.env.example

# ============================================================================
# Tesslate Studio - Complete Configuration
# ============================================================================
# This file contains all configuration for Tesslate Studio.
# It is used by both Docker Compose and native development.
# For Kubernetes deployment, see k8s/.env.example
# ============================================================================

# Instructions:
# 1. Copy this file: cp .env.example .env
# 2. Update SECRET_KEY and LITELLM_MASTER_KEY below
# 3. For Docker Compose: docker compose up -d
# 4. For native development: Export these variables or use a .env loader
# 5. Never commit the .env file to version control

# ----------------------------------------------------------------------------
# Required Configuration
# ----------------------------------------------------------------------------

# Backend Secret Key (IMPORTANT: Change in production!)
SECRET_KEY=your-secret-key-here-change-this-in-production

# Internal API Shared Secret — authenticates cluster-internal callers (Hub GC, btrfs CSI)
# to the /api/internal/* endpoints.  Generate a strong value for production:
#   python -c "import secrets; print(secrets.token_hex(32))"
# Leave empty to rely on the 60-second grace window only (not recommended for production).
# Desktop mode ignores this value entirely.
INTERNAL_API_SECRET=dev-secret-changeme

# ----------------------------------------------------------------------------
# Database Configuration (PostgreSQL)
# ----------------------------------------------------------------------------

# PostgreSQL Database (used by both orchestrator and LiteLLM)
POSTGRES_DB=tesslate_dev
POSTGRES_USER=tesslate_user
POSTGRES_PASSWORD=dev_password_change_me
POSTGRES_PORT=5432

# ----------------------------------------------------------------------------
# LiteLLM Configuration (Required for AI features)
# ----------------------------------------------------------------------------
# External LiteLLM service configuration
# Point to your LiteLLM proxy server (shared between dev and production)

LITELLM_API_BASE=https://your-litellm-url.com/v1
LITELLM_MASTER_KEY=your-litellm-master-key-here

# LiteLLM User Configuration
# Models available to new users (comma-separated, no spaces)
# Example: gpt-4o-mini,gpt-3.5-turbo,claude-3-haiku,gemini-pro
# These should match model names configured in your LiteLLM proxy
LITELLM_DEFAULT_MODELS=claude-sonnet-4.6,claude-opus-4.6
# Team/access group for users in your LiteLLM setup
LITELLM_TEAM_ID=default
# Email domain for internal user emails
LITELLM_EMAIL_DOMAIN=localhost
# Initial budget per user in USD
LITELLM_INITIAL_BUDGET=10000.0

# ----------------------------------------------------------------------------
# Agent Resource Limits (optional - has defaults)
# ----------------------------------------------------------------------------
# These limits prevent runaway costs and infinite loops in AI agents
# Limits are enforced globally across all agent executions

# Maximum total cost across all agent runs (USD)
# Default: 20.0
# AGENT_MAX_COST=20.0

# Maximum total iterations across all agent runs (0 = unlimited)
# Default: 0 (unlimited)
# AGENT_MAX_ITERATIONS=0

# Maximum cost per individual agent run (USD)
# Default: 5.0
# AGENT_MAX_COST_PER_RUN=5.0

# ----------------------------------------------------------------------------
# Container Cleanup Configuration (optional - has defaults)
# ----------------------------------------------------------------------------
# Two-tier cleanup system for idle development containers
# Helps manage resources and prevent runaway costs

# How often to run the cleanup check (minutes)
# CONTAINER_CLEANUP_INTERVAL_MINUTES=2

# Tier 1: Pause containers after being idle for X minutes
# CONTAINER_CLEANUP_TIER1_IDLE_MINUTES=2880

# Tier 2: Remove containers after being paused for X hours
# CONTAINER_CLEANUP_TIER2_PAUSED_HOURS=24

# ----------------------------------------------------------------------------
# Optional Backend Configuration (has sensible defaults)
# ----------------------------------------------------------------------------

# Database URL (PostgreSQL - automatically configured for Docker Compose)
# Docker Compose: Uses postgres service (automatic)
# Production: Update with your PostgreSQL credentials
DATABASE_URL=postgresql+asyncpg://tesslate_user:dev_password_change_me@postgres:5432/tesslate_dev

# Logging Configuration (optional - has defaults)
# Log level for the backend application
# Options: DEBUG, INFO, WARNING, ERROR, CRITICAL
# Default: INFO
# LOG_LEVEL=INFO

# JWT Configuration (optional - has defaults)
# ALGORITHM=HS256
# ACCESS_TOKEN_EXPIRE_MINUTES=30
# REFRESH_TOKEN_EXPIRE_DAYS=14

# Deployment Mode (default: docker)
# Options: "docker" (local development) or "kubernetes" (production cluster)
DEPLOYMENT_MODE=docker

# File watching for dev containers (required for hot reload on Windows/Mac Docker)
# These settings enable file change detection in Docker volumes
CHOKIDAR_USEPOLLING=true
CHOKIDAR_INTERVAL=1000
WATCHPACK_POLLING=true

# ----------------------------------------------------------------------------
# Frontend Configuration
# ----------------------------------------------------------------------------

# Frontend API URL
# Controls how the frontend connects to the backend API
#
# Development Mode (npm run dev):
#   - Vite reads from this .env file
#   - config.ts uses import.meta.env.VITE_API_URL
#   - Set to empty for Vite proxy, or http://localhost:8000 for direct connection
#
# Production Mode (Docker/K8s):
#   - config.ts reads from window._env_.API_URL (runtime config)
#   - This .env value is NOT used in production builds
#   - Production config comes from K8s ConfigMap or Docker env vars
#
# Docker Compose Dev: VITE_API_URL= (empty, uses Vite proxy)
# Native Dev:         VITE_API_URL=http://localhost:8000
# Production:         Set in K8s ConfigMap, not here
#
VITE_API_URL=

# Frontend Allowed Hosts
# Comma-separated list of hostnames allowed to access the Vite dev server
# Used for Host header validation and security
# Leave commented for automatic configuration based on APP_DOMAIN
# VITE_ALLOWED_HOSTS=your-domain.com,studio-test.tesslate.com,localhost

# ----------------------------------------------------------------------------
# Domain and Port Configuration
# ----------------------------------------------------------------------------

# Application Domain (no protocol, just domain)
# This is used for:
#   - Main app routing
#   - OAuth redirect URLs
#   - Subdomain-based project preview environments (project-slug.{APP_DOMAIN})
#   - CORS wildcard pattern matching (*.{APP_DOMAIN})
#
# Local development: localhost (recommended for OAuth compatibility)
# Production: your-domain.com, yourdomain.com, etc.
APP_DOMAIN=localhost

# Traefik additional host rule (for accepting multiple domains)
# Development: Leave empty "" to only accept APP_DOMAIN (localhost)
# Production: Set to empty string "" to only accept APP_DOMAIN
# This adds extra hostnames to Traefik routing rules
TRAEFIK_ADDITIONAL_HOST_RULE=

# Application Protocol (http or https)
APP_PROTOCOL=http

# Application Ports
APP_PORT=80
APP_SECURE_PORT=443
TRAEFIK_DASHBOARD_PORT=8080
BACKEND_PORT=8000
FRONTEND_PORT=5173

# Base URL (complete URL with protocol and domain)
# This is automatically constructed from APP_PROTOCOL and APP_DOMAIN
# Or you can override it directly
APP_BASE_URL=${APP_PROTOCOL}://${APP_DOMAIN}

# Development Server Base URL (for preview containers)
# Docker mode: Leave empty (uses .localhost domains)
# Kubernetes mode: Set to your ingress domain
# DEV_SERVER_BASE_URL=https://studio-test.tesslate.com
DEV_SERVER_BASE_URL=

# ----------------------------------------------------------------------------
# CORS and Security Configuration
# ----------------------------------------------------------------------------

# CORS Allowed Origins (comma-separated list)
# Add all frontend URLs that should be allowed to access the API
# For local development with multiple domains, include both
# For production, include your production domain(s)
CORS_ORIGINS=${APP_BASE_URL},http://localhost

# Allowed Hosts (comma-separated list)
# List of hostnames allowed for Vite dev server and Content Security Policy
# IMPORTANT: Docker Compose doesn't expand ${APP_DOMAIN} in .env file values
# You must set this explicitly based on your APP_DOMAIN
# For local development (APP_DOMAIN=localhost): localhost
# For production (APP_DOMAIN=yourdomain.com): yourdomain.com
ALLOWED_HOSTS=${APP_DOMAIN}

# ----------------------------------------------------------------------------
# Traefik Configuration
# ----------------------------------------------------------------------------

# Traefik Basic Auth for Dashboard (optional)
# Generate with: htpasswd -nb admin your-password
# Default: admin:admin
TRAEFIK_BASIC_AUTH=admin:REDACTED_TRAEFIK_BCRYPT

# ----------------------------------------------------------------------------
# Authentication & OAuth Configuration
# ----------------------------------------------------------------------------

# Google OAuth (for login) - OPTIONAL
# See docs/GOOGLE_OAUTH_SETUP.md for detailed setup instructions
# Create OAuth credentials at: https://console.cloud.google.com/apis/credentials
# Authorized redirect URIs in Google Cloud Console:
#   - http://localhost/api/auth/google/callback (for local development)
#   - https://yourdomain.com/api/auth/google/callback (for production)
# If not configured, Google login will be disabled (graceful degradation)
# GOOGLE_CLIENT_ID=your-client-id.apps.googleusercontent.com
# GOOGLE_CLIENT_SECRET=your-google-client-secret
# GOOGLE_OAUTH_REDIRECT_URI=http://localhost/api/auth/google/callback

# GitHub OAuth (for login) - OPTIONAL
# Create OAuth App at: https://github.com/settings/applications/new
# Authorization callback URL:
#   - http://localhost/api/auth/github/callback (for local development)
#   - https://yourdomain.com/api/auth/github/callback (for production)
# If not configured, GitHub login will be disabled (graceful degradation)
# GITHUB_CLIENT_ID=your_github_client_id
# GITHUB_CLIENT_SECRET=your_github_client_secret
# GITHUB_OAUTH_REDIRECT_URI=http://localhost/api/auth/github/callback

# Vercel OAuth (for deployments) - OPTIONAL
# Create Integration at: https://vercel.com/account/integrations
# Redirect URIs:
#   - http://localhost/api/deployment-oauth/vercel/callback (for local development)
#   - https://yourdomain.com/api/deployment-oauth/vercel/callback (for production)
# If not configured, Vercel deployments will require manual API tokens
# VERCEL_CLIENT_ID=your_vercel_client_id
# VERCEL_CLIENT_SECRET=your_vercel_client_secret
# VERCEL_OAUTH_REDIRECT_URI=http://localhost/api/deployment-oauth/vercel/callback

# Netlify OAuth (for deployments) - OPTIONAL
# Create OAuth App at: https://app.netlify.com/user/applications
# Redirect URIs:
#   - http://localhost/api/deployment-oauth/netlify/callback (for local development)
#   - https://yourdomain.com/api/deployment-oauth/netlify/callback (for production)
# If not configured, Netlify deployments will require manual API tokens
# NETLIFY_CLIENT_ID=your_netlify_client_id
# NETLIFY_CLIENT_SECRET=your_netlify_client_secret
# NETLIFY_OAUTH_REDIRECT_URI=http://localhost/api/deployment-oauth/netlify/callback

# CSRF Protection
# Separate secret key for CSRF tokens (optional - defaults to SECRET_KEY if not set)
# Generate a secure random string (32+ characters recommended)
# CSRF_SECRET_KEY=your-csrf-secret-key-here

# CSRF token maximum age in seconds
# Default: 86400 (24 hours)
# CSRF_TOKEN_MAX_AGE=86400

# Cookie Security Settings
# Set COOKIE_SECURE=true in production (requires HTTPS)
# Options: true, false
COOKIE_SECURE=false
# Cookie SameSite policy for CSRF protection
# Options: lax, strict, none
COOKIE_SAMESITE=lax
# Cookie domain for authentication cookies (IMPORTANT for subdomains)
# Local dev: Set to ".localhost" to work across localhost and project-slug.localhost
# Production: Set to your root domain (e.g., ".tesslate.com") to work across all subdomains
# Leave empty to restrict cookie to exact domain where it's set
COOKIE_DOMAIN=.localhost

# ----------------------------------------------------------------------------
# Deployment Configuration (Multi-Provider Deployments)
# ----------------------------------------------------------------------------

# Deployment Encryption Key (base64 encoded Fernet key)
# Used to securely encrypt deployment provider credentials (Cloudflare, Vercel, Netlify, etc.)
# If not set, will be derived from SECRET_KEY
# Generate a new key: python -c "from cryptography.fernet import Fernet; print(Fernet.generate_key().decode())"
# DEPLOYMENT_ENCRYPTION_KEY=your_base64_fernet_key_here

# Deployment timeout in seconds (default: 600 = 10 minutes)
# Maximum time allowed for deployment operations
# DEPLOYMENT_TIMEOUT=600

# Default build output directory (default: dist)
# Can be overridden per framework (e.g., .next for Next.js, build for CRA)
# DEPLOYMENT_BUILD_DIR=dist

# Provider API Base URLs (optional - has defaults)
# Only override if you need to use different API endpoints
# CLOUDFLARE_API_BASE=https://api.cloudflare.com/client/v4
# VERCEL_API_BASE=https://api.vercel.com
# NETLIFY_API_BASE=https://api.netlify.com/api/v1

# Heroku OAuth (optional — API key fallback available)
# Create OAuth App at: https://devcenter.heroku.com/articles/oauth
# HEROKU_CLIENT_ID=your_heroku_client_id
# HEROKU_CLIENT_SECRET=your_heroku_client_secret
# HEROKU_OAUTH_REDIRECT_URI=http://localhost/api/deployment-oauth/heroku/callback

# DigitalOcean OAuth (optional — API token fallback available)
# Create OAuth App at: https://cloud.digitalocean.com/account/api/applications
# DIGITALOCEAN_CLIENT_ID=your_digitalocean_client_id
# DIGITALOCEAN_CLIENT_SECRET=your_digitalocean_client_secret
# DIGITALOCEAN_OAUTH_REDIRECT_URI=http://localhost/api/deployment-oauth/digitalocean/callback

# Container Push Configuration
# CONTAINER_PUSH_TIMEOUT=900
# KANIKO_IMAGE=gcr.io/kaniko-project/executor:latest
# CONTAINER_PUSH_DEFAULT_CPU=0.25
# CONTAINER_PUSH_DEFAULT_MEMORY=512Mi

# Note: Individual provider credentials (Railway, Render, Heroku, AWS, GCP, Azure,
# Fly.io, Docker Hub, GHCR, Firebase, etc.) are stored per-user via the
# Settings → Deployment Providers UI. No server-level env vars needed.

# ----------------------------------------------------------------------------
# PostHog Analytics (OPTIONAL)
# ----------------------------------------------------------------------------
# Development Mode: config.ts reads from import.meta.env.VITE_PUBLIC_POSTHOG_*
# Production Mode: config.ts reads from window._env_.POSTHOG_* (K8s ConfigMap/Secret)
# Leave empty to disable analytics
VITE_PUBLIC_POSTHOG_KEY=
VITE_PUBLIC_POSTHOG_HOST=https://app.posthog.com

# ----------------------------------------------------------------------------
# Stripe Configuration (for payments and subscriptions)
# ----------------------------------------------------------------------------

# Stripe API Keys
# Test mode keys: sk_test_*, pk_test_*
# Production mode keys: sk_live_*, pk_live_*
# Get from: https://dashboard.stripe.com/apikeys
STRIPE_SECRET_KEY=sk_test_your_stripe_secret_key_here
STRIPE_PUBLISHABLE_KEY=pk_test_your_stripe_publishable_key_here

# Stripe Webhook Secret
# Get from: https://dashboard.stripe.com/webhooks
# For local testing: Use Stripe CLI (stripe listen --forward-to localhost:8000/api/webhooks/stripe)
STRIPE_WEBHOOK_SECRET=whsec_your_webhook_secret_here

# Stripe Connect (for creator payouts)
# Get from: https://dashboard.stripe.com/settings/applications
STRIPE_CONNECT_CLIENT_ID=ca_your_connect_client_id_here

# ----------------------------------------------------------------------------
# Subscription Pricing Configuration
# ----------------------------------------------------------------------------

# Stripe Price IDs for Subscription Tiers (Monthly)
# Create in Stripe Dashboard: Products -> Create Product -> Recurring
STRIPE_BASIC_PRICE_ID=price_your_basic_monthly_price_id
STRIPE_PRO_PRICE_ID=price_your_pro_monthly_price_id
STRIPE_ULTRA_PRICE_ID=price_your_ultra_monthly_price_id

# Stripe Price IDs for Subscription Tiers (Annual)
STRIPE_BASIC_ANNUAL_PRICE_ID=price_your_basic_annual_price_id
STRIPE_PRO_ANNUAL_PRICE_ID=price_your_pro_annual_price_id
STRIPE_ULTRA_ANNUAL_PRICE_ID=price_your_ultra_annual_price_id

# Credit Packages (price in cents, 1:1 ratio with credits)
CREDIT_PACKAGE_SMALL=500       # $5 for 500 credits
CREDIT_PACKAGE_MEDIUM=2500     # $25 for 2,500 credits
CREDIT_PACKAGE_LARGE=10000     # $100 for 10,000 credits
CREDIT_PACKAGE_TEAM=50000      # $500 for 50,000 credits

# Deploy Pricing (in cents)
ADDITIONAL_DEPLOY_PRICE=1000  # $10

# ----------------------------------------------------------------------------
# Subscription Tier Limits
# ----------------------------------------------------------------------------

# Tier Limits (see config.py for all tier settings)
# FREE: 3 projects, 5 credits/day
# BASIC ($20/mo): 7 projects, 500 credits/mo, BYOK
# PRO ($49/mo): 15 projects, 2,000 credits/mo, BYOK
# ULTRA ($149/mo): 40 projects, 8,000 credits/mo, BYOK

# Signup Bonus
SIGNUP_BONUS_CREDITS=15000
SIGNUP_BONUS_EXPIRY_DAYS=60

# ----------------------------------------------------------------------------
# Revenue Sharing Configuration
# ----------------------------------------------------------------------------

# Creator revenue share (decimal, 0.90 = 90%)
CREATOR_REVENUE_SHARE=0.90

# Platform revenue share (decimal, 0.10 = 10%)
PLATFORM_REVENUE_SHARE=0.10

# ----------------------------------------------------------------------------
# Billing Settings
# ----------------------------------------------------------------------------

# Day of month to generate usage invoices (1-28)
# Monthly billing for API-based agent usage
USAGE_INVOICE_DAY=1

# ----------------------------------------------------------------------------
# SMTP Configuration (for 2FA email codes)
# ----------------------------------------------------------------------------
# SMTP server for sending verification codes during login.
# If not configured, codes are logged to console (development mode).
# For production, use a service like AWS SES, SendGrid, Mailgun, etc.

# SMTP_HOST=smtp.example.com
# SMTP_PORT=587
# SMTP_USERNAME=your_smtp_username
# SMTP_PASSWORD=your_smtp_password
# SMTP_USE_TLS=true
# SMTP_SENDER_EMAIL=noreply@yourdomain.com

# Two-Factor Authentication
# Set to true to enable email 2FA for all email/password logins.
# When enabled, a 6-digit email code is required after password verification.
# Requires SMTP to be configured above.
# Default: false
# TWO_FA_ENABLED=false

# ----------------------------------------------------------------------------
# Kubernetes Multi-Container Architecture (for DEPLOYMENT_MODE=kubernetes)
# ----------------------------------------------------------------------------

# Storage class for shared source code (must support ReadWriteMany for multi-container)
# Common options: nfs-client, efs-sc (AWS), azurefile (Azure), longhorn
# Optional - Default: nfs-client
# K8S_RWX_STORAGE_CLASS=nfs-client

# Ingress controller class name
# Common options: nginx, traefik, alb (AWS), gce (GCP)
# Optional - Default: nginx
# K8S_INGRESS_CLASS=nginx

# Enable namespace-per-project isolation (recommended for production)
# When true, each project gets its own namespace (proj-{uuid})
# When false, uses legacy shared namespace mode
# Optional - Default: true
# K8S_NAMESPACE_PER_PROJECT=true

# Enable NetworkPolicy creation for project isolation
# Requires CNI plugin with NetworkPolicy support (Calico, Cilium, Weave)
# Optional - Default: true
# K8S_ENABLE_NETWORK_POLICIES=true

# ----------------------------------------------------------------------------
# S3/Object Storage for Kubernetes Ephemeral Architecture (Hibernation)
# ----------------------------------------------------------------------------
# Enable S3-backed storage for Kubernetes mode (hibernation/hydration model)
# When true, project files are stored in S3 and loaded/saved on pod start/stop
# When false, uses persistent PVCs (default, recommended for multi-container)
# Optional - Default: false
# K8S_USE_S3_STORAGE=false

# S3-compatible storage settings (DigitalOcean Spaces, AWS S3, MinIO, etc.)
# Required if K8S_USE_S3_STORAGE=true
# S3_ACCESS_KEY_ID=your_s3_access_key_id
# S3_SECRET_ACCESS_KEY=your_s3_secret_access_key
# S3_ENDPOINT_URL=https://nyc3.digitaloceanspaces.com
# Optional - Default: tesslate-projects
# S3_BUCKET_NAME=tesslate-projects
# Optional - Default: us-east-1
# S3_REGION=us-east-1
# Optional - Default: projects
# S3_PROJECTS_PREFIX=projects

# Hibernation/Hydration settings (S3-backed storage mode)
# Optional - Default: 2880
# K8S_HIBERNATION_IDLE_MINUTES=2880
# Optional - Default: 300
# K8S_HYDRATION_TIMEOUT_SECONDS=300
# Optional - Default: 120
# K8S_DEHYDRATION_TIMEOUT_SECONDS=120

# Dynamic PVC settings (S3-backed storage mode)
# Optional - Default: do-block-storage
# K8S_PVC_STORAGE_CLASS=do-block-storage
# Optional - Default: 5Gi
# K8S_PVC_SIZE=5Gi
# Optional - Default: ReadWriteOnce
# K8S_PVC_ACCESS_MODE=ReadWriteOnce


# ═══════════════════════════════════════════════════════════════════
# MCP Connector OAuth Apps (platform_app registration method)
# ═══════════════════════════════════════════════════════════════════
# Some MCP servers (GitHub Copilot MCP, Slack) don't advertise RFC 7591
# Dynamic Client Registration, so they require a pre-registered OAuth
# app owned by this Tesslate instance. Register an app with the provider,
# set the callback URL to  <PUBLIC_BASE_URL>/api/mcp/oauth/callback,
# and paste the credentials here.
#
# Dev callback URL:  http://localhost/api/mcp/oauth/callback
# Prod callback URL: https://<your-domain>/api/mcp/oauth/callback

# GitHub Copilot MCP — register at https://github.com/settings/developers
# MCP_OAUTH_APP_GITHUB_CLIENT_ID=
# MCP_OAUTH_APP_GITHUB_CLIENT_SECRET=

# Slack MCP — register a Slack app with OAuth scopes
# MCP_OAUTH_APP_SLACK_CLIENT_ID=
# MCP_OAUTH_APP_SLACK_CLIENT_SECRET=