# Dev overrides for `make dev-config`.
#
# Copy this file to .env and uncomment any variable you want to
# override. .env is gitignored; this .env.example is the canonical
# list of overridable knobs.
#
# This is NOT a Docker-compose `.env` file. The Makefile sources it as
# a POSIX shell snippet (`. ./.env`), so:
#   - `KEY=value` works and is auto-exported.
#   - Quote values containing spaces: `KEY="foo bar"`.
#   - `#` starts a comment, `export KEY=value` is accepted.
#   - Malformed assignments (e.g. unquoted spaces) abort `make dev-config`.
#
# All probod-bootstrap inputs are prefixed with PROBOD_. See pkg/bootstrap/builder.go; the values
# set below in the Makefile's `cfg/dev.yaml` recipe are the dev defaults
# that this file can override.

# ── Base URL & ports ──────────────────────────────────────────────────
# PROBOD_BASE_URL=http://localhost:8080
# PROBOD_API_ADDR=:8080
# PROBOD_API_CORS_ALLOWED_ORIGINS=http://localhost:8080,http://localhost:5173,http://localhost:5174
# PROBOD_TRUST_CENTER_HTTP_ADDR=:10080
# PROBOD_TRUST_CENTER_HTTPS_ADDR=:443
# PROBOD_TRUST_CENTER_BASE_DOMAIN=probopage.localhost

# ── Observability ─────────────────────────────────────────────────────
# PROBOD_METRICS_ADDR=localhost:8081
# PROBOD_TRACING_ADDR=localhost:4317

# ── Secrets (rotate before prod) ──────────────────────────────────────
# PROBOD_ENCRYPTION_KEY=thisisnotasecretAAAAAAAAAAAAAAAAAAAAAAAAAAA=
# PROBOD_AUTH_COOKIE_SECRET=this-is-a-secure-secret-for-cookie-signing-at-least-32-bytes
# PROBOD_AUTH_PASSWORD_PEPPER=this-is-a-secure-pepper-for-password-hashing-at-least-32-bytes
#
# Optional: load secrets from AWS by setting env vars to awssm://, aws://, or awsps:// refs.
# awssm://<secret-id> or aws://<secret-id> — Secrets Manager
#   (e.g. PROBOD_ENCRYPTION_KEY=awssm://probo/probod/encryption_key).
# The path after the prefix is the secret name or ARN; the plaintext SecretString is used directly.
# awsps://<parameter-name> — SSM Parameter Store (e.g. PROBOD_ENCRYPTION_KEY=awsps:///probo/probod/encryption_key).
# The path after awsps:// is the parameter name; String and SecureString values are supported.
# Plain env values are also supported. Requires AWS credentials (IAM role, AWS_ACCESS_KEY_ID,
# or AWS_PROFILE) and AWS_REGION via the standard AWS SDK default chain, not PROBOD_AWS_*.
# PROBOD_ENCRYPTION_KEY=aws://probo/probod/encryption_key
# PROBOD_ENCRYPTION_KEY=awssm://probo/probod/encryption_key
# PROBOD_ENCRYPTION_KEY=awsps:///probo/probod/encryption_key

# ── Cookie ────────────────────────────────────────────────────────────
# PROBOD_AUTH_COOKIE_DOMAIN=localhost
# PROBOD_AUTH_COOKIE_SECURE=false
# PROBOD_AUTH_COOKIE_DURATION=24

# ── Postgres ──────────────────────────────────────────────────────────
# PROBOD_PG_ADDR=localhost:5432
# PROBOD_PG_USERNAME=postgres
# PROBOD_PG_PASSWORD=postgres
# PROBOD_PG_DATABASE=probod
# PROBOD_PG_POOL_SIZE=100
# PROBOD_PG_MIN_POOL_SIZE=10
# PROBOD_PG_MAX_CONN_IDLE_TIME_SECONDS=1800
# PROBOD_PG_MAX_CONN_LIFETIME_SECONDS=3600
# PROBOD_PG_DEBUG=false

# ── Object storage (SeaweedFS via compose) ────────────────────────────
# PROBOD_AWS_REGION=us-east-1
# PROBOD_AWS_BUCKET=probod
# PROBOD_AWS_ACCESS_KEY_ID=probod
# PROBOD_AWS_SECRET_ACCESS_KEY=thisisnotasecret
# PROBOD_AWS_ENDPOINT=http://127.0.0.1:8333

# ── Mailer (Mailpit via compose) ──────────────────────────────────────
# PROBOD_SMTP_ADDR=localhost:1025
# PROBOD_SMTP_USER=
# PROBOD_SMTP_PASSWORD=
# PROBOD_SMTP_TLS_REQUIRED=false
# PROBOD_MAILER_SENDER_EMAIL=no-reply@notification.getprobo.com
# PROBOD_MAILER_SENDER_NAME=Probo

# ── LLM providers ─────────────────────────────────────────────────────
# PROBOD_OPENAI_API_KEY=sk-...
# PROBOD_ANTHROPIC_API_KEY=sk-ant-...
# PROBOD_LLM_DEFAULT_PROVIDER=openai
# PROBOD_LLM_DEFAULT_MODEL_NAME=gpt-4o

# ── LLM-backed workers (inherit from LLM defaults when unset) ─────────
# PROBOD_PROBO_AGENT_PROVIDER=anthropic
# PROBOD_PROBO_AGENT_MODEL_NAME=claude-sonnet-4-6
# PROBOD_EVIDENCE_DESCRIBER_PROVIDER=openai
# PROBOD_EVIDENCE_DESCRIBER_MODEL_NAME=gpt-4o-mini
# PROBOD_AGENT_THIRD_PARTY_VETTER_PROVIDER=openai  # inherits AGENT_DEFAULT_PROVIDER when unset
# PROBOD_AGENT_THIRD_PARTY_VETTER_MODEL_NAME=gpt-4o  # inherits AGENT_DEFAULT_MODEL_NAME when unset
# PROBOD_THIRD_PARTY_VETTING_INTERVAL=10
# PROBOD_THIRD_PARTY_VETTING_STALE_AFTER=1500
# PROBOD_THIRD_PARTY_VETTING_MAX_CONCURRENCY=1

# ── Document signature/approval notifications (seconds) ───────────────
# PROBOD_DOCUMENT_NOTIFICATION_INTERVAL=300
# PROBOD_DOCUMENT_NOTIFICATION_DEBOUNCE_DELAY=900
# PROBOD_DOCUMENT_NOTIFICATION_REMINDER_INTERVAL=86400

# ── OIDC sign-in providers ────────────────────────────────────────────
# PROBOD_AUTH_GOOGLE_CLIENT_ID=
# PROBOD_AUTH_GOOGLE_CLIENT_SECRET=
# PROBOD_AUTH_MICROSOFT_CLIENT_ID=
# PROBOD_AUTH_MICROSOFT_CLIENT_SECRET=

# ── Connectors (set _CLIENT_ID to enable; _CLIENT_SECRET is required) ─
# PROBOD_CONNECTOR_SLACK_CLIENT_ID=
# PROBOD_CONNECTOR_SLACK_CLIENT_SECRET=
# PROBOD_CONNECTOR_SLACK_SIGNING_SECRET=
# PROBOD_CONNECTOR_HUBSPOT_CLIENT_ID=
# PROBOD_CONNECTOR_HUBSPOT_CLIENT_SECRET=
# PROBOD_CONNECTOR_GITHUB_CLIENT_ID=
# PROBOD_CONNECTOR_GITHUB_CLIENT_SECRET=
# PROBOD_CONNECTOR_NOTION_CLIENT_ID=
# PROBOD_CONNECTOR_NOTION_CLIENT_SECRET=
# PROBOD_CONNECTOR_SENTRY_CLIENT_ID=
# PROBOD_CONNECTOR_SENTRY_CLIENT_SECRET=
# PROBOD_CONNECTOR_INTERCOM_CLIENT_ID=
# PROBOD_CONNECTOR_INTERCOM_CLIENT_SECRET=
# PROBOD_CONNECTOR_DOCUSIGN_CLIENT_ID=
# PROBOD_CONNECTOR_DOCUSIGN_CLIENT_SECRET=
# PROBOD_CONNECTOR_BREX_CLIENT_ID=
# PROBOD_CONNECTOR_BREX_CLIENT_SECRET=
# PROBOD_CONNECTOR_GITLAB_CLIENT_ID=
# PROBOD_CONNECTOR_GITLAB_CLIENT_SECRET=
# PROBOD_CONNECTOR_BITBUCKET_CLIENT_ID=
# PROBOD_CONNECTOR_BITBUCKET_CLIENT_SECRET=
# PROBOD_CONNECTOR_HEROKU_CLIENT_ID=
# PROBOD_CONNECTOR_HEROKU_CLIENT_SECRET=
# PROBOD_CONNECTOR_PAGERDUTY_CLIENT_ID=
# PROBOD_CONNECTOR_PAGERDUTY_CLIENT_SECRET=
# PROBOD_CONNECTOR_ASANA_CLIENT_ID=
# PROBOD_CONNECTOR_ASANA_CLIENT_SECRET=
# PROBOD_CONNECTOR_NETLIFY_CLIENT_ID=
# PROBOD_CONNECTOR_NETLIFY_CLIENT_SECRET=
# PROBOD_CONNECTOR_CLICKUP_CLIENT_ID=
# PROBOD_CONNECTOR_CLICKUP_CLIENT_SECRET=
# PROBOD_CONNECTOR_VERCEL_CLIENT_ID=
# PROBOD_CONNECTOR_VERCEL_CLIENT_SECRET=
# PROBOD_CONNECTOR_VERCEL_INTEGRATION_SLUG=
# PROBOD_CONNECTOR_MONDAY_CLIENT_ID=
# PROBOD_CONNECTOR_MONDAY_CLIENT_SECRET=
# PROBOD_CONNECTOR_DATADOG_CLIENT_ID=
# PROBOD_CONNECTOR_DATADOG_CLIENT_SECRET=
# Zendesk OAuth requires a Zendesk-approved global OAuth client (Marketplace).
# PROBOD_CONNECTOR_ZENDESK_CLIENT_ID=
# PROBOD_CONNECTOR_ZENDESK_CLIENT_SECRET=
# Google Analytics (GA4) OAuth (distinct from Google Workspace).
# PROBOD_CONNECTOR_GOOGLE_ANALYTICS_CLIENT_ID=
# PROBOD_CONNECTOR_GOOGLE_ANALYTICS_CLIENT_SECRET=
# Square OAuth (EMPLOYEES_READ); customers may also use a personal access token.
# PROBOD_CONNECTOR_SQUARE_CLIENT_ID=
# PROBOD_CONNECTOR_SQUARE_CLIENT_SECRET=
# PostHog Cloud (US + EU) OAuth needs NO config: it uses the CIMD public-client
# flow (no app registration, no client_secret), auto-enabled when this
# deployment is publicly reachable at PROBOD_BASE_URL. Self-hosted PostHog uses
# the API-key path with an instance URL. No CONNECTOR_POSTHOG_* vars required.

# ── OAuth2 authorization server ───────────────────────────────────────
# Comma-separated HTTPS client metadata document URLs allowed for CIMD
# OAuth clients (e.g. MCP connectors). Leave unset to disable CIMD.
# PROBOD_OAUTH2_SERVER_CIMD_ALLOWED_CLIENT_IDS=https://chatgpt.com/oauth/client.json,https://claude.ai/oauth/client.json

# ── Custom domains (step-ca ACME via compose) ─────────────────────────
# PROBOD_CUSTOM_DOMAINS_CNAME_TARGET=custom.getprobo.com
# PROBOD_ACME_DIRECTORY=https://localhost:9000/acme/acme/directory
# PROBOD_ACME_EMAIL=admin@probo.com
# Install the local root once for browser/CIMD trust:
#   step certificate install compose/step-ca/certs/root_ca.crt