.env.example

# =====================================================================
# TraceRAG — full-stack environment template (docker-compose).
# Copy to .env and fill in. The real .env is gitignored.
# Values with a default (shown after `=`) are optional for a local run.
# =====================================================================

# ---- Postgres (the `db` service) ------------------------------------
# One instance, two isolated databases created by infra/postgres/init.sql.
POSTGRES_PASSWORD=tracerag

# Connection strings the app/worker use (host `db` on the compose network).
# Override only if you point at an external Postgres; defaults match compose.
CONTROL_PLANE_DATABASE_URL=postgresql://tracerag:tracerag@db:5432/control_plane_db
GRAPH_STORE_DATABASE_URL=postgresql://tracerag:tracerag@db:5432/graph_store_db
APP_DATABASE_URL=postgresql://tracerag:tracerag@db:5432/control_plane_db

# ---- Redis (the `redis` service) ------------------------------------
# Celery broker + result backend AND the ZSET debounce store.
REDIS_URL=redis://redis:6379/0

# ---- Tenancy / serving ----------------------------------------------
MULTI_TENANCY_ENABLED=True
DEFAULT_TENANT_ORG_ID=org_local_dev
POD_ID=pod-local-1            # this serving instance's identity (gateway routing)
POD_AGENT_ENABLED=1           # run the desired->loaded reconcile loop on the api pod

# Secret guarding POST /api/admin/onboarding/provision (X-Admin-Secret header).
# Unset => the endpoint is disabled (503). Use a long random value.
ADMIN_SECRET_KEY=change-me-to-a-long-random-string

# ---- Artifact storage ------------------------------------------------
# 'local' -> shared named volume (default, no AWS needed).
# 's3'     -> real bucket via boto3 (multipart upload/download).
TRACERAG_STORAGE_PROVIDER=local
TRACERAG_S3_BUCKET=
AWS_ACCESS_KEY_ID=
AWS_SECRET_ACCESS_KEY=
AWS_REGION=us-east-1

# ---- GitHub ingestion ------------------------------------------------
# A PAT (public-repo read is enough) to escape the unauthenticated rate limit.
# Empty -> the client falls back to its deterministic mock batch.
GITHUB_TOKEN=
# TRACERAG_GITHUB_MAX_ITEMS=100   # cap a first sync of a huge repo (recent history)

# ---- Secrets encryption (Fernet) -------------------------------------
# Encrypts per-tenant GitHub tokens at rest. REQUIRED once tenants connect via
# OAuth. Generate: python -c "from cryptography.fernet import Fernet; print(Fernet.generate_key().decode())"
ENCRYPTION_MASTER_KEY=

# ---- GitHub App: OAuth + webhooks ------------------------------------
GITHUB_CLIENT_ID=
GITHUB_CLIENT_SECRET=
GITHUB_OAUTH_REDIRECT_URI=http://localhost:8000/api/github/callback
GITHUB_OAUTH_SCOPES=repo read:org
# Signs the OAuth state (CSRF); falls back to ADMIN_SECRET_KEY if unset.
GITHUB_OAUTH_STATE_SECRET=
# Shared secret set on the GitHub webhook; verifies X-Hub-Signature-256.
GITHUB_WEBHOOK_SECRET=

# ---- LLMs ------------------------------------------------------------
OPENROUTER_API_KEY=sk-or-v1-your_key_here
# OPENROUTER_MODEL=anthropic/claude-3-haiku
GROQ_API_KEY=                 # latency-critical router intent call (optional)

# ---- Auth (Clerk) ----------------------------------------------------
# Set to enforce real auth; unset = dev-bypass (do NOT deploy unset).
CLERK_ISSUER=

# ---- Frontend / CORS -------------------------------------------------
CORS_ORIGINS=*                # lock to your frontend origin in production

# ---- Observability (optional) ---------------------------------------
# SENTRY_DSN=https://examplePublicKey@o0.ingest.sentry.io/0
# SENTRY_ENVIRONMENT=production
# SENTRY_TRACES_SAMPLE_RATE=0.1

# ---- Worker tuning (optional; sane defaults in worker/settings.py) ---
# TRACERAG_DEBOUNCE_WINDOW=120       # coalesce a burst of PRs (seconds)
# TRACERAG_DEBOUNCE_MAX_WAIT=600     # cap the slide so a hot org still compiles
# TRACERAG_SWEEP_INTERVAL=30         # beat sweep cadence
# TRACERAG_COMPILE_LOCK_TTL=1800     # per-org compile lock safety release