.env.example

# SecGraph-AI Configuration
# Copy this file to .env and fill in your real values.
# .env is gitignored and will never be committed.
# NEVER put real credentials in this file.

# ── Neo4j ────────────────────────────────────────────────────────────────────
# Leave NEO4J_HOST blank to auto-detect (WSL→Windows host via default route).
NEO4J_HOST=
NEO4J_PORT=7687
NEO4J_USER=neo4j
NEO4J_PASSWORD=your_password_here
NEO4J_DATABASE=neo4j

# ── Neo4j data directory ──────────────────────────────────────────────────────
# REQUIRED — leaving this blank causes Neo4j to use a temporary volume
# that is destroyed on container restart, wiping all graph data.
#
# Set this to a path on your HOST machine (not inside the container).
# Windows example : W:/SecGraph-AI/neo4j
# Linux / macOS   : /home/yourname/secgraph-ai/neo4j
# WSL (Windows)   : the Windows path works best, e.g. W:/SecGraph-AI/neo4j
#
# Create the directory before starting Docker:
#   mkdir -p /mnt/w/SecGraph-AI/neo4j
NEO4J_DATA_DIR=W:/SecGraph-AI/neo4j

# ── Neo4j read-only credentials (Enterprise Edition only) ────────────────────
# Neo4j Community Edition does not support role-based access control.
# If you are running Neo4j Enterprise, create a read-only user:
#   CREATE USER secgraph_reader SET PASSWORD 'your_readonly_password' CHANGE NOT REQUIRED
#   GRANT ROLE reader TO secgraph_reader
# On Community Edition, leave these blank — AI queries will use the main
# credentials above but are still protected by the 30s timeout and 200-row
# cap enforced in run_ai_query().
NEO4J_READONLY_USER=
NEO4J_READONLY_PASSWORD=
NEO4J_HEAP_INITIAL=512m
NEO4J_HEAP_MAX=2G
NEO4J_PAGECACHE=1G

# ── Ollama ───────────────────────────────────────────────────────────────────
# Leave blank to auto-detect (same host as Neo4j).
OLLAMA_HOST=
OLLAMA_PORT=11434
# Recommended: qwen2.5 (Apache 2.0, best overall Cypher generation — 20/30 pass rate)
# Tested alternatives:
#   qwen2.5-coder  — fewer syntax errors, faster (2s avg), Apache 2.0
#   mistral        — 17/30 pass rate, Apache 2.0
#   llama3         — Meta Community Licence, attribution required
#   gemma2         — review Google Gemma Terms before commercial use
# Do NOT use qwen3 — thinking mode causes timeouts on Cypher generation
OLLAMA_MODEL=qwen2.5

# ── Sentence embeddings (RAG — local-first) ──────────────────────────────────
# SecGraph-AI is local-first. After running seed_query_examples.py once,
# set both flags below to 1 to prevent sentence-transformers from making
# any outbound HuggingFace hub requests at runtime.
#
# One-time setup (run before setting these to 1):
#   python3 src/ingestion/seed_query_examples.py
# This downloads all-MiniLM-L6-v2 (~90MB) to ~/.cache/huggingface/
# After that, the model loads from local disk — no internet needed.
#
TRANSFORMERS_OFFLINE=1
HF_HUB_OFFLINE=1

# ── OSINT API keys (all optional) ────────────────────────────────────────────
# NVD: https://nvd.nist.gov/developers/request-an-api-key
NVD_API_KEY=your_nvd_api_key_here

# AlienVault OTX: https://otx.alienvault.com
OTX_API_KEY=your_otx_api_key_here

# ── Paths ────────────────────────────────────────────────────────────────────
# Where to write generated reports. Leave blank to use <repo_root>/reports/
REPORTS_DIR=