.env.default

#################
# CONFIGURATION #
#################

DATABASE_HOST=localhost
DATABASE_PORT=5432
HBPE_HOST=http://localhost:8002
HOSTNAME="ci-server.localhost"
APP_PUBLIC_HOSTNAME="ci-server.localhost"
OAUTH_CALLBACK_URL="https://memory.local.companionintelligence.com/oauth/callback"
OBJECT_STORE_URL=http://localhost:9000
OIDC_ISSUER_URL=http://localhost:8506
# Public origin of this app, injected by CI-Hub (APP_BASE_URL). Used to build the
# OIDC redirect_uri; when unset the callback falls back to the inbound request host.
APP_BASE_URL=
OLLAMA_HOST=http://localhost:11434
# The embedding endpoint, the sibling of LLM_API_BASE: an OpenAI-style base or a
# bare host on any engine. Leave unset to embed on the chat backend when it
# serves the embedder, else on OLLAMA_HOST. CI Hub injects it. (OLLAMA_EMBED_HOST
# is the deprecated name and is still read.)
LLM_EMBEDDING_API_BASE=
# Document-parser API in the summary container (host 8003 -> container 8002;
# see docker-compose.local.yml — host 8002 is taken by the HBPE service).
PARSER_HOST=http://localhost:8003
# Where `make dev`'s API and Vite dev server listen. Unset, both answer this
# machine only (127.0.0.1), except the API on Linux, which keeps 0.0.0.0 so the
# HBPE and Summary containers can call it back through the docker bridge. Set
# 0.0.0.0 to test from a phone on the LAN or over the tailnet.
# DEV_LISTEN_HOST=0.0.0.0

###########
# SECRETS #
###########
#
# The values below are PLACEHOLDERS, not working credentials. They keep the
# format and length the code expects (so `make dev` and the e2e suite still run
# against throwaway local containers), but every one of them is a
# `replace-me-...` string that is obviously not a real key. `make init` replaces
# each `replace-me-...` value with a random one when it creates `.env`
# (scripts/dev-stack/env-secrets.ts), `make tunnel` refuses to run while any is
# left, and the API refuses to boot on one in production mode.
#
# This file used to ship real generated secrets. They were removed because
# `.env.default` is a committed file: anything in it is readable by everyone
# with repo access, forever, and is still present in git history.
#
# HOW TO GET REAL VALUES
#
#   Appliance / any real deployment
#     You do not set these by hand. `infrastructure/setup-secrets/entrypoint.sh`
#     generates a unique set on first boot into the shared secrets file
#     ($SECRETS_FILE, default /run/secrets/.env.secrets), and each service's
#     entrypoint loads them from there. CI-Hub injects the rest at install time.
#     Shell env > secrets file > fail, so a stray value here never wins.
#
#   Local development
#     The placeholders are fine for ordinary local work. If you need real
#     entropy locally, generate your own into `.env` (which is gitignored) and
#     never copy them back here:
#
#       # 64-char hex — required format for AUTH_FIELD_ENCRYPTION_KEY
#       openssl rand -hex 32
#       # any high-entropy string — the token/pepper/CSRF/PowerSync secrets
#       openssl rand -base64 48
#       # PS_JWT_SECRET_B64URL must stay in sync with POWERSYNC_JWT_SECRET:
#       printf '%s' "$POWERSYNC_JWT_SECRET" | basenc --base64url -w 0 | tr -d '='
#
# NOTE ON AUTH_FIELD_ENCRYPTION_KEY
#   64 hex zeros is deliberate. `field-encryption.ts` requires a 64-char hex
#   string, so the placeholder must be valid hex; and `configuration.ts` already
#   treats the all-zero key as a tripwire — it warns in development and refuses
#   to boot when NODE_ENV=production. That is the intended behaviour: a
#   production server must never come up on this file's values.
#
# See also `.env.example` for the full annotated variable list.

AUTH_FIELD_ENCRYPTION_KEY=0000000000000000000000000000000000000000000000000000000000000000
AUTH_REFRESH_TOKEN_SECRET=replace-me-auth-refresh-token-secret-000000000000000000000000000
AUTH_SESSION_PEPPER=replace-me-auth-session-pepper-000000000000000000000000000000000
AUTH_TOKEN_SECRET=replace-me-auth-token-secret-00000000000000000000000000000000000
AUTH_CSRF_TOKEN_SECRET=replace-me-auth-csrf-token-secret-000000000000000000000000000000
# Bearer the API presents to the HBPE/Summary sidecars; they refuse requests without it.
SIDECAR_AUTH_SECRET=replace-me-sidecar-auth-secret-00000000000000000000000000000000
DATABASE_ADMIN_PASSWORD=pgadmin_s3cure!
DATABASE_PASSWORD=comp4nion_1ntel_ftw!
OBJECT_STORE_USERNAME=replace-me-object-store-user-000
OBJECT_STORE_PASSWORD=replace-me-object-store-pass-000
# PowerSync shares an HS256 secret between the API (which signs client tokens) and
# the PowerSync service (which verifies them). The service refuses to boot without a
# key, so PS_JWT_SECRET_B64URL must always be set; it is base64url(POWERSYNC_JWT_SECRET)
# — see infrastructure/powersync/README.md for the derivation. Keep the two in sync.
# The API stays dormant (503 from /api/powersync/token) until POWERSYNC_URL is also
# set, so shipping the secret here does not turn the feature on.
POWERSYNC_JWT_SECRET=replace-me-powersync-jwt-secret-00000000000000000000000000000000
# Looks opaque but is not a key: this is base64url of the placeholder directly
# above (decode it and you get the same `replace-me-...` string). Regenerate it
# whenever you change POWERSYNC_JWT_SECRET, or the service rejects every token.
PS_JWT_SECRET_B64URL=cmVwbGFjZS1tZS1wb3dlcnN5bmMtand0LXNlY3JldC0wMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMA
# Replication runs as its own Postgres role, not as `companion`: setup-database
# creates `powersync` with the REPLICATION attribute and SELECT on the replicated
# tables only. This password is what it is created with and what the service
# connects with, so changing it here changes both on the next `up`.
POWERSYNC_DATABASE_PASSWORD=r3plic4te_me!
# infrastructure/powersync/entrypoint.sh derives the PowerSync service's Postgres
# URIs for the local `database` container: replication as `powersync` (above),
# bucket storage as `companion` (DATABASE_PASSWORD), which needs write access to
# its own schema.
# Uncomment to point the service at a different Postgres. Leave them commented for
# local work so each password stays defined in one place.
# PS_REPLICATION_URI=postgresql://<user>:<password>@<host>:5432/<database>
# PS_STORAGE_URI=postgresql://<user>:<password>@<host>:5432/<database>

#################
# UNCATEGORIZED #
#################

AUTH_DEFAULT_USER_EMAIL="jsmith@example.com"
AUTH_DEFAULT_USER_PASSWORD="replace-me-pw-000000"
# Where chat inference lives. This one value is read from both sides of a
# container boundary — the api and worker (on the host under `make dev`, in a
# container under staging/production compose) and the hbpe and summary sidecars,
# which are always containers — so no hostname here is correct for every reader:
# `localhost` names the container itself from inside one, and
# host.docker.internal resolves nowhere on a macOS or linux host.
#
# You do not have to pick. Every consumer corrects the hostname for the
# namespace it is actually in before using it, and says so in its log when it
# does (backend/apps/{hbpe,summary}/src/ci/*/llm_host.py, and
# resolveLlmUrlForRuntime in the api). Only the host is touched; port and path
# are yours. Set CI_LLM_HOST_REWRITE=off to be taken at your word instead, and
# CI_LLM_HOST_GATEWAY to name a gateway other than host.docker.internal.
#
# Point this at a non-Ollama port (vLLM on 8000) and the api's chat path speaks
# OpenAI protocol instead of native Ollama; embeddings follow it when it serves
# the embedder, else OLLAMA_HOST, unless LLM_EMBEDDING_API_BASE pins them.
LLM_API_BASE=http://host.docker.internal:11434/v1
LLM_API_KEY=ollama
# Leave unset: CI Hub injects the resolved chat model at install time, and the
# summary service otherwise discovers a served model from LLM_API_BASE/models.
# Set explicitly only to pin a specific model.
LLM_DEFAULT_CHAT_MODEL=
# Background extraction/classification (crons, queues) — NOT the model a person
# chats with. Leave unset to inherit the small compiled-in default. Do not point
# this at a large model: cost here is dominated by prompt evaluation, and an
# extraction prompt that a small model answers in seconds can exceed a job's
# whole timeout on a large one, which fails silently as a job that writes nothing.
LLM_UTILITY_MODEL=
LLM_DEFAULT_EMBEDDING_MODEL=nomic-embed-text-v2-moe
# NOTE: LLM_SKIP_MODEL_VALIDATION used to be listed here and was read by
# NOTHING — not configuration.ts, not custom-environment-variables.json, not
# OllamaService. Setting it had no effect: every chat still pays a `/api/tags`
# round trip to validate the model id, inside the caller's timeout budget.
# Removed rather than implemented, so the file stops advertising a switch that
# does not exist.

# Grounded chat recall. When on, a chat turn pre-runs memory recall for the
# newest user message and inserts the result into the fenced turn-context block,
# instead of relying on the model to choose the recall tool. Fails open.
# LLM_CHAT_GROUNDED_RECALL_ENABLED=true
#
# Maximum GraphQL query nesting depth, alongside the existing complexity ceiling.
# GRAPHQL_MAX_DEPTH=12
#
# Failed-login throttle, per client IP + submitted username. The appliance is
# reachable from the internet when exposed through the Portal, and this is the
# only brute-force protection on the login path. Fails open on internal error.
# AUTH_LOGIN_THROTTLE_ENABLED=true
# AUTH_LOGIN_THROTTLE_MAX_ATTEMPTS=10
# AUTH_LOGIN_THROTTLE_WINDOW_SECONDS=900
# AUTH_LOGIN_THROTTLE_LOCKOUT_SECONDS=900
#
# Comma-separated allowlist of extra origins allowed to call the API
# cross-origin with credentials. Native Capacitor origins (capacitor://localhost,
# ionic://localhost, http(s)://localhost) are always allowed; empty (the
# default) allows no others. Set this for a separately-hosted web client (e.g.
# a Cloudflare Pages SPA). See .env.example for detail; not to be confused
# with CI_HUB_ORIGINS, which only scopes the CI-Hub consent-redirect flow.
# CORS_ALLOWED_ORIGINS=https://ci-spatial-web.pages.dev

############
# FEATURES #
############
#
# Keep this list identical in `.env.example`. Values match
# `backend/apps/api/config/default.json`. Leave them commented so a copied
# `.env` does not override those defaults.
#
# ENABLE_SCHEDULED_ANSWER_INFERENCING=true
# ENABLE_SCHEDULED_CONNECTION_SYNC=true
# ENABLE_PINNED_DEMO_MODELS=false
# ENABLE_SYSTEM_PROMPT=true
# ENABLE_ADVANCED_THEME_TAB=false
# ENABLE_REQUIRE_SIGNUP_CODES=true
# ENABLE_FILES_PAGE=true
# ENABLE_INSIGHTS_PAGE=true
# ENABLE_CHAT_PAGE=true
# ENABLE_JOBS_PAGE=true
# ENABLE_IMPORT_PAGE=true
# ENABLE_PLANNING=true
# ENABLE_PLANNING_PAGE=true
# ENABLE_PLANNING_EMPTY_STATE=false
# ENABLE_STATS_PAGE=true
# ENABLE_SCHEDULE_PAGE=true
# ENABLE_TAGS_PAGE=true
# Gates the Today home route, the list surface for summaries, insights and derived actions.
# ENABLE_TODAY_PAGE=false
# ENABLE_HBPE=true
# ENABLE_AGENT_MEMORY_COMPACTION=false
# ENABLE_SHARED_SEARCH=true
# ENABLE_ONBOARDING_PREFERENCE_STEPS=false
# ENABLE_ACTIONS=true
# ENABLE_SMART_ROTATION=false
# ENABLE_ASK=false
# ENABLE_TRUST_TASKS=false
# ENABLE_GROUNDED_PROMPTS=true
# ENABLE_DERIVATION_ENGINES=true

#############
# DEBUGGING #
#############

# DATABASE_QUERY_LOGGING=true

############
# API KEYS #
############

# Third-party API keys are secrets and must NOT be committed. Leave blank here and
# provide real values via a local .env (gitignored) or injected env at deploy time.
# TMDB (movie/TV enrichment) and Google Maps (geocoding) are optional; when unset
# those enrichment paths are skipped.
TMDB_API_KEY=
GOOGLE_MAPS_KEY=

###############################################################
# API PROVIDER KEYS - NOTE: DEPRECATED - USE CI CLOUD INSTEAD #
###############################################################

MICROSOFT_CLIENT_ID=
MICROSOFT_CLIENT_SECRET=
GOOGLE_CLIENT_ID=
GOOGLE_CLIENT_SECRET=
FACEBOOK_CLIENT_ID=
FACEBOOK_CLIENT_SECRET=

#####################
# CI CLOUD PROXY    #
#####################
CI_CLOUD_URL=https://portal.companionintelligence.com
HUB_DEVICE_ID=
HUB_API_KEY=

# Prod geocode via hub. PortalGeocodeProvider appends:
#   forward  /api/geocode          → https://hub.ci.computer/api/geocode
#   reverse  /api/geocode/reverse  → https://hub.ci.computer/api/geocode/reverse
GEOCODING_PORTAL_BASE_URL=https://hub.ci.computer
GEOCODING_PROVIDER=portal