.env.example

# Database — required. Use `pnpm db:up` to start a local PostgreSQL via Docker.
DATABASE_URL=postgresql://onecomputer:onecomputer@localhost:5432/onecomputer

# Auth — single-user mode by default (no login required).
# To enable Google OAuth login (multi-user), set NEXTAUTH_SECRET and the Google credentials below.
# Generate with: openssl rand -hex 32
NEXTAUTH_SECRET=

# Gateway auth mode — "local" skips JWT validation (single-user dev), "oauth" validates NextAuth cookies.
AUTH_MODE=local

# OpenVTC-native identity/approval mode. In production, use a stable did:web
# RP signing identity and a separately provisioned manager DID in the VTA/VTC
# trust registry. The portal is read-only for approval in this mode.
OPENVTC_RP_DID=
OPENVTC_APPROVER_DID=
# `tsp` is the production default in AUTH_MODE=openvtc; it fails closed until
# the OpenVTC adapter is configured. `rest` is only an explicit contract-test
# seam to a VTA/mediator endpoint (never the push gateway itself).
OPENVTC_TRANSPORT_BINDING=tsp
OPENVTC_TASK_ENDPOINT_URL=
OPENVTC_TASK_ENDPOINT_BEARER=
OPENVTC_SESSION_SECRET=

# Google OAuth (for login — works in both auth modes)
GOOGLE_CLIENT_ID=
GOOGLE_CLIENT_SECRET=

# Microsoft Entra ID / Azure AD OAuth (optional — env-gated, only active when all three are set)
# App registration: single-tenant, giniresearch.onmicrosoft.com
# Redirect URI registered: http://127.0.0.1:10254/api/auth/callback/microsoft-entra-id
# Delegated Graph scopes: openid, profile, email, User.Read (admin-consented)
AZURE_AD_CLIENT_ID=
AZURE_AD_CLIENT_SECRET=
AZURE_AD_TENANT_ID=

# Secret encryption key for encrypting stored secrets (API keys, tokens, etc.)
# Auto-generated on first container start if not set.
# Only set this if you need a specific key (e.g., migrating data between instances).
# Generate with: node -e "console.log(require('crypto').randomBytes(32).toString('base64'))"
SECRET_ENCRYPTION_KEY=change-me-to-secure-key

# 1Password integration — the gateway resolves op:// references by calling the
# Node API (which runs the official 1Password SDK). INTERNAL_API_URL points the
# gateway at the Node app; GATEWAY_INTERNAL_SECRET authenticates that call.
# OSS: the gateway and Next.js app co-run, so localhost:10254 works.
INTERNAL_API_URL=http://localhost:10254
GATEWAY_INTERNAL_SECRET=

# API domain — where the API server runs (no protocol prefix).
# OSS: localhost:10255 (gateway serves API too), Cloud: api.onecomputer.local
API_DOMAIN=localhost:10255

# Gateway API domain — where the gateway HTTP endpoints live (vault, cache, approvals).
# OSS: same as API_DOMAIN, Cloud: same as API_DOMAIN (ALB routes by path)
GATEWAY_API_DOMAIN=localhost:10255

# Gateway proxy — where containers connect for the CONNECT proxy
# OSS: host.docker.internal:10255, Cloud: gateway.onecomputer.local:10255 (no protocol prefix)
GATEWAY_BASE_URL=host.docker.internal:10255

# Daytona sandbox adapter (Phase 1)
# API and toolbox proxy ports. NOTE: toolbox exec goes to port 4000, NOT 3000.
DAYTONA_API_URL=http://127.0.0.1:3000
DAYTONA_API_KEY=
DAYTONA_PROXY_URL=http://127.0.0.1:4000
DAYTONA_SNAPSHOT=

# JFrog Artifactory (local dev on port 8082, password: see setup docs)
ONECLI_JFROG_BASE_URL=http://127.0.0.1:8082
ONECLI_JFROG_AUTH_TOKEN=

# Package gate — Verdaccio npm proxy (Phase 4, not yet running)
VERDACCIO_URL=http://host.docker.internal:4873

# IMPORTANT: For local dev, leave NEXTAUTH_SECRET empty.
# Setting it triggers oauth mode which fails without GOOGLE_CLIENT_ID.
# See apps/web/src/lib/runtime-config.ts:35

# Postgres runs on port 5433 in local dev (5432 is taken by Daytona stack)
# Start with: POSTGRES_PORT=5433 docker compose -f docker/docker-compose.yml up -d postgres