# GOD CRM Backend Environment Configuration
# Copy this file to .env and fill in your actual values.
# NEVER commit .env or .env.prod to git (ADR-064).
#
# After D14 (2026-05-18) cutover (ADR-0040), the keys marked
# "[VAULT-MIGRATED]" below are read from the encrypted `_secrets` registry
# instead of process.env. On first owner login, add them via:
#   Settings → Secrets  (only the space-11 owner can access this tab)
# For local dev or self-hosters, populating the env values still works
# as a transitional fallback until D14; after that the env reads are
# removed from consumer code (see backend/services/secrets/registry.js).

# =============================================
# Core Settings
# =============================================
PORT=5000
NODE_ENV=development

# =============================================
# Bootstrap Secrets — must be in env (never in vault).
# =============================================
# AES-256-GCM master key for the SecretsVault — generate with:
#   openssl rand -base64 32
# Must be set on every host. Production fails-fast if missing.
SECRETS_MASTER_KEY=your_secrets_master_key_base64_here

# JWT / sessions / column-level encryption — bootstrap-only (vault depends on them).
JWT_SECRET=your_jwt_secret_here_change_in_production
ENCRYPTION_KEY=your_32_char_encryption_key_here
MASTER_ENCRYPTION_KEY=your_64_char_hex_master_key_here

# =============================================
# Database Configuration (ADR-017)
# Options: sqlite | postgres
# =============================================
DATABASE_TYPE=postgres
DATABASE_PATH=/var/lib/business-crm-data/crm.db
POSTGRES_HOST=localhost
POSTGRES_PORT=5432
POSTGRES_DB=godcrm
POSTGRES_USER=godcrm
POSTGRES_PASSWORD=your_postgres_password_here

# =============================================
# Application URL
# =============================================
APP_URL=http://localhost:5000

# =============================================
# Non-secret integration config (always in env, never in vault).
# =============================================
SMTP_HOST=smtp.gmail.com
SMTP_PORT=587
SMTP_SECURE=false
SMTP_FROM=your_email@gmail.com

OPENCODE_SERVER_URL=http://localhost:4096
OPENCODE_SERVER_USERNAME=opencode

GOOGLE_OAUTH_REDIRECT_URI=http://localhost:5000/auth/google/callback
TELEGRAM_ADMIN_CHAT_ID=your_telegram_user_id_here
NIKITRON_CHAT_ID=your_telegram_user_id_here
NIKITRON_BOT_NAME=NikitronBot
WA_DEFAULT_MAP_URL=/maps/office/main.json
WA_URL=https://wa.hltrn.cc
LIVEKIT_URL=ws://<RELAY_IP>:7880

# =============================================
# Code Execution Engines (ADR-032)
# =============================================
JUDGE0_URL=http://localhost:2358
PISTON_URL=http://localhost:2000
BACKEND_URL=http://localhost:5000

# =============================================
# Tier-1 Secrets — moved to Settings → Secrets (ADR-0040).
# =============================================
# Adding these to .env is OPTIONAL during the transition (auto-seeded on
# `node backend/scripts/seed-secrets-from-env.js`). After D14 (2026-05-18)
# they are read exclusively from the vault and these env lines are deleted
# from the consumer code paths.
#
# [VAULT-MIGRATED] vault_key                envName
# openai_api_key                            OPENAI_API_KEY
# anthropic_api_key                         ANTHROPIC_API_KEY
# gemini_api_key                            GEMINI_API_KEY | GOOGLE_AI_API_KEY | GOOGLE_API_KEY
# replicate_api_key                         REPLICATE_API_KEY
# firecrawl_api_key                         FIRECRAWL_API_KEY
# telegram_bot_token                        TELEGRAM_BOT_TOKEN
# nikitron_bot_token                        NIKITRON_BOT_TOKEN
# livekit_api_key                           LIVEKIT_API_KEY
# livekit_api_secret                        LIVEKIT_API_SECRET
# wa_webhook_secret                         WA_WEBHOOK_SECRET
# smtp_user                                 SMTP_USER
# smtp_pass                                 SMTP_PASS
# hcaptcha_secret                           HCAPTCHA_SECRET
# google_oauth_client_secret                GOOGLE_CLIENT_SECRET
# opencode_server_password                  OPENCODE_SERVER_PASSWORD