# Copy to .env next to docker-compose.images.yml.
# install-images.sh creates that file and fills the required secrets automatically.

POSTGRES_USER=rakazo
POSTGRES_PASSWORD=
POSTGRES_DB=rakazo

BETTER_AUTH_SECRET=
ENCRYPTION_KEY=
SCREEN_PROXY_SECRET=
# Distinct from BETTER_AUTH_SECRET. Required for local Docker computers.
SANDBOX_SUPERVISOR_TOKEN=

# Public origin the browser uses. For a VPS, put TLS in front of :5173 and use https://…
# Host reverse-proxy snippet: docs/self-host.md (Published images).
# Vite preview allowlists RAKAZO_HOST. For that host TLS proxy you must set RAKAZO_HOST
# to the public hostname (e.g. app.example.com); do not leave localhost.
BETTER_AUTH_URL=http://127.0.0.1:5173
WEB_ORIGIN=http://127.0.0.1:5173
API_URL=http://127.0.0.1:5173
RAKAZO_HOST=localhost

SIGNUPS_ENABLED=true
SIGNUP_ALLOWLIST=

# Optional password-recovery email. Both Resend and Amazon SES provide SMTP credentials.
SMTP_URL=
EMAIL_FROM=

# Restricted-network / registry-mirror escape hatch: override these four when
# GHCR is unreachable. Keep app + computer on the same mirror. Defaults stay GHCR.
# edge tracks main (amd64 + arm64). Pin a published release tag when you need a fixed version.
RAKAZO_IMAGE=ghcr.io/cynarai/evoo-local/app
RAKAZO_IMAGE_TAG=edge
RAKAZO_COMPUTER_IMAGE=ghcr.io/cynarai/evoo-local/computer
RAKAZO_COMPUTER_IMAGE_TAG=edge

# Optional Hub postgres/busybox overrides for published-images compose.
# Unset keeps Docker Hub defaults (digest-pinned postgres:16, busybox:1).
# On restricted networks, point these at a mirror that already has the images:
# POSTGRES_IMAGE=registry.example.com/library/postgres:16
# BUSYBOX_IMAGE=registry.example.com/library/busybox:1

# docker = local computers via the in-stack supervisor (default). Optional remote: e2b, daytona, box.
# none boots the UI without computers when Docker/supervisor is not configured.
SANDBOX_PROVIDER=docker
# E2B_API_KEY=
# DAYTONA_API_KEY=
# BOX_API_KEY=

# Optional model / integration keys
OPENROUTER_API_KEY=
COMPOSIO_API_KEY=
# Comma-separated model ids on centrally managed local / openai-compatible endpoints that accept images.
# User-connected OpenAI-compatible models use the per-connection Supports images setting instead.
# Declared ids get input ["text","image"] so screenshot computer tools stay available.
RAKAZO_LOCAL_VISION_MODELS=
RAKAZO_OPENAI_COMPATIBLE_VISION_MODELS=
# User-connected public OpenAI-compatible hosts need =1 (default: private/loopback only).
# RAKAZO_OPENAI_COMPAT_ALLOW_PUBLIC=1
# Optional integrations.sh-compatible catalog base URL (Rakazo appends api/search).
# Example: https://integrations.sh/ or a self-hosted mirror base, not the full search endpoint.
# INTEGRATIONS_CATALOG_URL=

# Optional outbound HTTP(S) proxy for api/worker containers (Mainland / corporate).
# Leave blank unless you need egress through a proxy. Uppercase or lowercase keys work.
# Include internal Compose names in NO_PROXY (postgres, supervisor, localhost, 127.0.0.1).
# HTTP_PROXY=
# HTTPS_PROXY=
# NO_PROXY=localhost,127.0.0.1,postgres,supervisor,api,worker,web

# Structured logs. JSON in production. Axiom is optional and disabled unless both are set.
LOG_LEVEL=info
LOG_FORMAT=
AXIOM_TOKEN=
AXIOM_DATASET=
AXIOM_EDGE=
AXIOM_EDGE_URL=