBACK_BASE_URL=
OAUTH_FRONTEND_URL=http://localhost:3000

# Generate with: openssl rand -hex 32
SECRET_KEY=change-me-with-a-64-character-random-value
# Defaults to SECRET_KEY when unset. Set this independently in production.
JWT_SECRET=change-me-with-a-different-64-character-random-value
JWT_ALGORITHM=HS256
ACCESS_TOKEN_EXPIRE_MINUTES=15
REFRESH_TOKEN_EXPIRE_MINUTES=10080

# Optional authentication mode. Keycloak is an external service and is not started by AgentForge.
AUTH_MODE=local
KEYCLOAK_URL=http://localhost:8080
KEYCLOAK_REALM=agentforge
KEYCLOAK_CLIENT_ID=agentforge-web
KEYCLOAK_CLIENT_SECRET=
KEYCLOAK_REDIRECT_URI=http://localhost:3000/auth/callback
KEYCLOAK_VALIDATE_TOKENS=true

# URL-safe base64-encoded 32-byte key. Generate with:
# python -c "import base64,secrets; print(base64.urlsafe_b64encode(secrets.token_bytes(32)).decode())"
MASTER_ENCRYPTION_KEY=MDEyMzQ1Njc4OWFiY2RlZjAxMjM0NTY3ODlhYmNkZWY=

# JSON array consumed by pydantic-settings.
CORS_ORIGINS=["http://localhost","http://localhost:3000"]
NEXT_PUBLIC_API_URL=/api/v1

# Container image contract: it receives AGENTFORGE_AGENT_CONFIG as JSON.
DEPLOYMENT_IMAGE_TAG=agentforge-agent:latest
# Optional Docker network joined by deployed agent containers.
DEPLOYMENT_DOCKER_NETWORK=agentforge_app
# Linux only: `stat -c '%g' /var/run/docker.sock` (often 998 or 999).
DOCKER_GID=998

# Realtime voice (LiveKit can be self-hosted or LiveKit Cloud).
LIVEKIT_URL=ws://livekit:7880
LIVEKIT_API_KEY=change-me-livekit-key
LIVEKIT_API_SECRET=change-me-livekit-secret
LIVEKIT_AGENT_NAME=agentforge-voice
LIVEKIT_TOKEN_TTL_MINUTES=15
LIVEKIT_ROOM_EMPTY_TIMEOUT=300
LIVEKIT_AUTO_DISPATCH=true

# Voice provider credentials. Keep these server-side only.
DEEPGRAM_API_KEY=
ASSEMBLYAI_API_KEY=
ELEVENLABS_API_KEY=
SPEECHIFY_API_KEY=

# Optional LangSmith tracing.
LANGSMITH_TRACING=false
LANGSMITH_API_KEY=
LANGSMITH_PROJECT=agentforge
LANGSMITH_ENDPOINT=https://api.smith.langchain.com

# Optional OpenTelemetry tracing to an externally managed, self-hosted Langtrace server.
# The local Langtrace UI and API are available at http://localhost:3000 by default.
LANGTRACE_TRACING=false
LANGTRACE_API_HOST=http://localhost:3000
# Create an API key in the selected Langtrace project if authentication is enabled.
LANGTRACE_API_KEY=
LANGTRACE_PROJECT=agentforge
LANGTRACE_SERVICE_NAME=agentforge