env.api.example.yaml

# Non-secret env vars for api-service. Copy to env.api.yaml and fill in.
# Secrets (DATABASE_URL, JWT_SECRET, etc.) come from Secret Manager via --set-secrets.

NODE_ENV: production
HOST: 0.0.0.0
PORT: "8080"

# Disable the Hocuspocus collab WebSocket (Cloud Run is single-port).
COLLAB_DISABLED: "1"

# Public-facing URLs.
FRONTEND_URL: https://app.your-domain.com

# Internal service URLs (filled in after first agents + gotenberg deploys; the
# Cloud Run console shows them, format: https://<name>-<hash>-<region>.a.run.app).
AGENTS_URL: https://agents-service-REPLACE.a.run.app
GOTENBERG_URL: https://gotenberg-REPLACE.a.run.app

# Object storage — GCS via S3-compat interop.
S3_ENDPOINT: https://storage.googleapis.com
S3_BUCKET: draftlegal-documents-REPLACE
S3_REGION: auto
S3_FORCE_PATH_STYLE: "true"

# Email (SMTP / nodemailer). Email only sends once SMTP_HOST is set.
# SMTP_USER / SMTP_PASS are secrets → provide via --set-secrets, not here.
SMTP_HOST: smtp.your-relay.com        # the gate: unset = no email is sent
SMTP_PORT: "587"                      # 587 STARTTLS, or 465 with SMTP_SECURE=true
SMTP_SECURE: "false"
SMTP_FROM: noreply@your-domain.com    # From: address
EMAIL_FROM: noreply@your-domain.com   # legacy alias for SMTP_FROM; still honored

# Public web base URL — builds signing links in emails (no trailing slash).
WEB_BASE_URL: https://app.your-domain.com

# Inbound email (optional) — lets a counterparty reply to a share email with a
# marked-up PDF/DOCX attached, landing it as a new contract version. Needs a
# provider inbound-parse webhook posting to /api/v1/inbound/email, plus MX
# records for this domain. INBOUND_EMAIL_SECRET is a secret → --set-secrets.
# Leave the domain blank to keep the "reply with your redline" invitation off.
INBOUND_EMAIL_DOMAIN: inbound.your-domain.com

# Feature flags
ENABLE_SIGNUP: "true"

# LLM observability (optional — leave blank if not using Langfuse)
LANGFUSE_HOST: https://cloud.langfuse.com