.env.example

# Copy to .env and fill in. .env is gitignored; .env.example is committed.

# Anthropic API key for the Claude Agent SDK (daemon, Spike 1).
# Get one at https://console.anthropic.com/settings/keys
ANTHROPIC_API_KEY=sk-ant-xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx

# Relay <-> daemon / web. Override to point a daemon at a self-hosted relay.
TELECODE_RELAY_URL=ws://127.0.0.1:8080/ws
RELAY_PORT=8080

# Postgres for the relay's registries. Local dev uses the Supabase stack (`supabase start`);
# the port comes from supabase/config.toml ([db] port). CI sets this to a Postgres container.
DATABASE_URL=postgresql://postgres:postgres@127.0.0.1:54522/postgres

# Relay auth secrets. CHANNEL_TOKEN_SECRET signs the short-lived browser channel tokens (relay-only).
# RELAY_SERVICE_SECRET authenticates the web tier's server-to-server calls to the relay; the web app
# must be given the SAME value. Generate with: openssl rand -base64url 32  (or node crypto.randomBytes).
CHANNEL_TOKEN_SECRET=replace-with-a-32-byte-random-secret
RELAY_SERVICE_SECRET=replace-with-a-32-byte-random-secret
# TOKEN_ENCRYPTION_KEY encrypts the user's stored GitHub OAuth token at rest (relay-only). Must be
# EXACTLY 32 bytes, base64. Generate with: openssl rand -base64 32. Unset disables repo listing.
TOKEN_ENCRYPTION_KEY=replace-with-a-base64-encoded-32-byte-key

# Web tier (SvelteKit). RELAY_HTTP_URL is the relay's HTTP base for server-to-server auth calls;
# APP_URL is the public origin used to build the OAuth redirect URI; PUBLIC_TELECODE_RELAY_URL is the
# relay WS URL the browser dials. Optional GITHUB_CLIENT_ID/SECRET enable real GitHub OAuth (otherwise
# dev login is offered).
RELAY_HTTP_URL=http://127.0.0.1:8080
APP_URL=http://127.0.0.1:5173
PUBLIC_TELECODE_RELAY_URL=ws://127.0.0.1:8080/ws
# GITHUB_CLIENT_ID=
# GITHUB_CLIENT_SECRET=

# Web push (VAPID). The relay holds the private key + signs pushes; the browser needs the public key to
# subscribe. Generate a pair with: node -e "console.log(require('web-push').generateVAPIDKeys())".
# Set the SAME public key for both VAPID_PUBLIC_KEY (relay) and PUBLIC_VAPID_KEY (web). Unset disables push.
VAPID_SUBJECT=mailto:admin@telecode.local
VAPID_PUBLIC_KEY=
VAPID_PRIVATE_KEY=
PUBLIC_VAPID_KEY=