# Forge — environment config. Copy to `.env` at the repo ROOT (gitignored) and set real values.
# All backend vars are prefixed FORGE_. This file holds PLACEHOLDERS ONLY — never commit real secrets.

# --- Core ---
FORGE_ENVIRONMENT=development            # "production" enforces the checklist at the bottom

# --- Platform auth ---
FORGE_JWT_SECRET=dev-insecure-change-me  # MUST be a strong random value in production
# FORGE_AUTH_REQUIRED=true               # default true — keep true so the service token is a real gate
FORGE_BOOTSTRAP_ADMIN_EMAIL=you@forge.local
FORGE_BOOTSTRAP_ADMIN_PASSWORD=forge-admin   # change for production

# --- Server-to-server barrier (an app backend → Forge) ---
# Static bearer that authenticates a trusted backend as a least-privilege service identity.
# Generate:  python -c "import secrets; print(secrets.token_urlsafe(32))"
FORGE_SERVICE_API_TOKEN=

# --- SSRF egress: allow specific private/loopback hosts (dev/testing only) ---
FORGE_EGRESS_ALLOW_PRIVATE_HOSTS=[]      # e.g. ["localhost","127.0.0.1"]  (Docker: ["host.docker.internal"])

# --- Tools: per-environment values ---
# A JSON map exposed to REST/GraphQL tool + auth templates as {{env.*}}, so the SAME tool row
# resolves to a different host per deploy (dev/qa/prod). A template referencing a key NOT in this
# map fails the call loudly. Blank/unset = {}.
FORGE_TOOL_VARS=                         # e.g. {"api_base":"https://api.example.com"}
# Deployment-wide fallback for a per-user auth provider's `token_ctx_key`: the run-context key an
# integration forwards its per-user token under (via X-Forge-Context) when a provider doesn't set
# its own. Empty = off. e.g. user_token
FORGE_DEFAULT_TOKEN_CTX_KEY=

# --- Model (needed for live agent runs) ---
FORGE_DEFAULT_MODEL=fake:echo            # offline-safe; set a real model for live runs, e.g. gpt-4.1-mini
# OPENAI_API_KEY=sk-...
# ANTHROPIC_API_KEY=sk-ant-...

# --- Frontend ---
NEXT_PUBLIC_FORGE_API_URL=http://localhost:8000

# ============================================================================
# PRODUCTION (Docker stack) — uncomment/set when deploying:
#   POSTGRES_PASSWORD=<db-password>          # compose substitutes this into the DB URL
#   FORGE_DATABASE_URL=postgresql+psycopg://forge:<pw>@localhost:5432/forge
#   FORGE_CHECKPOINT_BACKEND=postgres
#   FORGE_REDIS_URL=redis://localhost:6379/0
# The app REFUSES to boot in production unless: strong FORGE_JWT_SECRET,
# FORGE_AUTH_REQUIRED=true, FORGE_EGRESS_BLOCK_PRIVATE=true, Postgres FORGE_DATABASE_URL.
# ============================================================================