.env.example

# Copy this file to .env and fill in the blanks:
#   cp .env.example .env
# Keys marked "required" have no default in src/config/env.ts —
# the server refuses to start without them.

NODE_ENV=development
PORT=3000
CORS_ALLOWED_ORIGINS=http://localhost:5173,http://127.0.0.1:5173

# PostgreSQL connection URL (required)
# Local development default:
DATABASE_URL=postgresql://postgres:postgres@localhost:5432/qode_server

# SSL mode:
# - disable: no TLS
# - require: TLS with optional cert verification (controlled by DATABASE_SSL_REJECT_UNAUTHORIZED)
# - verify-full: keep this with DATABASE_SSL_REJECT_UNAUTHORIZED=true when CA/cert chain is properly configured
DATABASE_SSL_MODE=disable

# For local/dev or self-signed chain environments, keep false.
# For production with proper CA chain, set true.
DATABASE_SSL_REJECT_UNAUTHORIZED=false

# Optional CA certificate path for TLS verification (PEM)
# Example: ./global-bundle.pem
DATABASE_SSL_CA_PATH=./global-bundle.pem

# JWT settings (all required)
JWT_SECRET=dev-jwt-secret-change-me
JWT_EXPIRES_IN=7d
JWT_REFRESH_SECRET=dev-jwt-refresh-secret-change-me
JWT_REFRESH_EXPIRES_IN=30d

# GitHub OAuth Device Flow (client id/secret required)
GITHUB_OAUTH_CLIENT_ID=
GITHUB_OAUTH_CLIENT_SECRET=
GITHUB_OAUTH_SCOPES=repo read:user

# Required: 32-byte base64 (or 64-char hex) key for token encryption
# Example generation:
# node -e "console.log(require('node:crypto').randomBytes(32).toString('base64'))"
# Warning: changing this later makes every stored OAuth token undecryptable.
TOKEN_ENCRYPTION_KEY=

# OpenAI — used by the RAG assistant (src/lib/openai-client.ts)
OPENAI_API_KEY=
OPENAI_MODEL=gpt-4.1-mini

# LangSmith tracing — read directly by the langsmith SDK, not by src/config/env.ts.
# Leave LANGSMITH_TRACING=false to disable; the other three are then ignored.
LANGSMITH_TRACING=false
LANGSMITH_ENDPOINT=https://api.smith.langchain.com
LANGSMITH_API_KEY=
LANGSMITH_PROJECT=qode-server

# Kafka brokers for team chat. Comma-separated for multiple brokers.
# If the connection fails the server still starts; only team chat is suspended.
KAFKA_BROKERS=127.0.0.1:9092

# External analysis server (Qode-python)
ANALYSIS_SERVER_URL=http://localhost:8000
RAG_SERVICE_URL=http://localhost:8000
# Must match QODE_INTERNAL_TOKEN in Qode-python/.env
ANALYSIS_SERVER_INTERNAL_TOKEN=dev-qode-internal-token

# Sync worker
# Must match PROD_REPO_STORAGE_ROOT (or LOCAL_REPO_STORAGE_ROOT) in Qode-python/.env
SYNC_REPO_BASE_DIR=./.data/repos
SYNC_WORKER_ENABLED=true
SYNC_MAX_CONCURRENCY=1

# Invitation — NOT IMPLEMENTED YET (no code reads these keys).
# Kept as a placeholder for the invite-link feature; uncomment when it lands.
# APP_BASE_URL=http://localhost:5173
# INVITATION_EXPIRES_HOURS=72