.env.example

# Note: Copy these variables in your .env file

# DATABASE_URL=file:./dev.db

# If you are running it on a remote server/homelab, you must update timezone otherwise activities times may shift
TZ=America/Edmonton

# For homelab server, change the following to your server ip ex: http://192.168.x.x:3000
NEXTAUTH_URL=http://localhost:3737

# AUTH_SECRET is auto-generated by deploy.sh and docker-entrypoint.sh
# To set manually, uncomment and provide your own value:
# AUTH_SECRET=

# ENCRYPTION_KEY is used to encrypt stored API keys (OpenAI, DeepSeek, RapidAPI)
# Must be stable across restarts — changing it will make all stored API keys unrecoverable
# Generate with: openssl rand -base64 32
# ENCRYPTION_KEY=

# ADMIN_USER_IDS — Comma-separated allowlist of user IDs permitted to perform
# admin-only actions (module activation/deactivation and other shared-state
# mutations). Required for MULTI-USER deployments. Single-user self-hosted
# deployments can leave this UNSET — the sole user is implicitly admin via
# the tiered rule (see CLAUDE.md § Admin Authorization Tiered Rule).
#
# Tier A: if ADMIN_USER_IDS is set, ONLY listed ids are admins.
# Tier B: if unset AND exactly one user exists in the DB, that user is admin.
# Tier C: if unset AND more than one user exists, every admin call is DENIED.
#
# Multi-user deployments that forget to set this will see admin toggles stop
# working until the env var is configured and the instance restarted.
# Example: ADMIN_USER_IDS=d1e2f3a4-0000-0000-0000-000000000001,9a8b7c6d-0000-0000-0000-000000000002
# ADMIN_USER_IDS=

OPENAI_API_KEY=your-openai-api-key-here

# DeepSeek API Key - get from https://platform.deepseek.com
DEEPSEEK_API_KEY=your-deepseek-api-key-here

# For homelab server, if you ollama is running on server, change the following to your ollamma ip ex: http://192.168.x.x:12345
OLLAMA_BASE_URL=http://host.docker.internal:11434

# AI Configuration
# The system uses LLM-based semantic extraction for intelligent, context-aware skill matching
# No configuration needed - semantic extraction is the default

RAPIDAPI_KEY=your-rapidapi-key-here

# Logo.dev API Key — high-quality company logos in enrichment chain
# Optional: without key, falls back to Google Favicon (lower quality)
# Get from https://logo.dev — free tier available
LOGODEV_API_KEY=your-logodev-api-key-here

# Debug logging — set to "false" to suppress debug console.log output from
# scheduler, runner, and automation-logger. Default: enabled.
DEBUG_LOGGING=true

# Allowed dev origins for cross-origin requests (comma-separated)
# Required when accessing the dev server from a different host (e.g., homelab, VM, Tailscale)
# Example: ALLOWED_DEV_ORIGINS=192.168.1.100,myhost.tail1234.ts.net
# ALLOWED_DEV_ORIGINS=

# Playwright E2E Tests — use system Chromium on NixOS (bundled binary lacks libXfixes.so.3)
# PLAYWRIGHT_CHROMIUM_EXECUTABLE_PATH=/run/current-system/sw/bin/chromium

# Developer / Mock Data
# Set to "true" to enable the Developer Options page and mock data generation
# in production builds. In development mode (NODE_ENV=development), the page
# is always available regardless of this setting.
# Uses NEXT_PUBLIC_ prefix so the sidebar can show/hide the link on the client.
# NEXT_PUBLIC_ENABLE_MOCK_DATA=false