# TuneVault Self-Hosted Configuration
# Copy this file to .env and fill in your values:  cp .env.example .env
#
# `bash setup.sh` auto-generates SESSION_SECRET and ENCRYPTION_KEY and writes
# DATABASE_URL for the bundled Postgres, so for the standard install you only need
# to set DB_PASSWORD, ADMIN_EMAILS, APP_URL and TUNEVAULT_LICENSE_KEY below.
# If you are NOT using setup.sh (e.g. plain `docker compose up`, or an external
# database), you must set DATABASE_URL and ENCRYPTION_KEY yourself — the app will
# not run without them. See "Required" below.

# ── Required ─────────────────────────────────────────────────────────────────

# Self-hosted mode (enables license checks; disables forced-HTTPS headers so
# plain-HTTP LAN installs work). Leave this set to true for self-hosted.
TUNEVAULT_SELF_HOSTED=true

# License key. Get a FREE 30-day key (1 connection, unlimited health checks) at
# https://tunevault.app/download — or https://tunevault.app/pricing for a paid tier.
# The app exits at startup without a valid key.
TUNEVAULT_LICENSE_KEY=TV-XXXXX-XXXXX-XXXXX

# Postgres connection string.
# setup.sh WRITES this for you (from DB_PASSWORD below) when using the bundled
# database — leave it commented in that case. Set it explicitly ONLY for an
# external Postgres or a non-setup.sh install. Required: db/index.js throws at
# startup if it is unset.
# DATABASE_URL=postgresql://tunevault:your_db_password@localhost:5432/tunevault

# Password for the bundled Postgres (used by setup.sh to build DATABASE_URL).
DB_PASSWORD=change_this_strong_password

# Encryption key for stored Oracle/EBS/SSH credentials (AES-256-GCM).
# MUST be exactly 64 hex characters (32 bytes). setup.sh generates one if unset.
# Generate manually with:
#   node -e "console.log(require('crypto').randomBytes(32).toString('hex'))"
# REQUIRED: with NODE_ENV=production (which docker-compose.yml sets) the process
# exits the first time a credential is encrypted/decrypted if this is missing.
# NEVER change it after first use — existing stored credentials become undecryptable.
ENCRYPTION_KEY=

# Session signing secret (any long random string). setup.sh generates one if unset.
SESSION_SECRET=change_this_to_a_random_64_char_string

# Your admin email address (comma-separated for several admins).
ADMIN_EMAILS=you@yourcompany.com

# Application URL (change to your server's IP or domain).
APP_URL=http://localhost:3000

# ── Optional ─────────────────────────────────────────────────────────────────

# AI features — keys from platform.openai.com (sk-...) and console.anthropic.com
# (sk-ant-...). Leave BLANK to run without AI: health-check AI summaries and
# TuneBot chat are disabled, but all monitoring/ops features work.
OPENAI_API_KEY=
ANTHROPIC_API_KEY=

# Optional: point the OpenAI client at a compatible proxy/gateway instead of
# api.openai.com (e.g. an internal LLM gateway). Leave blank for the default.
# OPENAI_BASE_URL=

# Optional: Google OAuth (for Google sign-in — leave blank to use magic link only).
GOOGLE_CLIENT_ID=
GOOGLE_CLIENT_SECRET=

# Optional: Email sending via Resend (magic links, health-check + alert emails).
# Leave blank to disable outbound email. You can still sign in: with no provider
# configured, a self-hosted install PRINTS the sign-in link to the server log —
#   journalctl -u tunevault -f      (or: docker compose logs -f app)
# — as a boxed "TUNEVAULT SIGN-IN LINK" banner. The link keeps its normal 15-minute,
# single-use lifetime. Google OAuth (below) is unaffected and also works standalone.
RESEND_API_KEY=
# From address for outbound mail (defaults to "TuneVault <noreply@tunevault.app>").
# Set this to a domain you have verified with Resend.
# EMAIL_FROM=TuneVault <noreply@yourcompany.com>

# Optional: default recipient for autonomous-monitoring alert emails when a
# connection schedule has no alert_email of its own.
# ALERT_EMAIL=

# Optional: Port (default 3000).
PORT=3000

# Optional: Node environment. docker-compose.yml already sets production.
# NODE_ENV=production

# Optional: license server this self-hosted instance validates against.
# Defaults to https://tunevault.app — override only for testing/on-prem mirrors.
# TUNEVAULT_LICENSE_SERVER_URL=https://tunevault.app

# Auto-generated on first license validation. Do not change after initial setup.
# TUNEVAULT_INSTANCE_ID=

# Optional: Anonymous telemetry (OFF by default). Set to true to send a single
# anonymous version ping (version, Node version, platform) to tunevault.app on
# startup. No PII, no connection data, no database contents — ever. Opt-in only.
TELEMETRY_OPT_IN=false

# ── Optional tuning (defaults are fine for almost everyone) ──────────────────

# Seconds since last heartbeat before an agent is shown as online / stale.
# AGENT_ONLINE_S=90
# AGENT_STALE_S=300
# Cooldown between automatic agent-upgrade attempts, in milliseconds.
# PROXY_UPGRADE_COOLDOWN_MS=3600000
# SSH connection-pool limits for the SSH-first query path.
# TUNEVAULT_SSH_POOL_MAX=10
# SSH_MAX_CONCURRENT_STREAMS=4

# ── CI / test-only credentials ────────────────────────────────────────────────
# NOT needed to run TuneVault. These parameterize throwaway values used by the
# test suite and CI workflows so no credential literals live in the repo.
#
# Local test (tests/api-delete-connection.js) — synthetic connection to a fake
# host; both optional (username defaults to 'ci_test', password to a generated
# throwaway when unset):
CI_TEST_USERNAME=ci_test
CI_TEST_PASSWORD=
#
# GitHub Actions workflows read the following as repository SECRETS (add them at
# Settings → Secrets and variables → Actions), not from this .env file:
#   CI_PG_PASSWORD          — .github/workflows/e2e-smoke.yml ephemeral Postgres
#   CI_SESSION_SECRET       — .github/workflows/e2e-smoke.yml app boot
#   CI_ORACLE_PASSWORD      — .github/workflows/e2e-oracle-xe-full.yml SYSTEM pwd
#   CI_ORACLE_APP_PASSWORD  — .github/workflows/e2e-oracle-xe-full.yml APP_USER pwd

# ── Cloud-only (tunevault.app SaaS) — intentionally NOT part of self-hosted ───
# Listed so you know they are omitted deliberately, not forgotten. Setting them
# on a self-hosted install has no effect or is unsupported:
#   RAZORPAY_KEY_ID / RAZORPAY_KEY_SECRET / RAZORPAY_TEST_* / USD_TO_INR_RATE
#       — hosted billing; self-hosted licensing is via TUNEVAULT_LICENSE_KEY.
#   POLSIA_API_URL / POLSIA_API_KEY / POLSIA_API_TOKEN / POSTMARK_API_TOKEN
#       — legacy hosted mail relays; self-hosted uses RESEND_API_KEY.
#   OUTREACH_SEND_ENABLED / OUTREACH_UNLOCK_TOKEN
#       — hosted cold-email hard lock. Never set these.
#   GITHUB_TOKEN / GITHUB_REPO / CI_REPORT_TOKEN / SMOKE_REPORT_SECRET
#   READY_TEST_TOKEN / READY_TEST_SSH_HOST / INSTALLER_ALERT_EMAIL / OPS_ALERT_EMAIL
#       — CI reporting + internal ops alerting.
#   RENDER / RENDER_GIT_COMMIT / RENDER_REGION / GIT_SHA / DEPLOY_DATE
#       — injected by the Render platform; meaningless off Render.
#   ADMIN_BULK_DELETE / SKIP_TIER_LIMITS / INTERNAL_API_KEY
#   TV_HC_EMAIL_SUPPRESS_USERS
#       — internal maintenance/testing switches.
