# rakazo/.env
#
# Read twice by the deployment, which is why it lives here next to the compose
# file:
#   1. Docker Compose interpolation (${VAR} in docker-compose.yml).
#   2. Every bare `KEY:` entry in the compose file pulls its value from the
#      compose process environment, which Compose loads from this file because
#      it sits in the project directory.
#
# Committed to the private Gitea repo, like every other stack in this repo
# (news, caveman, litellm all do the same). Portainer's stack env list is empty
# by design: the file in the clone is the single source of truth, so a redeploy
# cannot drift from what is committed.
#
# SECRET HANDLING: the five values below must all be different. Losing
# ENCRYPTION_KEY makes stored model/bot credentials unreadable; losing
# POSTGRES_* desynchronises the passwords from an existing pgdata volume.
# Treat this file and the volumes together, and take backups as a pair.

# --- Postgres -------------------------------------------------------------
POSTGRES_USER=rakazo
POSTGRES_PASSWORD=8b7f13036cbfca2949c575a5cf18eec3
POSTGRES_DB=rakazo
# The app's own login, subject to row-level security (not superuser).
POSTGRES_APP_PASSWORD=4b8b3894e4793c5a33240dd3e77aa0c1

# --- Core secrets (independent values, 64 hex chars each) -----------------
# Auth/session signing. Rotating it invalidates every session.
BETTER_AUTH_SECRET=a47f2a88cdf99bb542193badb70f57bc1faad7f93639cd5f9b1c6842ba2ad037
# Encrypts stored credentials at rest. Never rotate on a live deployment.
ENCRYPTION_KEY=fb480075ae44d2f907ff13b0510b96677d2cdcf3601035511c2650c4dc66e803
# Signs the short-lived /novnc/* screen capabilities.
SCREEN_PROXY_SECRET=69e405dcfc82d4e21cdfea0652a21b9e8ac0e96daff02cb90fdebf11adb6b11c
# API <-> sandbox supervisor. Required: empty makes `compose up` fail closed.
SANDBOX_SUPERVISOR_TOKEN=9b52f1329b86eb45d29819ad3e0f113aad9e6feb12dd976ce5133b35f210b599

# --- Content --------------------------------------------------------------
# on = encrypt new message content at rest (existing ciphertext still reads if
# switched off). Left on: bots see mail, calendars and files.
CONTENT_ENCRYPTION=on
SECRET_STORE=encrypted
MAX_UPLOAD_SIZE_MB=10

# --- Public origin --------------------------------------------------------
# All three must be the same https:// URL, and RAKAZO_HOST must be the bare
# hostname: the Vite preview server only answers for hosts on this allowlist.
# Caddy on the VPS terminates TLS and proxies over WireGuard to this host.
BETTER_AUTH_URL=https://rakazo.mildgrim.com
WEB_ORIGIN=https://rakazo.mildgrim.com
API_URL=https://rakazo.mildgrim.com
RAKAZO_HOST=rakazo.mildgrim.com

# --- Published ports ------------------------------------------------------
# 0.0.0.0 so the WireGuard-routed edge reaches it. Narrow this to the host's
# WireGuard address to take the port off the LAN. Do not publish 3100: the web
# container proxies /api and /rpc, and the API port is loopback-only upstream.
RAKAZO_BIND_IP=0.0.0.0
RAKAZO_WEB_PORT=5173
RAKAZO_API_PORT=3100

# --- Signups --------------------------------------------------------------
# First registered user becomes the deployment owner. Order of operations:
#   1. Deploy with SIGNUPS_ENABLED=true and the allowlist below.
#   2. Register sebastian@mildgrim.com, connect a model.
#   3. Set SIGNUPS_ENABLED=false, commit, let the webhook redeploy.
# The allowlist already means only that address can register; step 3 closes the
# endpoint outright rather than relying on the allowlist alone.
SIGNUPS_ENABLED=true
SIGNUP_ALLOWLIST=sebastian@mildgrim.com

# --- Bot computers --------------------------------------------------------
# docker = the in-stack supervisor drives this host's Docker daemon, so bot
# computers are sibling containers here. No E2B/Daytona account needed.
SANDBOX_PROVIDER=docker
# Fail closed instead of "auto": computers refuse to start unless the host
# ruleset is installed. Run, once per host, from the repo checkout:
#   sudo bash rakazo/restrict-computer-egress.sh
SANDBOX_COMPUTER_EGRESS=restricted
# Restricted egress drops forwards to the host's resolver (it lives on the LAN),
# so point computers at public resolvers.
SANDBOX_COMPUTER_DNS=1.1.1.1,1.0.0.1
# Per-computer ceilings. Each bot computer is a full Xvfb + window manager +
# Chromium desktop.
RAKAZO_COMPUTER_MEMORY=2g
RAKAZO_COMPUTER_CPUS=2
RAKAZO_COMPUTER_PIDS_LIMIT=2048

# --- Private-network reachability ----------------------------------------
# false: bots and tool sources cannot reach 192.168.1.0/24 (Gitea, Portainer,
# n8n, LiteLLM...). Flip to true only if you deliberately want a bot to drive a
# LAN service; it widens what a prompt injection can reach.
MCP_ALLOW_PRIVATE_ENDPOINT=false

# --- Images ---------------------------------------------------------------
# edge tracks upstream main and is rebuilt on every merge. Pin a published
# vX.Y.Z tag instead for a reproducible deploy (README, "Upgrading").
RAKAZO_IMAGE=ghcr.io/elie222/rakazo/app
RAKAZO_IMAGE_TAG=edge
RAKAZO_COMPUTER_IMAGE=ghcr.io/elie222/rakazo/computer
RAKAZO_COMPUTER_IMAGE_TAG=edge

# --- Model credentials (optional) ----------------------------------------
# Leave blank and connect models in the UI (per bot), or set a key here for
# deployment-wide models. Rakazo never bills for models: these are your keys.
OPENROUTER_API_KEY=
ANTHROPIC_API_KEY=
DEEPSEEK_API_KEY=
# Plugins via Composio. Optional; the built-in tool sources work without it.
COMPOSIO_API_KEY=

# --- Password recovery (optional) ---------------------------------------
# Blank means a lost owner password is a database-level recovery, not an email
# reset. Both keys are needed together (Resend or Amazon SES both work).
SMTP_URL=
EMAIL_FROM=

# --- Logs and error reporting -------------------------------------------
LOG_LEVEL=info
LOG_FORMAT=
SENTRY_DSN=
SENTRY_BROWSER_DSN=

# --- Deliberately unset --------------------------------------------------
# TRUSTED_PROXIES / CLIENT_IP_HEADER: leave unset. Upstream then trusts this
# stack's own networks plus a host-side reverse proxy. Setting it to the VPS
# Caddy's WireGuard address is the only change needed if you later want
# per-client IPs for rate limiting.
#
# RAKAZO_LOCAL_MODELS / RAKAZO_LOCAL_MODELS_URL: the LiteLLM wiring (see
# README, "Routing bots through LiteLLM"). Requires joining this stack to
# litellm_net first, so it is not enabled here.
