# OpenCodeHub Configuration
# Copy this file to .env and configure your settings

# Server Configuration
HOST=0.0.0.0
PORT=3000
SITE_URL=http://localhost:3000
APP_NAME=OpenCodeHub

# Database Configuration
# Supported drivers: sqlite, postgres, mysql, mongodb, turso, planetscale, redis, firestore, dynamodb, neo4j, cockroachdb, cassandra, scylladb, surrealdb, tidb
DATABASE_DRIVER=sqlite
DATABASE_URL=./data/opencodehub.db

# PostgreSQL example:
# DATABASE_DRIVER=postgres
# DATABASE_URL=postgresql://user:password@localhost:5432/opencodehub
# DATABASE_SSL=true
# DATABASE_SSL_REJECT_UNAUTHORIZED=true

# MySQL example:
# DATABASE_DRIVER=mysql
# DATABASE_URL=mysql://user:password@localhost:3306/opencodehub

# MongoDB example:
# DATABASE_DRIVER=mongodb
# DATABASE_URL=mongodb://localhost:27017/opencodehub

# Turso example (Recommended for Vercel):
# DATABASE_DRIVER=turso
# DATABASE_URL=libsql://your-database.turso.io
# DATABASE_AUTH_TOKEN=your-auth-token

# Upstash Redis (Required for Vercel Sessions):
UPSTASH_REDIS_REST_URL=https://your-redis.upstash.io
UPSTASH_REDIS_REST_TOKEN=your-token

# Redis example (Self-hosted):
# DATABASE_DRIVER=redis
# DATABASE_URL=redis://localhost:6379
# Required in production for distributed locking and rate limiting:
REDIS_URL=redis://localhost:6379

# Neo4j example:
# DATABASE_DRIVER=neo4j
# DATABASE_URL=bolt://localhost:7687
# DATABASE_USER=neo4j
# DATABASE_PASSWORD=password

# Authentication
JWT_SECRET=change-this-to-a-very-long-random-secret-key-in-production
JWT_EXPIRES_IN=7d
SESSION_SECRET=change-this-session-secret-too

# Internal Hook Security (CRITICAL for production)
# This secret protects git hooks from unauthorized access
# Generate with: openssl rand -hex 32
INTERNAL_HOOK_SECRET=change-this-internal-hook-secret-in-production
# CRITICAL: Secret for cron endpoints (gc, mirror sync, etc.)
# Generate with: openssl rand -hex 32
CRON_SECRET=change-this-cron-secret-in-production
# CRITICAL: Encryption key for sensitive config blobs (AI provider keys, etc.)
# Generate with: openssl rand -hex 32
AI_CONFIG_ENCRYPTION_KEY=change-this-ai-config-encryption-key-in-production
# CRITICAL: Encryption key for workflow/repo secrets at rest.
# Generate with: openssl rand -hex 32
WORKFLOW_SECRET_ENCRYPTION_KEY=change-this-workflow-secret-encryption-key-in-production

# OAuth Providers (optional)
OAUTH_GOOGLE_CLIENT_ID=
OAUTH_GOOGLE_CLIENT_SECRET=
OAUTH_GITHUB_CLIENT_ID=
OAUTH_GITHUB_CLIENT_SECRET=
OAUTH_GITLAB_CLIENT_ID=
OAUTH_GITLAB_CLIENT_SECRET=

# Git Configuration
GIT_REPOS_PATH=./data/repositories
GIT_SSH_PORT=2222
GIT_SSH_HOST_KEY=./data/ssh/host_key

# Storage Configuration
# Supported: local, s3, gcs, azure, dropbox, gdrive, ftp, rclone
STORAGE_DRIVER=local
STORAGE_PATH=./data/storage

# S3 Configuration (if STORAGE_DRIVER=s3)
S3_BUCKET=
S3_REGION=
S3_ACCESS_KEY=
S3_SECRET_KEY=
S3_ENDPOINT=

# Google Cloud Storage (if STORAGE_DRIVER=gcs)
GCS_BUCKET=
GCS_PROJECT_ID=
GCS_KEY_FILE=

# FTP Configuration (if STORAGE_DRIVER=ftp)
FTP_HOST=
FTP_PORT=21
FTP_USER=
FTP_PASSWORD=

# Rclone Configuration (if STORAGE_DRIVER=rclone)
RCLONE_REMOTE=
RCLONE_CONFIG_PATH=

# CI/CD Runner Configuration
RUNNER_ENABLED=true
RUNNER_DOCKER_SOCKET=/var/run/docker.sock
RUNNER_WORKSPACE_PATH=./data/runner/workspaces
RUNNER_ARTIFACTS_PATH=./data/runner/artifacts
RUNNER_CONCURRENT_JOBS=2
RUNNER_TIMEOUT=3600
# CRITICAL: Secret shared between server and runners. Must be the same.
# Generate with: openssl rand -hex 32
RUNNER_SECRET=change-this-runner-secret-in-production
# Registration token validity period (days) before rotation is required.
RUNNER_REGISTRATION_TOKEN_TTL_DAYS=90

# Email Configuration (optional)
SMTP_HOST=
SMTP_PORT=587
SMTP_USER=
SMTP_PASSWORD=
[email protected]

# Logging
LOG_LEVEL=info
LOG_FILE=./data/logs/opencodehub.log

# Security
RATE_LIMIT_ENABLED=true
# Authentication endpoints (login/register) - 5 requests per 15 minutes
RATE_LIMIT_AUTH=5
# API endpoints - 100 requests per minute
RATE_LIMIT_API=100
# Git operations - 200 requests per minute
RATE_LIMIT_GIT=200
# General requests - 60 per minute
RATE_LIMIT_GENERAL=60
# Skip rate limiting in development (not recommended)
RATE_LIMIT_SKIP_DEV=false
# Skip CSRF protection in development (not recommended)
CSRF_SKIP_DEV=false

# Features
ENABLE_REGISTRATION=true
ENABLE_WIKI=true
ENABLE_ISSUES=true
ENABLE_ACTIONS=true
ENABLE_PACKAGES=false
ENABLE_AI_ASSISTANT=true

# AI Providers (optional)
# Used by /settings/ai and AI review jobs.
OPENAI_API_KEY=
ANTHROPIC_API_KEY=
GROQ_API_KEY=
BYTEZ_API_KEY=
OPENROUTER_API_KEY=
TOGETHER_API_KEY=
GOOGLE_AI_API_KEY=

# External review agent integration (CodeRabbit-like)
# Outbound webhook used by provider "external_agent"
EXTERNAL_AGENT_WEBHOOK_URL=
# Optional bearer token for outbound webhook auth
EXTERNAL_AGENT_API_KEY=
# Required for authenticated callbacks from external agent.
# Falls back to INTERNAL_HOOK_SECRET when omitted.
EXTERNAL_AGENT_CALLBACK_SECRET=

# Air-gapped / offline mode
# When true, all outbound third-party integrations are blocked at runtime.
AIR_GAPPED_MODE=false