APP_ENV=dev
APP_HOST=0.0.0.0
APP_PORT=8000
AUTO_CREATE_SCHEMA=true
CORS_ALLOW_ORIGINS=http://localhost:3000,http://127.0.0.1:3000

DATABASE_URL=postgresql+psycopg://postgres:postgres@localhost:5432/gtm_copilot
DATABASE_PROVIDER=postgresql  # postgresql or tidb
REDIS_URL=redis://localhost:6379/0

# TiDB Cloud (set DATABASE_PROVIDER=tidb to activate)
TIDB_HOST=
TIDB_PORT=4000
TIDB_USER=
TIDB_PASSWORD=
TIDB_DATABASE=gtm_copilot
TIDB_SSL_CA=  # Path to CA cert for TiDB Cloud

OPENAI_BASE_URL=
OPENAI_API_KEY=
OPENAI_MODEL=gpt-4.1
OPENAI_EMBEDDING_MODEL=text-embedding-3-small
ENTERPRISE_MODE=false
SECURITY_REQUIRE_PRIVATE_LLM_ENDPOINT=false
SECURITY_ALLOWED_LLM_BASE_URLS=
SECURITY_FAIL_CLOSED_ON_MISSING_LLM_KEY=false
SECURITY_FAIL_CLOSED_ON_MISSING_EMBEDDING_KEY=false
SECURITY_REDACT_BEFORE_LLM=true
SECURITY_REDACT_AUDIT_LOGS=false
SECURITY_TRUSTED_HOST_ALLOWLIST=
SECURITY_ALLOW_INSECURE_HTTP_LLM=false
EMBEDDING_DIMENSIONS=1536
RETRIEVAL_TOP_K=8

# Google OAuth (login + Drive). Add http://localhost:3000/api/auth/exchange as an authorized redirect URI.
GOOGLE_CLIENT_ID=
GOOGLE_CLIENT_SECRET=
NEXT_PUBLIC_APP_URL=http://localhost:3000

GOOGLE_DRIVE_CLIENT_ID=
GOOGLE_DRIVE_CLIENT_SECRET=
GOOGLE_DRIVE_SERVICE_ACCOUNT_JSON=
GOOGLE_DRIVE_OAUTH_TOKEN_PATH=.google-drive-token.json
GOOGLE_DRIVE_TOKEN_ENCRYPTION_KEY=
GOOGLE_DRIVE_OAUTH_STATE_TTL_SECONDS=600
GOOGLE_DRIVE_ROOT_FOLDER_ID=
GOOGLE_DRIVE_FOLDER_IDS=
FAKE_DRIVE_INCLUDE_GITHUB=false


# Chorus by ZoomInfo — call transcript connector
# API token from: Chorus app → Personal Settings → API Tokens
# Base URL is always https://chorus.ai (do not change)
CHORUS_API_KEY=
# CALL_API_KEY= and CALL_BASE_URL= are legacy aliases (still supported)

EMAIL_MODE=draft
INTERNAL_DOMAIN_ALLOWLIST=example.com
SMTP_HOST=
SMTP_PORT=587
SMTP_USERNAME=
SMTP_PASSWORD=
SMTP_FROM=gtm-copilot@example.com

SLACK_BOT_TOKEN=
SLACK_SIGNING_SECRET=
SLACK_DEFAULT_CHANNEL=

# --- Auth (JWT secret for API; generate with: openssl rand -hex 32) ---
SECRET_KEY=changeme-generate-with-openssl-rand-hex-32

# --- Next.js / NextAuth (UI service) ---
NEXTAUTH_URL=http://localhost:3000
NEXTAUTH_SECRET=changeme-generate-with-openssl-rand-hex-32
# NEXT_PUBLIC_API_URL is the public URL of the API service (used by browser)
NEXT_PUBLIC_API_URL=http://localhost:8000

# --- Observability (optional) ---
SENTRY_DSN=
ENVIRONMENT=development
LOG_LEVEL=INFO