# Veritas Kanban Server - Environment Variables
# Copy to .env and customize:
#   cp .env.example .env

# Server port
PORT=3001

# ═══════════════════════════════════════════════════════════════════════════════
# LOGGING
# ═══════════════════════════════════════════════════════════════════════════════

# Log level: trace | debug | info | warn | error | fatal (default: info)
# Set to 'debug' for verbose output, 'warn' for quieter logs
LOG_LEVEL=info

# ═══════════════════════════════════════════════════════════════════════════════
# AUTHENTICATION SETTINGS
# ═══════════════════════════════════════════════════════════════════════════════

# Enable/disable authentication (default: true)
# Set to "false" to disable auth (NOT recommended for production)
VERITAS_AUTH_ENABLED=true

# Allow unauthenticated requests from localhost (default: false)
# Useful for local development while keeping auth enabled for remote
# When enabled, localhost gets the role specified by VERITAS_AUTH_LOCALHOST_ROLE
VERITAS_AUTH_LOCALHOST_BYPASS=true

# Role assigned to unauthenticated localhost connections (default: read-only)
# Options: read-only, agent, admin
# ⚠️  WARNING: "admin" grants full access to any local process without credentials
VERITAS_AUTH_LOCALHOST_ROLE=read-only

# Admin API key - has full access to all endpoints
# Generate a secure key: node -e "console.log(require('crypto').randomBytes(32).toString('hex'))"
# ⚠️  Key MUST be at least 32 characters. Weak keys like "dev-admin-key" will trigger a startup warning.
VERITAS_ADMIN_KEY=your-secret-admin-key-here

# API keys for agents and services
# Format: name:key:role,name2:key2:role2
# Roles: admin, agent, read-only
# Example:
VERITAS_API_KEYS=veritas-agent:vk_agent123:agent,dashboard:vk_dashboard456:read-only

# ═══════════════════════════════════════════════════════════════════════════════
# JWT / SESSION SECRET
# ═══════════════════════════════════════════════════════════════════════════════

# JWT signing secret for user sessions (password auth).
# If set, the secret is NEVER written to security.json on disk.
# If unset, a secret is auto-generated and stored in security.json (legacy)
# or generated at runtime (ephemeral — sessions won't survive restart).
# Generate a secure secret: openssl rand -hex 64
# VERITAS_JWT_SECRET=

# ═══════════════════════════════════════════════════════════════════════════════
# CORS & NETWORKING
# ═══════════════════════════════════════════════════════════════════════════════

# Allowed CORS origins (comma-separated)
CORS_ORIGINS=http://localhost:3000,http://localhost:5173,http://127.0.0.1:3000,http://127.0.0.1:5173

# Reverse proxy support (set when behind nginx, Caddy, Traefik, etc.)
# TRUST_PROXY=1

# ═══════════════════════════════════════════════════════════════════════════════
# DATA & STORAGE
# ═══════════════════════════════════════════════════════════════════════════════

# Data directory for tasks, config, logs (default: .veritas-kanban in project root)
# VERITAS_DATA_DIR=.veritas-kanban

# Storage backend: file | sqlite (default: file)
# VERITAS_STORAGE=file

# SQLite database path when VERITAS_STORAGE=sqlite (default: runtime dir / veritas.db)
# VERITAS_SQLITE_PATH=.veritas-kanban/veritas.db

# Telemetry retention: days to keep event files before deletion (default: 30)
# TELEMETRY_RETENTION_DAYS=30

# Telemetry compression: days after which NDJSON files are gzip-compressed (default: 7, 0 = disabled)
# TELEMETRY_COMPRESS_DAYS=7

# ═══════════════════════════════════════════════════════════════════════════════
# INTEGRATION
# ═══════════════════════════════════════════════════════════════════════════════

# Clawdbot gateway URL for AI agent orchestration
# CLAWDBOT_GATEWAY=http://127.0.0.1:18789

# Webhook URL for pushing task/chat events to an external service (e.g. Clawdbot Gateway).
# Overrides the webhookUrl value in notification settings if set.
# VERITAS_WEBHOOK_URL=http://127.0.0.1:18789/webhook

# Secret for signing webhook payloads (HMAC-SHA256). Sent in X-Webhook-Signature header.
# VERITAS_WEBHOOK_SECRET=your-webhook-secret-here

# ═══════════════════════════════════════════════════════════════════════════════
# RATE LIMITING
# ═══════════════════════════════════════════════════════════════════════════════

# Max API requests per minute per IP (default: 300).
# Localhost is exempt from general rate limiting.
# Sensitive endpoints (auth, settings) have a stricter 15 req/min limit.
# RATE_LIMIT_MAX=300

# ═══════════════════════════════════════════════════════════════════════════════
# ROLE PERMISSIONS
# ═══════════════════════════════════════════════════════════════════════════════
#
# admin     - Full access to all endpoints
# agent     - Can read/write tasks, run agents, manage worktrees
# read-only - Can only GET endpoints (view tasks, read config)
#

# ═══════════════════════════════════════════════════════════════════════════════
# AUTHENTICATION METHODS
# ═══════════════════════════════════════════════════════════════════════════════
#
# 1. Authorization header (Bearer token)
#    curl -H "Authorization: Bearer your-api-key" http://localhost:3001/api/tasks
#
# 2. X-API-Key header
#    curl -H "X-API-Key: your-api-key" http://localhost:3001/api/tasks
#
# 3. Query parameter (for WebSocket)
#    ws://localhost:3001/ws?api_key=your-api-key
#

# Squad Chat Script Configuration
# VK_HOST=localhost    # Host for squad-post.sh (default: localhost)
# VK_PORT=3001         # Port for squad-post.sh (default: 3001)