# SQLite (default)
DB_URI=sqlite:./db.sqlite
# or Postgres
# DB_URI=postgres://nao:nao@localhost:8888/nao
# Enable SQL query logging (set to 'true' to enable)
# DB_QUERY_LOGGING=true

# Chat app port (optional)
SERVER_PORT=5005

# Docker Postgres
POSTGRES_USER=nao
POSTGRES_PASSWORD=nao
POSTGRES_DB=nao

# Auth
BETTER_AUTH_SECRET= #run `openssl rand -base64 32` to generate
# Public URL of your app (used for authentication, trusted origins, and Slack redirects)
BETTER_AUTH_URL=http://localhost:3000

# LLM providers
OPENAI_API_KEY=sk-123456789
ANTHROPIC_API_KEY=sk-123456789

# Azure OpenAI
# AZURE_API_KEY=your-azure-api-key
# Either resource name or base URL — not both:
# AZURE_RESOURCE_NAME=your-resource-name
# AZURE_OPENAI_BASE_URL=https://your-resource.openai.azure.com
# AZURE_API_VERSION=v1
# AZURE_USE_DEPLOYMENT_BASED_URLS=false

# AWS Bedrock
# AWS_REGION=us-east-1
# Pick ONE of the following auth methods:
#   (a) Bearer token
# AWS_BEARER_TOKEN_BEDROCK=your-bearer-token
#   (b) Static IAM credentials
# AWS_ACCESS_KEY_ID=your-access-key
# AWS_SECRET_ACCESS_KEY=your-secret-key
#   (c) Ambient credentials from the AWS SDK chain — IAM task role (ECS),
#       IRSA (EKS), named profile, SSO. Any of these env vars will surface
#       Bedrock as auto-configured:
# AWS_PROFILE=your-profile                       # named profile from ~/.aws/credentials
# AWS_CONTAINER_CREDENTIALS_RELATIVE_URI=...     # set automatically on ECS
# AWS_WEB_IDENTITY_TOKEN_FILE=...                # set automatically on EKS / IRSA
#   (d) EC2 instance profile or default ~/.aws/credentials profile — these
#       leave no env footprint, so opt in explicitly:
# AWS_USE_INSTANCE_CREDENTIALS=true

# App metadata (optional)
APP_VERSION=dev
APP_COMMIT=unknown
APP_BUILD_DATE=

# Context folder (to change for your setup)
NAO_DEFAULT_PROJECT_PATH=/Users/blef/Work/naolabs/chat/example

# Git-based context (Docker only) — clone the project from a git repo on container start.
# Set NAO_CONTEXT_SOURCE=git to enable, then point NAO_DEFAULT_PROJECT_PATH at a clone target inside the container (e.g. /app/context).
# NAO_CONTEXT_SOURCE=git
# NAO_CONTEXT_GIT_URL=https://github.com/your-org/your-nao-context.git
# NAO_CONTEXT_GIT_BRANCH=main
# Authentication — pick ONE of:
#   (a) HTTPS + personal access token (NAO_CONTEXT_GIT_URL must be https://...)
# NAO_CONTEXT_GIT_TOKEN=ghp_xxx
#   (b) SSH deploy key (NAO_CONTEXT_GIT_URL must be git@github.com:org/repo.git)
# NAO_CONTEXT_GIT_SSH_KEY="-----BEGIN OPENSSH PRIVATE KEY-----\n...\n-----END OPENSSH PRIVATE KEY-----"
# Clone only a subfolder of the repo (sparse checkout) — useful for monorepos.
# NAO_CONTEXT_GIT_SUBPATH=analytics/finance

# Enterprise license — signed token issued by getnao.
# Accepts either the raw token or a path to a file containing it.
# When unset, the app runs in OSS mode and all EE features (SSO, …) stay off.
# NAO_LICENSE=/etc/nao/license.key
# NAO_LICENSE=eyJhbGciOiJFZERTQSJ9.eyJpc3MiOiJnZXRuYW8iLC...

# SMTP server Configuration
SMTP_HOST=              # smtp.yourservice.com
SMTP_SSL=false
SMTP_PORT=              # Default to 587
SMTP_MAIL_FROM=
SMTP_PASSWORD=

# GOOGLE OAuth Configuration
GOOGLE_CLIENT_ID=
GOOGLE_CLIENT_SECRET=
GOOGLE_AUTH_DOMAINS=

# GitHub OAuth app — used for the cloud "import from GitHub" integration
# (cloning user repos) and, optionally, as an SSO login provider.
# Create an OAuth app at https://github.com/settings/developers
GITHUB_CLIENT_ID=
GITHUB_CLIENT_SECRET=
# Set to true to also enable "Sign in with GitHub" using the same OAuth app.
# GITHUB_SSO=false
# When SSO is enabled, restrict login to this comma-separated list of GitHub
# usernames. In CI, the PR author is appended automatically.
GITHUB_ALLOWED_USERS=
# Role assigned to new users joining via social auth (admin or user, defaults to user)
# DEFAULT_USER_ROLE=user

# Microsoft / Azure AD SSO (Enterprise — requires NAO_LICENSE with the 'sso' feature)
# AZURE_AD_CLIENT_ID=
# AZURE_AD_CLIENT_SECRET=
# AZURE_AD_TENANT_ID=
# Scope used to silently acquire downstream access tokens (e.g. Redshift native IdP).
# Set to the exposed API scope whose audience the downstream resource expects, e.g.
# api://<clientId>/user_impersonation. Defaults to <clientId>/.default.
# AZURE_AD_TOKEN_SCOPE=

NOTION_API_KEY=

# ClickHouse (optional; use in nao_config.yaml with env() or for connection)
CLICKHOUSE_HOST=localhost
CLICKHOUSE_PORT=8123
CLICKHOUSE_DATABASE=default
CLICKHOUSE_USER=default
CLICKHOUSE_PASSWORD=admin
CLICKHOUSE_SECURE=false

# Tracking (optional)
POSTHOG_KEY=phc_123
POSTHOG_HOST=https://eu.i.posthog.com
POSTHOG_DISABLED=false # (used to opt-out of tracking)

# Beta feature flags
# Set to true to enable the Automations feature (recurring prompt automations).
# BETA_AUTOMATIONS_ENABLED=false