# GOD CRM self-host configuration.
# Copy to `.env` (cp env.example .env) and fill in.
# `install.sh` creates this file and generates the secrets for you.

# ---- How you reach the app ----
# Host port the CRM is published on.
APP_PORT=5000
# Public origin(s) the browser uses, comma-separated. MUST match how you open
# the app (a mismatch serves a white screen — CORS gates the static assets).
# Examples: http://localhost:5000  |  https://crm.example.com
PUBLIC_URL=http://localhost:5000

# ---- Database (CRM) ----
POSTGRES_DB=godcrm
POSTGRES_USER=godcrm
# REQUIRED. Generate: openssl rand -hex 24
POSTGRES_PASSWORD=

# ---- Secrets (REQUIRED) ----
# Generate each: openssl rand -hex 32   (SECRETS_MASTER_KEY: openssl rand -base64 32)
JWT_SECRET=
SESSION_SECRET=
ENCRYPTION_KEY=
MASTER_ENCRYPTION_KEY=
SECRETS_MASTER_KEY=
CRM_CREDENTIAL_KEY=

# ---- Hindsight MemPalace (OPTIONAL — only used with `--profile memory`) ----
# Our own MemPalace fork (ADR-148), published to GHCR — pulls automatically,
# no build step. Pin a tag/digest here if you want to freeze the version.
HINDSIGHT_IMAGE=ghcr.io/holetron/hindsight-mempalace:latest
# Where the CRM finds Hindsight. Leave as-is for the bundled service.
HINDSIGHT_URL=http://hindsight:5100
# Hindsight's own database password. Generate: openssl rand -hex 24
HINDSIGHT_DB_PASSWORD=
# LLM used to classify memories (embeddings/reranker run locally on CPU).
LLM_PROVIDER=openai
LLM_API_KEY=
LLM_MODEL=gpt-4o-mini