# Cauldron — copy to .env (chmod 600). Point compose at it via
# CAULDRON_ENV_FILE if you keep it elsewhere.

# Flask
SECRET_KEY=change-me-32-bytes-of-entropy

# Bind
BIND_HOST=0.0.0.0
BIND_PORT=7790

# Mealie
MEALIE_BASE_URL=https://mealie.example.com
MEALIE_API_TOKEN=

# clawdforge (claude-runner HTTP service)
CLAWDFORGE_URL=http://clawdforge:8800
CLAWDFORGE_TOKEN=
DEFAULT_MODEL=sonnet
DEFAULT_TIMEOUT_SECS=120

# Admin bearer for batch ops (sterilize-all, etc.) — separate from user OIDC
ADMIN_BEARER=change-me-this-is-the-cauldron-admin-batch-token

# Authentik OIDC (or any OIDC provider that exposes
# /.well-known/openid-configuration)
OIDC_ISSUER=https://auth.example.com/application/o/cauldron/
OIDC_CLIENT_ID=
OIDC_CLIENT_SECRET=
OIDC_REDIRECT_URI=http://localhost:7790/auth/callback

# DB
DB_HOST=mariadb
DB_PORT=3306
DB_NAME=cauldron
DB_USER=cauldron_app
DB_PASSWORD=

# Fernet master key for at-rest encryption of per-user Mealie tokens.
# Generate with: python -c "from cryptography.fernet import Fernet; print(Fernet.generate_key().decode())"
CAULDRON_FERNET_KEY=

# --- Public-deploy hardening ---
# Comma-separated list of OIDC subjects who get the operator-tier /me
# admin tools panel (consolidate, discover scrape). Empty = nobody.
CAULDRON_ADMIN_SUBS=

# External base URL where cauldron is reachable (e.g. https://cauldron.example.com).
# Leave empty for LAN-only HTTP. When set: enables CSRF Origin guard,
# HSTS, secure cookie.
CAULDRON_BASE_URL=

# Whether the deploy is fronted by TLS. Independent toggle from base_url
# so dev/staging can override. When true: SESSION_COOKIE_SECURE=True,
# HSTS header emitted.
CAULDRON_BEHIND_TLS=false

# Comma-separated CIDR list of trusted proxies whose X-Forwarded-* we
# honor. Empty = trust nothing → ProxyFix is OFF and X-Forwarded-* are
# stripped from every request. Set this to the reverse-proxy peer's
# address (e.g. 10.20.30.1/32). Any X-Forwarded-* from a peer outside
# this list gets dropped before ProxyFix sees it.
CAULDRON_TRUSTED_PROXIES=

# bugs.sulkta.com integration. Per-service key minted via:
#   docker exec bugs-sulkta bugs-sulkta-cli keys create --service=cauldron \
#     --scopes=read,write,update --description="cauldron prod"
# Empty = bugs page renders a "not configured" placeholder; POSTs return 503.
BUGS_API_KEY=
# Override only for staging / on-prem bugs deployments. Default is fine.
BUGS_BASE_URL=https://bugs.sulkta.com