.env.example

# Dev environment for working ON katari (the runtime `dev` script and `docker compose` both read it):
#
#   cp .env.example .env
#   echo "KATARI_API_KEY=$(openssl rand -hex 32)"       >> .env
#   echo "KATARI_SECRET_KEY=$(openssl rand -base64 32)" >> .env
#
# That is the whole setup — everything else has a working default for `pnpm run dev`. When you use the
# CLI against this runtime, give it the same key: `export KATARI_API_KEY=…` (the CLI reads it from the
# environment), or pass it per-command.

# The API bearer token every caller must present. Required — the runtime refuses to boot without it.
KATARI_API_KEY=

# At-rest encryption key for secret values (base64, 32 bytes). Distinct from the API key above.
#
# KEEP THIS VALUE. Every stored secret and OAuth credential is sealed under it, so regenerating it makes
# them permanently unreadable. To rotate deliberately, put the new key here and move the old one to
# KATARI_SECRET_KEY_PREVIOUS (comma-separated for more than one) — new writes use the new key while old
# values keep opening.
KATARI_SECRET_KEY=
#KATARI_SECRET_KEY_PREVIOUS=

DATABASE_URL=postgres://katari:katari@localhost:5432/katari

# Blob bytes → the s3mock container from compose (mapped to localhost for the host-run dev runtime).
# The bucket is created on boot. Comment these out to use the in-memory store instead.
BLOB_S3_BUCKET=katari-blobs
BLOB_S3_ENDPOINT=http://localhost:9090
BLOB_S3_FORCE_PATH_STYLE=true
BLOB_S3_CREATE_BUCKET=true
AWS_ACCESS_KEY_ID=s3mock
AWS_SECRET_ACCESS_KEY=s3mock

# A program's outbound requests (`http.fetch`, MCP) may not reach loopback / private / link-local
# addresses, so that a url an LLM or a webhook chose cannot reach your internal network or the cloud
# metadata service. Local development is exactly the case where you DO want to fetch localhost.
KATARI_EGRESS_ALLOW_PRIVATE=true