.env.example

# -----------------------------------------------------------------------------
# Bitcoin Academy — root environment file, used ONLY by Docker Compose.
#
# Every value here has a working default in docker-compose.yml, so
# `docker compose up --build` succeeds on a fresh clone without this file.
# Copy it to `.env` only when you want to override something:
#
#     cp .env.example .env
#
# Per-service configuration lives elsewhere and is read directly by each
# service (both optional for Compose):
#     services/ai/.env         backend — see services/ai/.env.example
#     apps/web/.env.local      frontend — see apps/web/.env.example
#
# The platform is local-first: no external AI provider key is required, and
# none is used.
# -----------------------------------------------------------------------------

# --- Secrets -----------------------------------------------------------------
# CHANGE BOTH before exposing this deployment to anyone else.
# SECRET_KEY signs JWTs and must be at least 32 characters.
SECRET_KEY=change-me-must-be-at-least-32-chars-long
NEXTAUTH_SECRET=change-me-too-generate-a-random-value

# --- Database ----------------------------------------------------------------
# The host must be `postgres` — the Compose service name, not localhost.
POSTGRES_USER=bitcoin_academy
POSTGRES_PASSWORD=bitcoin_academy
POSTGRES_DB=bitcoin_academy
DATABASE_URL=postgresql://bitcoin_academy:bitcoin_academy@postgres:5432/bitcoin_academy

# --- Environment -------------------------------------------------------------
# development enables Swagger UI at /docs and relaxed CORS.
ENVIRONMENT=production

# --- URLs --------------------------------------------------------------------
# Baked into the browser bundle, so it must be reachable from the browser —
# not from inside the container network.
NEXT_PUBLIC_API_BASE_URL=http://localhost:8000/api
NEXTAUTH_URL=http://localhost:3000
CORS_ORIGINS=http://localhost:3000

# --- Reverse proxy -----------------------------------------------------------
# Change if ports 80/443 are already taken on the host.
HTTP_PORT=80
HTTPS_PORT=443

# --- Local models ------------------------------------------------------------
# Set to false on machines with less than 8 GB of free RAM: the system then runs
# in retrieval-only mode (~670 MB), returning source passages without prose
# generation.
QVAC_LLM_ENABLED=true

# --- Debug -------------------------------------------------------------------
# Mounts /api/debug/* — these endpoints have NO authentication.
# Never enable this on a deployment reachable by anyone else.
DEBUG_MODE=false