# Copy this file to deploy/production.env and replace every CHANGE_ME value.
# Keep production.env outside version control and restrict it to the deploy user.
GATEWAY_VERSION=0.10.0

POSTGRES_DB=gateway
POSTGRES_USER=gateway
POSTGRES_PASSWORD=CHANGE_ME_LONG_RANDOM_POSTGRES_PASSWORD
REDIS_PASSWORD=CHANGE_ME_LONG_RANDOM_REDIS_PASSWORD

# URL-encode special characters in passwords used in URLs.
DATABASE_URL=postgres://gateway:CHANGE_ME_URL_ENCODED_POSTGRES_PASSWORD@postgres:5432/gateway?sslmode=disable
REDIS_CRITICAL_URL=redis://:CHANGE_ME_URL_ENCODED_REDIS_PASSWORD@redis-critical:6379/0
REDIS_CACHE_URL=redis://:CHANGE_ME_URL_ENCODED_REDIS_PASSWORD@redis-cache:6379/0

# Generate once with: openssl rand -base64 32
# Never rotate this value without following a KEK rotation procedure.
CREDENTIAL_MASTER_KEY=CHANGE_ME_BASE64_32_BYTE_KEY
CREDENTIAL_KEK_VERSION=1
CREDENTIAL_KEK_KEYRING=

# Disabled by default. Create database-backed API keys after bootstrap.
GATEWAY_BOOTSTRAP_API_KEY_ENABLED=false
GATEWAY_BOOTSTRAP_API_KEY=

UPSTREAM_FALLBACK_ENABLED=false
UPSTREAM_BASE_URL=https://api.openai.com
UPSTREAM_API_KEY=

ALLOW_PRIVATE_PROVIDER_URLS=false
ALLOW_PRIVATE_TOOL_URLS=false
ALLOW_PRIVATE_WEBHOOK_URLS=false

GATEWAY_BIND_IP=127.0.0.1
GATEWAY_PORT=8080
WEB_BIND_IP=127.0.0.1
ADMIN_PORT=8081
PORTAL_PORT=8082
REDIS_CACHE_MAXMEMORY=256mb

# M8 对象存储（MinIO）。MinIO 不暴露主机端口，上传/下载全部经网关代理。
# 生产建议生成强随机密钥对（S3_ACCESS_KEY_ID/S3_SECRET_ACCESS_KEY），
# compose 的 minio 服务会用这两个值初始化 MINIO_ROOT_USER/PASSWORD。
S3_ENDPOINT=http://minio:9000
S3_ACCESS_KEY_ID=CHANGE_ME_MINIO_ACCESS_KEY
S3_SECRET_ACCESS_KEY=CHANGE_ME_MINIO_SECRET_KEY
S3_BUCKET=gateway-files
S3_REGION=us-east-1
S3_USE_SSL=false
S3_MAX_FILE_BYTES=134217728

# Used only for the one-time bootstrap-admin command; remove after use.
BOOTSTRAP_ADMIN_USERNAME=admin
BOOTSTRAP_ADMIN_PASSWORD=CHANGE_ME_AT_LEAST_12_CHARACTERS