# briven self-host — copy to `.env` and fill in.
# Generate secrets with `openssl rand -hex 32`.
#
# Post ADR-0002 the platform runs on TWO database engines, so there are
# TWO distinct database passwords below — do not reuse one for the other.

# ─── Domain ──────────────────────────────────────────────────────────────
# Domain you own. The compose creates Traefik routes for:
#   ${BRIVEN_DOMAIN}            — dashboard (web)
#   api.${BRIVEN_DOMAIN}       — control plane (api)
#   realtime.${BRIVEN_DOMAIN}  — realtime websocket/poll service
#   docs.${BRIVEN_DOMAIN}      — docs
#   status.${BRIVEN_DOMAIN}    — status page (same container as docs)
#   s3.${BRIVEN_DOMAIN}        — public MinIO S3 endpoint
BRIVEN_DOMAIN=briven.example.com

# ─── Required secrets — 32+ chars each ──────────────────────────────────
BRIVEN_BETTER_AUTH_SECRET=__set_me__32_plus_chars__
BRIVEN_AUDIT_IP_PEPPER=__set_me__32_plus_chars__
BRIVEN_ENCRYPTION_KEY=__set_me__32_plus_chars__
BRIVEN_RUNTIME_SHARED_SECRET=__set_me__32_plus_chars__

# ─── Database passwords (TWO engines, two passwords) ────────────────────
# Control plane — stock Postgres (pgvector image). Holds users, orgs,
# projects, billing, secrets, auth. Used in BRIVEN_DATABASE_URL.
BRIVEN_POSTGRES_PASSWORD=__set_me_strong__

# Data plane — DoltGres (git-for-data, Postgres-wire). One database per
# customer project. Used in BRIVEN_DATA_PLANE_URL (api/runtime/realtime).
BRIVEN_DOLTGRES_PASSWORD=__set_me_strong__

# ─── Object storage (MinIO) ─────────────────────────────────────────────
# MinIO root password = the S3 secret key the api signs upload URLs with.
BRIVEN_MINIO_ROOT_PASSWORD=__set_me_strong__
# Optional — bucket name + region (defaults shown).
# BRIVEN_MINIO_BUCKET=briven
# BRIVEN_MINIO_REGION=us-east-1

# ─── Data-plane backup ──────────────────────────────────────────────────
# How often the dolt-backup sidecar snapshots every DoltGres database into
# the doltgres_backups volume (seconds). Default = once a day.
# BRIVEN_BACKUP_INTERVAL_SECONDS=86400

# ─── mittera.eu transactional email (optional) ──────────────────────────
# API_URL + API_KEY are required for outbound POST /api/v1/emails (Bearer).
# WEBHOOK_SECRET only needed if mittera posts delivery/bounce events back.
# Until set, magic-link emails print to the api container stdout.
# Webhook URL to register on mittera: https://api.${BRIVEN_DOMAIN}/mittera-webhook
# BRIVEN_MITTERA_API_URL=https://api.mittera.eu
# BRIVEN_MITTERA_API_KEY=...
# BRIVEN_MITTERA_WEBHOOK_SECRET=whsec_...

# ─── OAuth sign-in (all optional) ───────────────────────────────────────
# Each provider's button only shows in the UI when its CLIENT_ID is set.
# Google:  redirect URI https://api.${BRIVEN_DOMAIN}/v1/auth/callback/google
# BRIVEN_GOOGLE_CLIENT_ID=...
# BRIVEN_GOOGLE_CLIENT_SECRET=...
# BRIVEN_GITHUB_CLIENT_ID=...
# BRIVEN_GITHUB_CLIENT_SECRET=...
# BRIVEN_KONNOS_CLIENT_ID=...
# BRIVEN_KONNOS_CLIENT_SECRET=...
# BRIVEN_KONNOS_ISSUER=https://code.konnos.org
# BRIVEN_DISCORD_CLIENT_ID=...
# BRIVEN_DISCORD_CLIENT_SECRET=...

# ─── In-platform LLM (optional, Ollama-compatible) ──────────────────────
# BRIVEN_OLLAMA_URL=
# BRIVEN_OLLAMA_API_KEY=
# BRIVEN_OLLAMA_MODEL=qwen2.5-coder:32b

# ─── Billing (Polar — optional, skip for self-host) ─────────────────────
# BRIVEN_POLAR_ACCESS_TOKEN=...
# BRIVEN_POLAR_WEBHOOK_SECRET=...
# BRIVEN_POLAR_PRO_PRODUCT_ID=...
# BRIVEN_POLAR_TEAM_PRODUCT_ID=...

# ─── Public open signups ────────────────────────────────────────────────
# Default false = invite-only. Flip to true for a fully public instance.
BRIVEN_OPEN_SIGNUPS=false