.env.docker.example

# Compose env for the Dockerized stack. Copy to `.env` next to docker-compose.yml.
# docker compose reads `.env` automatically.

# --- Postgres ---
POSTGRES_PASSWORD=change-me

# --- Auth ---
AUTH_SECRET=generate-with-openssl-rand-base64-32
NEXTAUTH_URL=https://tasks.example.com
SERVER_PORT=3000

# --- Models / backend ---
TASK_ORCH_AGENT_BACKEND=claude
TASK_ORCH_CHAT_MODEL=openai/gpt-5.6-sol
TASK_ORCH_AGENT_MODEL=anthropic/claude-opus-4-8

# --- Credentials passed to workers ---
# GitHub token used for git clone/push (HTTPS) and `gh pr create`. Needs `repo`
# AND `workflow` scope — without `workflow`, pushes that touch
# `.github/workflows/*.yml` are rejected by GitHub.
GH_TOKEN=ghp_xxx
# Claude auth: an OAuth token (from ~/.claude) OR an API key. The worker also
# mounts CLAUDE_HOME so a subscription session/resume works.
CLAUDE_CODE_OAUTH_TOKEN=
ANTHROPIC_API_KEY=

# pi backend (TASK_ORCH_AGENT_BACKEND=pi) provider keys. Any of these set on
# the server is forwarded into each worker container's env, so a pi persona on
# a non-Anthropic model works inside the container too. The full recognized
# list lives in lib/agent-backend/provider-env.ts.
# OPENAI_API_KEY=
# Optional override; preferred Codex source is CODEX_HOME/auth.json.
# CODEX_ACCESS_TOKEN=
# GEMINI_API_KEY=
# GROQ_API_KEY=
# OPENROUTER_API_KEY=
# XAI_API_KEY=
# MISTRAL_API_KEY=

# Brave Search tool for chat and agent web lookup.
# BRAVE_SEARCH_API_KEY=

# Host ~/.claude dir (auth + Claude Code session store), mounted RW into the
# server + each worker so session resume survives ephemeral worker containers.
CLAUDE_HOME=/home/youruser/.claude

# Space-separated owner/repo list to pre-clone into the repo-cache volume.
TARGET_REPOS=nodetool-ai/nodetool

# --- Worker resource limits + memory-aware admission (optional overrides) ---
# docker-compose.yml already bakes in defaults sized for an 8 GB / 4-CPU host
# (~2 concurrent workers). Override here for a bigger/smaller box. Per-worker caps
# are hard cgroup limits; the admission gate reads remaining HOST memory and
# defers over-capacity runs to 'pending' (a pump retries them). Set an MB var to 0
# to omit that limit. IMPORTANT: never give the server container its own mem_limit
# — /proc/meminfo must report host-wide memory for the gate.
# TASK_ORCH_WORKER_MEMORY_MB=3072        # hard RAM cap per worker (HostConfig.Memory); also the per-worker charge in admission accounting
# TASK_ORCH_WORKER_CPUS=2                # hard CPU cap per worker (HostConfig.NanoCpus), clamped to host NCPU
# TASK_ORCH_WORKER_PIDS_LIMIT=512        # fork-bomb / runaway-thread guard (HostConfig.PidsLimit)
# TASK_ORCH_WORKER_MEMORY_SWAP_MB=       # defaults to = MEMORY_MB (swap disabled); values below MEMORY_MB are raised to it
# TASK_ORCH_WORKER_MEMORY_RESERVATION_MB= # optional soft low-watermark (HostConfig.MemoryReservation), clamped <= MEMORY_MB
# TASK_ORCH_HOST_MEMORY_RESERVE_MB=2048  # memory held back for OS + server + postgres + pipe before the worker budget
# TASK_ORCH_MAX_WORKERS=2                # hard concurrency backstop independent of the memory math (0 = memory-bound only)
# TASK_ORCH_PENDING_PUMP_MS=15000        # pump interval: re-dispatch deferred runs + reap stale leases (0 disables)
# TASK_ORCH_MAX_DEFER_MS=1800000         # fail a run left queued longer than this (30 min) instead of deferring forever
# TASK_ORCH_ADMISSION_ENABLED=1          # master switch for the gate (0 = per-worker caps only, spawn eagerly)
# TASK_ORCH_CHAT_IDLE_MS=600000          # long-lived chat worker: idle wait (10 min) before exiting; next message resumes

# --- Optional: Discord pipe ---
DISCORD_BOT_TOKEN=
DISCORD_ALLOWED_USERS=
DISCORD_ALLOWED_CHANNELS=