# ============================================================
# Veritas Kanban — Environment Variables
# ============================================================
# Copy this file to server/.env and fill in the values.
#   cp .env.example server/.env
#
# Variables marked [REQUIRED] must be set or the server will
# refuse to start. All others have sensible defaults.
# ============================================================

# ── Server ───────────────────────────────────────────────────
# Port the HTTP server listens on (default: 3001)
# PORT=3001

# Node environment: development | production | test
# Controls CSP strictness, logging format, static file serving
# NODE_ENV=development

# ── Security [REQUIRED] ─────────────────────────────────────
# Admin API key — grants full access to all endpoints.
# Generate one with: node -e "console.log(require('crypto').randomBytes(32).toString('hex'))"
VERITAS_ADMIN_KEY=

# JWT secret for auth token signing/verification.
# If omitted the server auto-generates one (tokens won't survive restarts).
# Generate one with: node -e "console.log(require('crypto').randomBytes(64).toString('hex'))"
# VERITAS_JWT_SECRET=

# Enable/disable authentication middleware (default: true)
# Set to "false" only for local development without auth
# VERITAS_AUTH_ENABLED=true

# Allow localhost requests to bypass authentication (default: false)
# SECURITY: Keep this disabled unless you explicitly need local bypass for development.
# VERITAS_AUTH_LOCALHOST_BYPASS=false

# Role assigned to localhost-bypass connections: admin | agent | read-only
# Recommended (if bypass is enabled): read-only
# VERITAS_AUTH_LOCALHOST_ROLE=read-only

# Additional API keys (comma-separated, format: name:key:role,name:key:role)
# Example: ci:vk_xxx:agent,readonly-bot:vk_yyy:read-only
# VERITAS_API_KEYS=

# ── Data ─────────────────────────────────────────────────────
# Root directory for persistent data (tasks, config, telemetry).
# Default: <cwd>/.veritas-kanban
# VERITAS_DATA_DIR=

# Storage backend and optional SQLite location.
# VERITAS_STORAGE=file
# VERITAS_SQLITE_PATH=

# Required only for governed SQLite DELETE compatibility or expert override mode.
# Use a stable, unique value for this host; do not reuse it on another machine.
# VERITAS_SQLITE_TOPOLOGY=single-host
# VERITAS_SQLITE_HOST_ID=replace-with-stable-host-identity

# ── CORS ─────────────────────────────────────────────────────
# Comma-separated list of allowed origins for CORS and WebSocket.
# Default (dev): http://localhost:5173,http://localhost:3000,
#                http://127.0.0.1:5173,http://127.0.0.1:3000
# CORS_ORIGINS=http://localhost:5173,http://localhost:3000

# Optional operator HTTP proxy for selective run-scoped egress.
# Destination policy is still evaluated and the pinned IP is sent through CONNECT.
# Credentials are held in memory and are not persisted in launch or telemetry evidence.
# VERITAS_EGRESS_UPSTREAM_PROXY=http://proxy-user:proxy-password@proxy.internal:3128

# ── Logging ──────────────────────────────────────────────────
# Pino log level: fatal | error | warn | info | debug | trace | silent
# LOG_LEVEL=info

# ── Content Security Policy ─────────────────────────────────
# Use report-only mode (log violations without blocking)
# CSP_REPORT_ONLY=false

# URL to receive CSP violation reports (e.g., https://example.com/csp-report)
# CSP_REPORT_URI=

# ── Rate Limiting ────────────────────────────────────────────
# Maximum requests per rate-limit window (default: 300)
# RATE_LIMIT_MAX=300

# ── Telemetry ────────────────────────────────────────────────
# Days to retain raw telemetry events
# TELEMETRY_RETENTION_DAYS=30

# Days after which telemetry is compressed
# TELEMETRY_COMPRESS_DAYS=7

# Prometheus /metrics exposure
# In production, /metrics requires normal auth with telemetry:read unless one of these is set.
# PROMETHEUS_METRICS_TOKEN=
# PROMETHEUS_METRICS_PUBLIC=false

# ── External Services ────────────────────────────────────────
# OpenClaw gateway URL (default: http://127.0.0.1:18789) and optional bearer token.
# OPENCLAW_GATEWAY_URL=http://127.0.0.1:18789
# OPENCLAW_GATEWAY_TOKEN=

# Optional operator-declared OpenClaw version hint for provider runtime manifests.
# This does not count as runtime-verified evidence; host registration must verify it.
# OPENCLAW_GATEWAY_VERSION=

# Legacy gateway URL alias.
# CLAWDBOT_GATEWAY=http://127.0.0.1:18789