.env.example

# Copy this file to `.env` (or `python-server/.env`) and fill in real values.
# NEVER commit a real key. `.env` files are git-ignored on purpose.
#
# These variables are read by the FastAPI server ONLY. They are server-side
# secrets and must never be exposed to the browser or prefixed with VITE_.

# --- Chat proxy (server-side only) ---
# Google Generative Language (Gemini) API key. Server reads this to call Google.
GEMINI_API_KEY=your-server-side-gemini-key-here
# Model is non-secret and configurable.
GEMINI_MODEL=gemini-2.0-flash

# --- FastAPI service ---
# Bind host/port. Default to loopback; do not expose 0.0.0.0 without a reason.
HOST=127.0.0.1
PORT=8000
# Exact-match, comma-separated list of allowed browser origins for CORS.
ALLOWED_ORIGINS=http://localhost:5173

# --- WebSocket signaling server ---
WS_HOST=127.0.0.1
WS_PORT=5174
WS_PATH=/ws
# Exact-match, comma-separated list of allowed browser origins for the socket.
WS_ALLOWED_ORIGINS=http://localhost:5173

# --- Frontend (public, safe to ship in the browser bundle) ---
# Public signaling URL the browser connects to. Contains NO secret.
VITE_SIGNALING_URL=ws://localhost:5174/ws