.env.example

# Server Configuration
PORT="3000"
NODE_ENV="development"
LOG_LEVEL="info"

# Security
# Required (production): 32-byte hex string for encrypting API keys stored in the database.
# Generate with: node -e "console.log(require('crypto').randomBytes(32).toString('hex'))"
ENCRYPTION_KEY="replace_with_32_byte_hex_string"

# Required (production): Secret for signing JWT tokens.
# In development, a random per-process secret is generated automatically.
# Generate with: node -e "console.log(require('crypto').randomBytes(32).toString('hex'))"
JWT_SECRET="replace_with_a_strong_random_string"

# Required (production): SQLCipher key for encrypting the SQLite database at rest.
# Generate with: node -e "console.log(require('crypto').randomBytes(32).toString('hex'))"
SQLITE_ENCRYPTION_KEY="replace_with_a_sqlcipher_key"

# CORS: Comma-separated list of allowed origins.
# In development, defaults to http://localhost:3000,http://processace.local:3000
# In production, this MUST be set to your actual domain(s).
# CORS_ALLOWED_ORIGINS="https://your-domain.com"

# Redis (for local development without Docker)
# REDIS_HOST="localhost"
# REDIS_PORT="6379"

# Redis password (required for the Docker Compose stack)
# Generate with: node -e "console.log(require('crypto').randomBytes(24).toString('hex'))"
# REDIS_PASSWORD="replace_with_a_strong_random_string"

# TLS overlay (required when using docker-compose.tls.yml)
# CADDY_HOST="processace.example.com"
# CADDY_EMAIL="ops@example.com"

# Dev/Testing
# Set to 'true' to use the internal mock provider (generates dummy BPMN without calling an API)
MOCK_LLM="false"

# Upload Limits
# Maximum upload size in megabytes. Defaults to 100 if unset.
# MAX_UPLOAD_SIZE_MB="100"

# SQLite (Docker on Windows/Mac/WSL2)
# Uncomment to disable WAL mode and avoid SQLITE_IOERR_SHMOPEN errors on Docker volumes.
# DISABLE_SQLITE_WAL="true"

# The default database path is:
# - data/processAce-dev.db in development and test
# - data/processAce.db in production
# Existing plaintext production databases are not auto-migrated to SQLCipher.

# Ollama
# The base Docker stack is cloud-only by default and does NOT start a bundled Ollama container.
# Use one of these modes when you actually want local models:
#
# 1. Bundled Docker Ollama:
#    docker compose -f docker-compose.yml -f docker-compose.ollama.yml up -d --build
#
# 2. Bundled Docker Ollama + Linux AMD ROCm:
#    docker compose -f docker-compose.yml -f docker-compose.ollama.yml -f docker-compose.ollama-amd.yml up -d --build
#
# 3. Host-installed Ollama:
#    docker compose up -d --build
#    and set the variables below for the host endpoint.
#
# Deployment switch for the app -> Ollama OpenAI-compatible endpoint.
# Bundled Docker Ollama override:    http://ollama:11434/v1
# Host-installed Ollama from Docker: http://host.docker.internal:11434/v1
# Non-Docker local app:              http://localhost:11434/v1
# OLLAMA_BASE_URL_DEFAULT="http://ollama:11434/v1"

# Deployment switch for native Ollama management calls such as /api/pull.
# Bundled Docker Ollama override:    http://ollama:11434
# Host-installed Ollama from Docker: http://host.docker.internal:11434
# Non-Docker local app:              http://localhost:11434
# OLLAMA_PULL_HOST="http://ollama:11434"

# Windows + AMD fallback:
# Run Ollama on the Windows host and set both variables above to host.docker.internal.

# NOTE: LLM API keys (OpenAI, Google GenAI, Anthropic) are configured via the
# App Settings page (/app-settings.html) and stored encrypted in the database.
# They are NOT configured via environment variables.