.env.example

# VERONICA Environment Variables
# Copy this file to .env and fill in required values.
# Never commit .env to version control.

# ─── Authentication ────────────────────────────────────────────────────────────
# Required in production. Generate with:
#   python -c "import secrets; print(secrets.token_hex(32))"
VERONICA_API_KEY=

# Set to 1 to disable authentication entirely (development only, never in production).
# VERONICA_AUTH_DISABLED=1

# ─── Server ────────────────────────────────────────────────────────────────────
# Bind address. Defaults to 127.0.0.1.
# Use 0.0.0.0 only behind a reverse proxy with TLS.
# VERONICA_HOST=127.0.0.1

# Bind port. Defaults to 8000.
# VERONICA_PORT=8000

# ─── CORS ──────────────────────────────────────────────────────────────────────
# Comma-separated allowed origins, or * to allow all.
# When set to specific origins, credentials are enabled.
# When * or unset, credentials are disabled.
# VERONICA_CORS_ORIGINS=https://app.example.com,https://admin.example.com

# ─── PostgreSQL ────────────────────────────────────────────────────────────────
# Connection URL for the event store. Managed by docker-compose in the default setup.
# Change credentials before any network exposure.
# VERONICA_DATABASE_URL=postgresql://veronica:CHANGE_ME@localhost:5432/veronica

# ─── Policy Security ───────────────────────────────────────────────────────────
# When set, policy bundles are signed with HMAC-SHA256 using this key.
# STRONGLY RECOMMENDED in production. Omitting this silently disables
# bundle signature verification (policy_signature will be None).
# Must be at least 32 characters. Generate with:
#   python -c "import secrets; print(secrets.token_hex(32))"
# VERONICA_POLICY_SIGNING_KEY=

# When set to 1/true/yes, PUT /policies/{id} returns 403 (immutable mode).
# Use in production environments where runtime policy changes are forbidden.
# VERONICA_IMMUTABLE_CONFIG=1

# ─── Debug (development only) ──────────────────────────────────────────────────
# Set to 1 to include exception details in 500 responses. Never use in production.
# VERONICA_DEBUG=1