# OpenCodeHub Configuration
# ============================================================
# Copy this file to .env and configure your settings.
# For production, run: bash scripts/prod-setup.sh
# ============================================================

# ── Server Configuration ─────────────────────────────────────
HOST=0.0.0.0
PORT=4321
SITE_URL=http://localhost:4321
APP_NAME=OpenCodeHub

# ── Database Configuration ───────────────────────────────────
# Supported drivers: postgres (required for production), sqlite (dev only), turso (libsql)
# IMPORTANT: All schemas use pgTable — PostgreSQL is REQUIRED for production
DATABASE_DRIVER=postgres
DATABASE_URL=postgresql://opencodehub:opencodehub@localhost:5432/opencodehub
# Connection pool size (default: 10, increase for high traffic)
DATABASE_POOL_SIZE=10
# PostgreSQL SSL (enable when connecting to remote/cloud databases)
DATABASE_SSL=false
DATABASE_SSL_REJECT_UNAUTHORIZED=true

# ── PostgreSQL Credentials (for Docker Compose) ─────────────
# CRITICAL: Change these for production! Generate with: openssl rand -base64 24
POSTGRES_USER=opencodehub
POSTGRES_PASSWORD=change-me-in-production
POSTGRES_DB=opencodehub

# ── Redis Configuration ─────────────────────────────────────
# Required in production for distributed locking, rate limiting, sessions
# CRITICAL: Change the password for production!
REDIS_URL=redis://localhost:6379
REDIS_PASSWORD=change-me-in-production

# Upstash Redis (for Vercel/edge deployments):
# UPSTASH_REDIS_REST_URL=https://your-redis.upstash.io
# UPSTASH_REDIS_REST_TOKEN=your-token

# ── Authentication ───────────────────────────────────────────
# CRITICAL: Generate with: openssl rand -base64 32
JWT_SECRET=change-this-to-a-very-long-random-secret-key-in-production
JWT_EXPIRES_IN=7d
# CRITICAL: Generate with: openssl rand -base64 32
SESSION_SECRET=change-this-session-secret-too

# ── Security Secrets (CRITICAL for production) ──────────────
# All must be unique. Generate each with: openssl rand -hex 32
# Protects git hooks from unauthorized access
INTERNAL_HOOK_SECRET=change-this-internal-hook-secret-in-production
# Protects cron endpoints (gc, mirror sync, etc.)
CRON_SECRET=change-this-cron-secret-in-production
# Encryption key for AI provider keys at rest
AI_CONFIG_ENCRYPTION_KEY=change-this-ai-config-encryption-key-in-production
# Encryption key for workflow/repo secrets at rest
WORKFLOW_SECRET_ENCRYPTION_KEY=change-this-workflow-secret-encryption-key-in-production
# Shared secret between server and CI runners
RUNNER_SECRET=change-this-runner-secret-in-production

# ── OAuth Providers (optional) ──────────────────────────────
OAUTH_GOOGLE_CLIENT_ID=
OAUTH_GOOGLE_CLIENT_SECRET=
OAUTH_GITHUB_CLIENT_ID=
OAUTH_GITHUB_CLIENT_SECRET=
OAUTH_GITLAB_CLIENT_ID=
OAUTH_GITLAB_CLIENT_SECRET=

# ── Git Configuration ───────────────────────────────────────
GIT_REPOS_PATH=./data/repositories
GIT_SSH_PORT=2222
GIT_SSH_HOST_KEY=./data/ssh/host_key
SSH_PORT=2222

# ── Storage Configuration ───────────────────────────────────
# Supported backends: local, s3
STORAGE_TYPE=local
STORAGE_PATH=./data/storage

# NAS / dedicated-disk deployments (docker-compose.nas.yml):
# Point every data directory at your NAS mount or dedicated disk.
# OCH_DATA_DIR=/mnt/nas/opencodehub
# STORAGE_PATH=./data/storage  # or /mnt/nas/opencodehub/storage with local driver

# S3 Configuration (required when STORAGE_TYPE=s3)
# Works with AWS S3, MinIO, Cloudflare R2, Garage, SeaweedFS,
# Ceph RGW, Wasabi, Backblaze B2, etc.
STORAGE_BUCKET=
STORAGE_REGION=us-east-1
STORAGE_ENDPOINT=
STORAGE_ACCESS_KEY_ID=
STORAGE_SECRET_ACCESS_KEY=

# ── CI/CD Runner Configuration ──────────────────────────────
RUNNER_ENABLED=true
RUNNER_DOCKER_SOCKET=/var/run/docker.sock
RUNNER_WORKSPACE_PATH=./data/runner/workspaces
RUNNER_ARTIFACTS_PATH=./data/runner/artifacts
RUNNER_CONCURRENT_JOBS=2
RUNNER_TIMEOUT=3600
RUNNER_REGISTRATION_TOKEN_TTL_DAYS=90

# ── Email Configuration (optional) ──────────────────────────
SMTP_HOST=
SMTP_PORT=587
SMTP_USER=
SMTP_PASSWORD=
SMTP_FROM=noreply@opencodehub.local

# ── Logging ─────────────────────────────────────────────────
LOG_LEVEL=info
LOG_FILE=./data/logs/opencodehub.log

# ── Rate Limiting ───────────────────────────────────────────
RATE_LIMIT_ENABLED=true
RATE_LIMIT_AUTH=5          # Auth endpoints: 5 req/15min
RATE_LIMIT_API=100         # API endpoints: 100 req/min
RATE_LIMIT_GIT=200         # Git operations: 200 req/min
RATE_LIMIT_GENERAL=60      # General: 60 req/min
RATE_LIMIT_SKIP_DEV=false
CSRF_SKIP_DEV=false

# ── CORS ────────────────────────────────────────────────────
ALLOWED_ORIGINS=http://localhost:4321

# ── Request Limits ──────────────────────────────────────────
# Maximum request body size in MB (default: 10)
MAX_REQUEST_BODY_MB=10
# Maximum git pack file size in MB (default: 500)
MAX_PACK_SIZE_MB=500
# Timeout for git processes in seconds (default: 300)
GIT_PROCESS_TIMEOUT_SECS=300

# ── Feature Flags ───────────────────────────────────────────
ENABLE_REGISTRATION=true
ENABLE_WIKI=true
ENABLE_ISSUES=true
ENABLE_ACTIONS=true
ENABLE_PACKAGES=false
ENABLE_AI_ASSISTANT=true

# ── AI Providers (optional) ─────────────────────────────────
OPENAI_API_KEY=
ANTHROPIC_API_KEY=
GROQ_API_KEY=
BYTEZ_API_KEY=
OPENROUTER_API_KEY=
TOGETHER_API_KEY=
GOOGLE_AI_API_KEY=

# ── External Review Agent (optional) ────────────────────────
EXTERNAL_AGENT_WEBHOOK_URL=
EXTERNAL_AGENT_API_KEY=
EXTERNAL_AGENT_CALLBACK_SECRET=

# ── Backup Configuration ────────────────────────────────────
# Generate with: openssl rand -hex 32
BACKUP_ENCRYPTION_KEY=
BACKUP_S3_BUCKET=
BACKUP_S3_PREFIX=opencodehub-backups
BACKUP_RETENTION_DAYS=30
BACKUP_DIR=./backups

# ── Air-gapped / Offline Mode ──────────────────────────────
AIR_GAPPED_MODE=false

# ── Observability (optional) ────────────────────────────────
# Bearer token protecting GET /api/metrics (Prometheus). Empty = public in
# non-production; denied with 403 in production when empty.
# Production requires METRICS_TOKEN to be set.
METRICS_TOKEN=

# Grafana Cloud OTLP
GRAFANA_OTLP_ENDPOINT=
GRAFANA_INSTANCE_ID=
GRAFANA_API_KEY=