.env

# Copy to .env and fill in real values. Never commit the real .env file.

# Postgres connection string.
# Local dev example: postgresql+psycopg://postgres:postgres@localhost:5432/drunkenbot
#DATABASE_URL=postgresql+psycopg://postgres:postgres@localhost:5432/drunkenbot
DATABASE_URL=sqlite:///./drunkenbot.db
# Ed25519 private key used to sign licenses and grace receipts, PEM format,
# base64-encoded onto a single line (see scripts/generate_keypair.py).
# This is the single most sensitive value in the whole service -- treat it
# like a root credential. Never commit it, never log it, rotate access to
# whatever secret store holds it in production.
SIGNING_PRIVATE_KEY_B64=LS0tLS1CRUdJTiBQUklWQVRFIEtFWS0tLS0tCk1DNENBUUF3QlFZREsyVndCQ0lFSUozWUxVb1JoUlV2MTBLdVdlNDUrVlptYXpnem0rbmZzZlAxUlRjMWIyQ3YKLS0tLS1FTkQgUFJJVkFURSBLRVktLS0tLQo=

# Shared bearer token for the /admin/* endpoints. Generate a long random
# value (e.g. `openssl rand -hex 32`) -- this is a v1 simplification
# (single shared admin credential); see README for the plan to replace it
# with per-admin accounts later.
ADMIN_API_TOKEN=05bcdf8e736a1249

# How long an online-validated license "grace receipt" stays valid before
# the IDE must re-check with the server (hours).
GRACE_RECEIPT_VALID_HOURS=168

# Signs browser session cookies for the admin web UI (/admin-ui/*). A
# DIFFERENT random value from ADMIN_API_TOKEN -- generate the same way
# (`python -c "import secrets; print(secrets.token_hex(32))"`), keep it
# separate so a leak of one credential doesn't also compromise the other.
SESSION_SECRET_KEY=5aae0d1b01412d63d7810769f5b6415a39e843fbde297acdd056229f7327f452

# Requests allowed per IP per minute on the public validation endpoints.
RATE_LIMIT_PER_MINUTE=30

#PUBLIC_KEY=MCowBQYDK2VwAyEAqSMgksl/WHckxsecjYRPkUSoRxpkkhamLPshwyYTvvA=

# Encrypts notification secrets (Gmail app password, Telegram bot token,
# Discord webhook URL) at rest in the database -- a DIFFERENT random value
# from every other secret above. Generate with:
#   python -c "from cryptography.fernet import Fernet; print(Fernet.generate_key().decode())"
# Changing this after secrets have been saved makes existing saved secrets
# unreadable (they'll need to be re-entered in the settings page).
NOTIFICATION_ENCRYPTION_KEY=