.env.example

# =========================
# PostgreSQL
# =========================
POSTGRES_USER=multi
POSTGRES_PASSWORD=multi_pass
POSTGRES_DB=multi_ai
POSTGRES_PORT=5432
POSTGRES_HOST=localhost

# =========================
# NATS
# =========================
NATS_PORT=4222
NATS_MONITOR_PORT=8222
NATS_HOST=localhost
NATS_USER=testuser
NATS_PASSWORD=testpassword

# =========================
# MinIO
# =========================
MINIO_ROOT_USER=minio
MINIO_ROOT_PASSWORD=minio_pass
MINIO_API_PORT=9000
MINIO_CONSOLE_PORT=9001
MINIO_HOST=localhost

REDIS_PORT=6379
REDIS_HOST=localhost
REDIS_PASSWORD=

# =========================
# pgAdmin
# =========================
PGADMIN_PORT=5050

# Secret used to sign mobile access tokens and staff JWTs (HS256).
# Must be high-entropy, minimum 32 bytes to satisfy PyJWT's recommended
# HMAC key length for SHA-256 (RFC 7518 §3.2).
jwt_secret=
jwt_algorithm=HS256

# AES-256-GCM key used to encrypt the refresh-token grace-window replay
# cache before it's stored in Redis (see app/core/securite.py:
# encrypt_refresh_cache_payload / decrypt_refresh_cache_payload).
# Must be a base64-encoded 32-byte (256-bit) key.
encryption_key=Oy/A1P2ziik16x7dCzb2sBYOMLh6aol6MVn2cyPifag=

totp_issuer=MultiAI

GOOGLE_CLIENT_ID=
GOOGLE_CLIENT_SECRET=
GOOGLE_REDIRECT_URI=http://127.0.0.1:8000/staff/drive/callback
GOOGLE_OAUTH_SCOPES=https://www.googleapis.com/auth/drive.readonly openid email profile

# Key for the (currently dormant/commented-out) EmbeddingCrypto class in
# app/core/securite.py. Same format requirement as encryption_key above —
# base64-encoded 32-byte key — if this class is ever re-enabled, a weak
# placeholder value here will fail the same way an under-length
# encryption_key did.
FACE_ENCRYPTION_KEY=

# CORS Configuration
CORS_ORIGINS=["http://localhost:3000", "http://localhost:5173", "http://127.0.0.1:3000", "http://127.0.0.1:5173"]

# Firebase
FIREBASE_CREDENTIALS_PATH=path/to/firebase-credentials.json

# Resend Email Configuration
RESEND_API_KEY=
EMAIL_FROM=