.env.example

# ── Database ─────────────────────────────────────────────────────
POSTGRES_USER=doc
POSTGRES_PASSWORD=changeme_in_production
POSTGRES_DB=doc
DATABASE_URL=postgresql+asyncpg://doc:changeme_in_production@db:5432/doc

# Password used by the Postgres streaming-replication role.
# Only matters if you run the primary/standby compose files; safe to leave
# as-is for a standalone install.
REPLICATION_PASSWORD=changeme_replication_password

# Redis
REDIS_URL=redis://redis:6379/0

# Ollama
OLLAMA_BASE_URL=http://ollama:11434
OLLAMA_MODEL=qwen2.5:3b

# LLM Provider: "ollama" (local, default) or "claude" (Anthropic cloud API)
LLM_PROVIDER=ollama
ANTHROPIC_API_KEY=

# OpenDroneLog (optional — only needed for migration of existing data)
OPENDRONELOG_URL=http://your-opendronelog-host:8080

# DJI API Key (required for parsing encrypted DJI flight logs from newer drones)
# Register at https://developer.dji.com to obtain a key
DJI_API_KEY=

# JWT
JWT_SECRET_KEY=changeme_generate_a_random_secret
JWT_ALGORITHM=HS256
JWT_ACCESS_TOKEN_EXPIRE_MINUTES=30
JWT_REFRESH_TOKEN_EXPIRE_DAYS=30

# SMTP (configure in Settings page or here)
SMTP_HOST=
SMTP_PORT=587
SMTP_USER=
SMTP_PASSWORD=
SMTP_FROM_EMAIL=
SMTP_FROM_NAME=
SMTP_USE_TLS=true

# App
APP_NAME=DroneOpsCommand
UPLOAD_DIR=/data/uploads
REPORTS_DIR=/data/reports

# Frontend URL (used in intake email links — must be reachable by customers)
# For LAN-only: http://192.168.1.50:3080  |  For tunnel: https://yourdomain.com
FRONTEND_URL=http://localhost:3080

# Frontend port (set to 127.0.0.1:3080 to restrict to local-only when using tunnel)
# Use "3080" for LAN access, or "127.0.0.1:3080" for localhost-only
FRONTEND_PORT=3080

# ── Stripe (optional — enables client portal payments) ───────────
STRIPE_SECRET_KEY=
STRIPE_PUBLISHABLE_KEY=
STRIPE_WEBHOOK_SECRET=

# ── Watchtower (auto-update base images) ─────────────────────────
# Set to true to get notifications only (no auto-update)
WATCHTOWER_MONITOR_ONLY=false
# Shoutrrr URL for notifications (Slack, Discord, email, etc.)
# See https://containrrr.dev/shoutrrr/ for format
WATCHTOWER_NOTIFICATION_URL=

# ── Cloudflare Tunnel (optional) ──────────────────────────────────
# Auto-starts with the app. Set the token to enable; leave blank to skip.
# Get your token from https://one.dash.cloudflare.com → Networks → Tunnels
CLOUDFLARE_TUNNEL_TOKEN=

# ── Demo mode (optional — only used by docker-compose.demo.yml) ──
# Auto-creates an admin account on boot. Leave blank for a normal install.
DEMO_ADMIN_USERNAME=
DEMO_ADMIN_PASSWORD=

# ── Observability (optional — central plane on HSH-HQ) ───────────
# Phase 5 of the BarnardHQ observability rollout. All three vars are
# DSN/endpoint gated — unset = no-op. Self-hosted single-tenant
# DroneOps installs can ignore this block.
#
# Backend (FastAPI + Celery) → Sentry/GlitchTip + OTLP/gRPC traces.
# Frontend (Vite) → Sentry/GlitchTip via VITE_SENTRY_DSN (build-time).
#
# Prod (HSH-HQ) defaults:
#   SENTRY_DSN                     -> from ~/.secrets/observability-dsns.env
#   OTEL_EXPORTER_OTLP_ENDPOINT    -> http://10.99.0.1:4317 (HSH-HQ Alloy)
#   ENV                            -> prod
#
# Demo (CHAD-HQ) overrides via docker-compose.demo.yml:
#   OTEL_EXPORTER_OTLP_ENDPOINT    -> http://10.99.0.2:4317 (CHAD-HQ Alloy)
#   ENV                            -> demo
SENTRY_DSN=
SENTRY_TRACES_SAMPLE_RATE=0.05
SENTRY_ENVIRONMENT=production
OTEL_EXPORTER_OTLP_ENDPOINT=
OTEL_SERVICE_NAME=droneops-api
TENANT=shared
ENV=prod

# Frontend Sentry — build-time only (read by Vite at `npm run build`).
# Leave blank to skip — the frontend initFrontendSentry() bails out when
# VITE_SENTRY_DSN is empty.
VITE_SENTRY_DSN=
VITE_SENTRY_ENVIRONMENT=production