# -----------------------------------------------------------------------------
# Orcheo Stack Environment Template
#
# Notes:
# - This file is read by Docker Compose and injected into backend/worker/canvas.
# - `${VAR}` references below reuse earlier values to avoid duplication.
# -----------------------------------------------------------------------------

# -----------------------------------------------------------------------------
# Required secrets and signing keys
# -----------------------------------------------------------------------------
# PostgreSQL password used by the `postgres` container and backend DSN.
ORCHEO_POSTGRES_PASSWORD=change-me
# 64-hex key used by the vault to encrypt credentials at rest.
ORCHEO_VAULT_ENCRYPTION_KEY=replace-with-64-hex-chars
# HMAC signing key used to mint/verify ChatKit access tokens.
ORCHEO_CHATKIT_TOKEN_SIGNING_KEY=strong-random-secret
# Bootstrap API token used when auth mode is `required` or `optional`.
ORCHEO_AUTH_BOOTSTRAP_SERVICE_TOKEN=change-me
# Public ChatKit domain key consumed by Canvas; required for ChatKit UI features.
# Security note: this value is shipped to browsers. Scope it per environment.
VITE_ORCHEO_CHATKIT_DOMAIN_KEY=domain_pk_replace_me

# -----------------------------------------------------------------------------
# Core service defaults (database, API, and browser-facing URLs)
# -----------------------------------------------------------------------------
# PostgreSQL username used by the `postgres` container and internal DSN.
ORCHEO_POSTGRES_USER=orcheo
# PostgreSQL database name used by backend/worker/celery-beat.
ORCHEO_POSTGRES_DB=orcheo
# Public backend API URL used by CLI/SDK integrations.
ORCHEO_API_URL=http://localhost:8000
# Canvas API base URL; typically same as ORCHEO_API_URL.
VITE_ORCHEO_BACKEND_URL=${ORCHEO_API_URL}
# Public Canvas base URL used to generate ChatKit links from backend responses.
ORCHEO_CHATKIT_PUBLIC_BASE_URL=http://localhost:5173
# CORS allow-list enforced by backend for browser API requests.
ORCHEO_CORS_ALLOW_ORIGINS=http://localhost:5173,http://127.0.0.1:5173

# -----------------------------------------------------------------------------
# Backend authentication behavior (API token validation)
# -----------------------------------------------------------------------------
# Backend auth mode: `disabled`, `optional`, or `required`.
ORCHEO_AUTH_MODE=disabled
# Enables backend developer login endpoint when true (keep false in production).
ORCHEO_AUTH_DEV_LOGIN_ENABLED=false
# OIDC issuer expected in incoming JWTs (backend validation).
ORCHEO_AUTH_ISSUER=https://your-auth-provider.com/
# OAuth client ID (used by CLI OAuth login and shared with Canvas below).
ORCHEO_AUTH_CLIENT_ID=your-client-id
# JWT audience expected by backend token validation.
ORCHEO_AUTH_AUDIENCE=https://your-api-audience.com
# JWKS endpoint backend uses to fetch signing keys for JWT verification.
ORCHEO_AUTH_JWKS_URL=https://your-auth-provider.com/.well-known/jwks.json

# -----------------------------------------------------------------------------
# Canvas OAuth login configuration (browser-side)
# -----------------------------------------------------------------------------
# Leave blank to disable OAuth login UI; set to enable login page redirects.
VITE_ORCHEO_AUTH_ISSUER=
# Canvas OAuth client ID; defaults to ORCHEO_AUTH_CLIENT_ID to avoid duplication.
VITE_ORCHEO_AUTH_CLIENT_ID=${ORCHEO_AUTH_CLIENT_ID}
# Optional explicit callback URL; blank uses `${origin}/auth/callback`.
VITE_ORCHEO_AUTH_REDIRECT_URI=
# Space-delimited scopes requested by Canvas during OAuth login.
VITE_ORCHEO_AUTH_SCOPES=openid profile email workflows:read workflows:execute chatkit:session
# Optional OAuth audience for Canvas token requests.
VITE_ORCHEO_AUTH_AUDIENCE=${ORCHEO_AUTH_AUDIENCE}
# Optional organization identifier for multi-tenant IdPs (e.g., Auth0).
VITE_ORCHEO_AUTH_ORGANIZATION=org_xxxxxxxxxx
# Optional provider hint query parameter key (e.g., `connection`).
VITE_ORCHEO_AUTH_PROVIDER_PARAM=connection
# Optional provider hint value for Google.
VITE_ORCHEO_AUTH_PROVIDER_GOOGLE=google-oauth2
# Optional provider hint value for GitHub.
VITE_ORCHEO_AUTH_PROVIDER_GITHUB=github
# Comma-separated hostnames Canvas dev server accepts (reverse proxy/custom domain).
VITE_ALLOWED_HOSTS=localhost

# -----------------------------------------------------------------------------
# Optional stack runtime pin
# -----------------------------------------------------------------------------
# Runtime image for backend/worker/celery-beat. Uncomment to pin a release.
# ORCHEO_STACK_IMAGE=ghcr.io/shaojiejiang/orcheo-stack:0.1.0
