.env.example

# =============================================================================
# OpenProxy Environment Configuration
# =============================================================================
# Copy this file to .env in the project root or export the variables before
# starting openproxy. Variables with a default can be left commented out.
#
#   cp .env.example .env
#   openproxy
#
# Most operators only set JWT_SECRET and INITIAL_PASSWORD and leave the rest
# at defaults. See the README "Configuration" section for details.
# =============================================================================

# --- Server ---
PORT=4623
HOST=127.0.0.1
# DATA_DIR=~/.openproxy
# HOSTNAME=127.0.0.1         # Bind host (alias: HOST). 0.0.0.0 to expose on LAN
# BASE_URL=http://localhost:4623
# CLOUD_URL=                  # Cloud-sync endpoint. Leave unset to disable.

# --- Authentication ---
JWT_SECRET=openproxy-default-secret-change-me
# Leave INITIAL_PASSWORD unset to use a random generated password (printed
# once in the startup banner). If set, this is the dashboard password when no
# stored hash exists yet.
# INITIAL_PASSWORD=change-me
# OPENPROXY_ENCRYPTION_KEY=   # 64 hex chars (32 bytes) for DB field encryption.
                              # Credentials are encrypted with AES-256-GCM (authenticated)
                              # using an Argon2id-derived key. Legacy AES-CBC (opxenc1)
                              # values stay readable and migrate on next write.
# OPENPROXY_ARGON2_M_COST_KB=65536  # Argon2id memory cost in KiB (min 19456)
# OPENPROXY_ARGON2_T_COST=3         # Argon2id time cost (min 2)
# OPENPROXY_ARGON2_P_COST=1         # Argon2id parallelism
# API_KEY_SECRET=              # HMAC secret for generated API keys. If unset, a
                                # random secret is generated at first startup and
                                # persisted to $DATA_DIR/api_key_secret.
# AUTH_COOKIE_SECURE=false     # Set true behind HTTPS
# SHUTDOWN_SECRET=             # Protect the /api/shutdown endpoint
# NODE_ENV=                    # Set "production" to disable the shutdown endpoint

# --- API Access ---
# REQUIRE_API_KEY=false        # Reject /v1/* requests without Authorization header.
#                              # Configured via dashboard settings, not an env read.

# --- Database (backups) ---
# DATABASE_URL=                # Reserved for future multi-backend support
# DB_BACKUP_MAX_FILES=7
# DB_BACKUP_RETENTION_DAYS=30
# DISABLE_AUTO_BACKUP=false

# --- Streaming Timeouts ---
# STREAM_STALL_TIMEOUT_MS=360000    # Abort stream if no chunk arrives (360 s)
# STREAM_FIRST_CHUNK_TIMEOUT_MS=200000  # Time-to-first-token timeout (200 s)

# --- Observability / Logging ---
# OBSERVABILITY_ENABLED=true        # Reserved for future observability pipeline
# OBSERVABILITY_MAX_JSON_SIZE=5120  # Reserved
# ENABLE_REQUEST_LOGS=false         # Write per-request logs under logs/
# REQUEST_LOG_DIR=logs              # Directory for request log files
# ENABLE_TRANSLATOR=false           # Enable the translator provider
# MACHINE_ID_SALT=endpoint-proxy-salt

# --- OIDC SSO (dashboard login) ---
# OIDC_ISSUER=https://accounts.example.com
# OIDC_CLIENT_ID=openproxy
# OIDC_CLIENT_SECRET=
# OIDC_REDIRECT_URI=http://127.0.0.1:4623/api/auth/oidc/callback

# --- OAuth Endpoint Overrides ---
# Each override lets you redirect a provider's OAuth / API traffic to a
# custom endpoint, e.g. a self-hosted proxy or mirror.

# Claude
# OPENPROXY_CLAUDE_AUTHORIZE_URL=
# OPENPROXY_CLAUDE_TOKEN_URL=

# Codex (ChatGPT / OpenAI)
# OPENPROXY_CODEX_AUTHORIZE_URL=
# OPENPROXY_CODEX_TOKEN_URL=

# Gemini / Antigravity
# OPENPROXY_GEMINI_TOKEN_URL=
# OPENPROXY_GEMINI_USER_INFO_URL=
# OPENPROXY_GEMINI_LOAD_CODE_ASSIST_ENDPOINT=
# OPENPROXY_ANTIGRAVITY_TOKEN_URL=
# OPENPROXY_ANTIGRAVITY_USER_INFO_URL=
# OPENPROXY_ANTIGRAVITY_LOAD_CODE_ASSIST_ENDPOINT=
# OPENPROXY_ANTIGRAVITY_ONBOARD_USER_ENDPOINT=

# iFlow
# OPENPROXY_IFLOW_API_BASE_URL=
# OPENPROXY_IFLOW_TOKEN_URL=
# OPENPROXY_IFLOW_USER_INFO_URL=

# Kiro
# OPENPROXY_KIRO_AUTH_SERVICE_BASE_URL=
# OPENPROXY_KIRO_OIDC_BASE_URL=
# OPENPROXY_KIRO_TOKEN_URL=

# Other providers
# OPENPROXY_OPENAI_TOKEN_URL=
# OPENPROXY_CLINE_TOKEN_URL=
# OPENPROXY_XAI_TOKEN_URL=
# OPENPROXY_VERCEL_API_BASE_URL=
# OPENPROXY_DENO_API_BASE_URL=

# --- Azure OpenAI ---
# AZURE_OPENAI_ENDPOINT=
# AZURE_OPENAI_API_VERSION=
# AZURE_OPENAI_DEPLOYMENT=

# --- Google Cloud (Vertex AI / Gemini) ---
# GOOGLE_APPLICATION_CREDENTIALS=/path/to/service-account-key.json

# --- CLI Config Profiles ---
# OPENPROXY_PROFILE=work
# OPENPROXY_DATA_DIR=
# OPENPROXY_URL=
# OPENPROXY_API_KEY=
# OPENPROXY_CONFIG=

# --- Headroom (proxy pool) ---
# HEADROOM_PYTHON=python3       # Python executable for Headroom proxy pool

# --- HTTP Proxy (outbound) ---
# HTTP_PROXY=http://proxy:8080
# HTTPS_PROXY=http://proxy:8080
# NO_PROXY=localhost,127.0.0.1