# Copy this file to deploy/production.env and replace every CHANGE_ME value.
# Keep production.env outside version control and restrict it to the deploy user.
GATEWAY_VERSION=0.10.0

POSTGRES_DB=gateway
POSTGRES_USER=gateway
POSTGRES_PASSWORD=CHANGE_ME_LONG_RANDOM_POSTGRES_PASSWORD
REDIS_PASSWORD=CHANGE_ME_LONG_RANDOM_REDIS_PASSWORD

# URL-encode special characters in passwords used in URLs.
DATABASE_URL=postgres://gateway:CHANGE_ME_URL_ENCODED_POSTGRES_PASSWORD@postgres:5432/gateway?sslmode=disable
REDIS_CRITICAL_URL=redis://:CHANGE_ME_URL_ENCODED_REDIS_PASSWORD@redis-critical:6379/0
REDIS_CACHE_URL=redis://:CHANGE_ME_URL_ENCODED_REDIS_PASSWORD@redis-cache:6379/0

# Generate once with: openssl rand -base64 32
# Never rotate this value without following a KEK rotation procedure.
CREDENTIAL_MASTER_KEY=CHANGE_ME_BASE64_32_BYTE_KEY
CREDENTIAL_KEK_VERSION=1
CREDENTIAL_KEK_KEYRING=

# Disabled by default. Create database-backed API keys after bootstrap.
GATEWAY_BOOTSTRAP_API_KEY_ENABLED=false
GATEWAY_BOOTSTRAP_API_KEY=

UPSTREAM_FALLBACK_ENABLED=false
UPSTREAM_BASE_URL=https://api.openai.com
UPSTREAM_API_KEY=

ALLOW_PRIVATE_PROVIDER_URLS=false
ALLOW_PRIVATE_TOOL_URLS=false
ALLOW_PRIVATE_WEBHOOK_URLS=false

GATEWAY_BIND_IP=127.0.0.1
GATEWAY_PORT=8080
WEB_BIND_IP=127.0.0.1
ADMIN_PORT=8081
PORTAL_PORT=8082
REDIS_CACHE_MAXMEMORY=256mb

# Used only for the one-time bootstrap-admin command; remove after use.
BOOTSTRAP_ADMIN_USERNAME=admin
BOOTSTRAP_ADMIN_PASSWORD=CHANGE_ME_AT_LEAST_12_CHARACTERS