.env.example

# Postil control plane configuration.
# Copy to .env and fill in. Web, worker, and monitor processes validate required values at boot
# and exit with the missing variable, its purpose, and an example.

# --- Database (required: web + worker + monitor) ---------------------------
# Postgres connection string. The bundled docker-compose provides this host.
DATABASE_URL=postgres://postil:postil@db:5432/postil
# Optional session or direct connection used only by release migrations.
# Hosted Supabase deployments derive port 5432 from a port-6543 pooler URL.
# POSTIL_DIRECT_DATABASE_URL uses the same PostgreSQL URL format as DATABASE_URL.
# Maximum Postgres connections per process. Start low on small hosted Postgres
# tiers and raise only if metrics show saturation.
POSTIL_DB_POOL_MAX=2

# --- Web sessions and webhooks (required: web) ------------------------------
# Canonical HTTPS origin for browser URLs and request telemetry behind proxies.
# Required in production. Use only an origin, with no path, query, or fragment.
# Local development can leave this unset and use the request origin.
#POSTIL_PUBLIC_URL=https://your-host

# HMAC key for signing session cookies. Generate: openssl rand -hex 32
POSTIL_SESSION_SECRET=

# Shared secret for GitHub webhook signature verification
# (X-Hub-Signature-256). Must match the secret on the GitHub App's webhook
# settings page. Generate: openssl rand -hex 32
GITHUB_WEBHOOK_SECRET=

# Optional iLert outbound alert receiver. Generate a random password with
# `openssl rand -hex 32`, set it here, and configure the iLert webhook URL as
# https://postil-ilert:<URL-encoded-password>@<your-host>/api/webhooks/ilert.
# Select alert-created, alert-assigned, alert-auto-escalated,
# alert-auto-resolved, alert-acknowledged, alert-rejected, alert-raised, and
# alert-resolved as trigger events. Leave unset to make the endpoint return 404.
POSTIL_ILERT_WEBHOOK_SECRET=

# Numeric GitHub ids allowed to use operator-only surfaces. The alert stream
# also requires a renewable `postil login` access token for an allowlisted id.
POSTIL_OPERATOR_GITHUB_IDS=

# GitHub OAuth app (dashboard sign-in; separate from the GitHub App).
# Callback URL must be: https://<your-host>/api/auth/callback
GITHUB_OAUTH_CLIENT_ID=
GITHUB_OAUTH_CLIENT_SECRET=

# --- GitHub App (required: worker) ------------------------------------------
# Numeric App id from the GitHub App settings page.
#
# Webhook event subscriptions to enable on the App (Settings > Permissions &
# events): Pull request and Check run/suite for reviews; Issue comment, Pull
# request review comment, and Issues for the interactive @postil bot. The bot
# also needs Issues: Read & write and Pull requests: Read & write to reply.
GITHUB_APP_ID=

# The App's private key. Raw PEM (multiline or \n-escaped) or base64-encoded
# PEM both work. Never logged, never stored in the database.
GITHUB_APP_PRIVATE_KEY=

# Public slug of the GitHub App (github.com/apps/<slug>), used for install
# links and to recognize App-authored review threads. Defaults to the hosted
# app's slug.
GITHUB_APP_SLUG=

# --- Secret sealing (required: web + worker) --------------------------------
# AES-256-GCM key sealing org BYOK credentials at rest. 32 bytes as 64 hex chars
# or base64. Generate: openssl rand -hex 32
POSTIL_SEALING_KEY=

# --- LLM defaults (optional: worker) ----------------------------------------
# Used when an organization has not configured its own BYOK settings.
# MODEL_API_KEY is preferred. Set POSTIL_API_KEY to the same value while
# pinned CLI images still read the legacy name during direct `postil doctor`.
MODEL_API_KEY=
POSTIL_API_KEY=
#OPENROUTER_API_KEY=
# Provider interface and base URL. Examples:
#   OpenRouter:    https://openrouter.ai/api/v1   (default)
#   Anthropic:     https://api.anthropic.com/v1
#   Azure OpenAI:  https://<resource>.openai.azure.com/openai/v1
#   Ollama:        http://ollama:11434/v1
POSTIL_API_FORMAT=openai-compatible
POSTIL_API_BASE=https://openrouter.ai/api/v1
# Required only for an intentional local/private endpoint such as Ollama.
#POSTIL_ALLOW_PRIVATE_API_BASE=1
# Optional private-gateway authentication, set as a pair.
#POSTIL_ENDPOINT_AUTH_HEADER=CF-Access-Client-Secret
#POSTIL_ENDPOINT_AUTH_VALUE=
REVIEW_MODEL=z-ai/glm-5.2
# Comma-separated fallbacks tried in order on provider errors.
REVIEW_MODEL_CASCADE=moonshotai/kimi-k2.7-code,deepseek/deepseek-v4-flash
# Maximum seconds for one model-provider request and for all model-provider
# requests in a review. Hosted defaults keep model work below the 10-minute
# review watchdog; raise only with a matching watchdog/drain budget change.
POSTIL_LLM_REQUEST_TIMEOUT_SECS=420
POSTIL_LLM_TOTAL_TIMEOUT_SECS=540

# --- Transactional email (optional: worker) ---------------------------------
# Transactional messages use Brevo's authenticated HTTPS REST API at
# https://api.brevo.com/v3/smtp/email. The path name does not permit SMTP
# transport. In Brevo, configure anonymous
# transactional-email tracking and the shortest suitable log-retention period.
# Anonymous tracking keeps aggregate open and click counts without linking them
# to contacts. Brevo does not expose a per-message tracking override in this API,
# and delivery remains enabled without that account-level setting.
BREVO_API_KEY=
POSTIL_EMAIL_FROM_EMAIL=reviews@mail.postil.dev
POSTIL_EMAIL_FROM_NAME=Postil
# Verified operator inbox for account, installation, billing, and service alerts.
POSTIL_OPERATOR_ALERT_EMAIL=

# --- Self-service billing (optional: web and worker) -----------------------
# Keep disabled until the Paddle product, recurring $0 base price, $6 active
# author price, verified webhook destination, and production monitor are ready.
POSTIL_PADDLE_BILLING_ENABLED=0
PADDLE_ENVIRONMENT=production
PADDLE_API_KEY=
PADDLE_WEBHOOK_SECRET=
PADDLE_CLIENT_TOKEN=
PADDLE_ZERO_BASE_PRICE_ID=
PADDLE_ACTIVE_AUTHOR_PRICE_ID=

# GitHub Enterprise Server: point both the worker and the spawned CLI at your
# instance's API (one variable covers both). Leave unset for github.com.
# GITHUB_API_URL=https://github.example.com/api/v3

# --- Worker (optional) -------------------------------------------------------
# Path to the postil CLI binary. The Docker image bakes it at
# /usr/local/bin/postil; for bare-metal dev it defaults to `postil` on PATH.
# The web process also uses this when POSTIL_WEBHOOK_DRAIN_ENABLED=1.
POSTIL_BIN=/usr/local/bin/postil
# Concurrent review slots (default 4).
WORKER_CONCURRENCY=4
# Review and respond jobs one organization may run at once, which reduces how
# much of the fleet a single busy organization occupies (default 2). The cap is
# best-effort, so it can be exceeded by up to the number of concurrent claim
# loops. Set 0 to remove the limit.
WORKER_PER_ORG_CONCURRENCY=2
# Initial idle poll interval (default 1000).
WORKER_POLL_INTERVAL_MS=1000
# Maximum idle poll interval. On free-tier managed Postgres, use 900000
# (15 minutes) with WORKER_CONCURRENCY=1 so idle periods stay quiet.
WORKER_IDLE_POLL_MAX_MS=900000
# Watchdog cadence. Keep it aligned with the idle max poll for free-tier
# managed Postgres; lower values intentionally keep the database warmer.
WORKER_WATCHDOG_INTERVAL_MS=900000
WORKER_WEBHOOK_REDELIVERY_INTERVAL_MS=900000
# Required when the private monitor is enabled. Leave unset otherwise so an
# idle self-hosted worker can scale database traffic down.
# WORKER_HEARTBEAT_INTERVAL_MS=30000
# Wait this long for active jobs before interrupting and requeueing them.
WORKER_SHUTDOWN_DRAIN_MS=10000
# Allow interrupted review handlers to persist terminal state and cleanup work.
WORKER_SHUTDOWN_SETTLE_MS=15000
# Directory for transient baseline files (default .cache).
POSTIL_CACHE_DIR=.cache

# --- Private monitor (optional self-hosted profile) --------------------------
# Start with: docker compose --profile monitoring up -d
# Requires POSTIL_PUBLIC_URL, POSTIL_OPERATOR_ALERT_EMAIL, BREVO_API_KEY, and
# WORKER_HEARTBEAT_INTERVAL_MS. Results remain in Postgres and /operator.
# OpenRouter cap monitoring activates when its management key and all three
# private key-name bindings are present. Missing or rejected configuration
# opens one private incident without stopping other monitor checks.
POSTIL_MONITOR_INTERVAL_MS=300000
POSTIL_MONITOR_ALERT_STATE_PATH=/var/lib/postil-monitor/alert-state.json
# OPENROUTER_MANAGEMENT_API_KEY=
# POSTIL_OPENROUTER_DEVELOPMENT_KEY_NAME=
# POSTIL_OPENROUTER_PRODUCTION_KEY_NAME=
# POSTIL_OPENROUTER_EMERGENCY_KEY_NAME=
# Defaults to the checked-in maximum hosted review reservation ($1).
POSTIL_OPENROUTER_REVIEW_OUTAGE_THRESHOLD_USD=1

# --- Free-tier queue profile (optional: web) -------------------------------
# Let webhook requests kick a bounded queue drain in the web process. This
# keeps reviews responsive while the worker uses a long idle fallback poll.
POSTIL_WEBHOOK_DRAIN_ENABLED=1
POSTIL_QUEUE_DRAIN_MAX_JOBS=1
POSTIL_QUEUE_DRAIN_DEADLINE_MS=720000

# --- Observability (optional: web, worker, and monitor) ---------------------
# Bearer token protecting GET /api/metrics (Prometheus text format).
# Metrics are disabled when unset. Generate: openssl rand -hex 24
METRICS_TOKEN=
# Legacy deployments may set METRICS_API_KEY instead; METRICS_TOKEN wins when both are set.
METRICS_API_KEY=

# PostHog browser analytics and server-side request telemetry. The project token
# is returned at runtime only when browser capture is enabled. Do not put a
# personal API key here. Enable Cookieless server hash mode and IP discard in
# the PostHog project before enabling browser capture.
# Use https://us.i.posthog.com instead if the PostHog project is on US Cloud.
POSTHOG_PROJECT_TOKEN=
NEXT_PUBLIC_POSTHOG_HOST=https://eu.i.posthog.com
# Set to 0 to disable server-side request telemetry while keeping browser analytics.
POSTHOG_SERVER_CAPTURE=1
# Set to 0 to disable browser analytics. Enabled capture is cookieless, stores
# nothing in browser persistence, honors DNT/GPC, and covers public pages only.
POSTHOG_CLIENT_CAPTURE=1
# Scrubbed server-only operational telemetry is opt-in. Configure PostHog
# billing caps, rate limits, alerts, and log drop rules before enabling it.
POSTHOG_ERROR_CAPTURE=0
POSTHOG_LOG_CAPTURE=0
POSTHOG_LOG_INFO_SAMPLE_RATE=0.01
POSTHOG_LOG_WARN_SAMPLE_RATE=0.1
POSTHOG_LOG_MAX_PER_MINUTE=60
POSTHOG_ERROR_MAX_PER_HOUR=10
# Optional 7-40 character hexadecimal commit SHA for release correlation.
POSTIL_RELEASE_SHA=