.env.example

# SENTINEL AI — Environment Configuration
# Copy to .env and fill in your values

# Database
DATABASE_URL=postgresql+asyncpg://sentinel:YOUR_DB_PASSWORD@localhost:5434/sentinel_ai
DATABASE_URL_SYNC=postgresql+psycopg2://sentinel:YOUR_DB_PASSWORD@localhost:5434/sentinel_ai

# Redis
REDIS_URL=redis://localhost:6379/0

# JWT — Generate with: python -c "import secrets; print(secrets.token_hex(32))"
JWT_SECRET_KEY=
JWT_ALGORITHM=HS256
JWT_ACCESS_TOKEN_EXPIRE_MINUTES=480

# Gemini AI
GEMINI_API_KEY=
GEMINI_FLASH_MODEL=gemini-2.0-flash
GEMINI_PRO_MODEL=gemini-2.0-pro

# Groq (optional, for multi-provider)
GROQ_API_KEY=

# OpenAI (optional, for multi-provider)
OPENAI_API_KEY=

# Qdrant
QDRANT_HOST=localhost
QDRANT_PORT=6333
QDRANT_COLLECTION=sentinel_events

# Embedding
EMBEDDING_MODEL=all-MiniLM-L6-v2
EMBEDDING_DIM=384

# App
APP_NAME=SENTIGON
# APP_ENV: "development"/"test"/"local" relax startup checks. ANY other value
# (e.g. "production") is treated as production and the app WILL refuse to start
# unless JWT_SECRET_KEY and GEMINI_API_KEY (when GEMINI_ENABLED) are set.
APP_ENV=development
LOG_LEVEL=INFO
CORS_ORIGINS=["http://localhost:3000","http://localhost:8000"]

# SSO / Identity — disabled by default. The current SSO/LDAP module is a stub;
# do not enable in production until it is backed by a real identity provider.
SSO_ENABLED=false

# Celery
CELERY_BROKER_URL=redis://localhost:6379/1

# Video
MAX_CAMERAS=16
FRAME_BUFFER_SIZE=30
DEFAULT_FPS=15

# Admin seed — CHANGE THESE immediately after first login
DEFAULT_ADMIN_EMAIL=admin@sentinel.local
DEFAULT_ADMIN_PASSWORD=

# Slack Integration (optional)
SLACK_SIGNING_SECRET=
SLACK_WEBHOOK_URL=

# ──────────────────────────────────────────────────────────────
# Docker Compose production (docker-compose.prod.yml) — host vars.
# Compose refuses to start if these are unset (fail-fast `${VAR:?}`).
# ──────────────────────────────────────────────────────────────
# Public domain the browser uses (nginx serves TLS here):
DOMAIN=localhost
# JWT signing secret — python -c "import secrets; print(secrets.token_hex(32))"
JWT_SECRET=
# Postgres password for the bundled db service:
POSTGRES_PASSWORD=
# GEMINI_API_KEY is also read here (set GEMINI_ENABLED=false to run without it).