# OpenCode WebUI Configuration
# Copy this file to .env and customize as needed
# Default values are defined in: shared/src/config/defaults.ts

# ============================================
# Backend Server Configuration
# ============================================
PORT=5003
HOST=0.0.0.0
CORS_ORIGIN=http://localhost:5173
NODE_ENV=production
LOG_LEVEL=info

# ============================================
# OpenCode Server
# ============================================
OPENCODE_SERVER_PORT=5551
OPENCODE_HOST=127.0.0.1

# Optional - bearer password required when OPENCODE_HOST=0.0.0.0 (external exposure).
# The managed OpenCode server will refuse to start if OPENCODE_HOST is not
# localhost/127.0.0.1 and no password is configured (either here or via
# Settings → OpenCode → Server Auth).
# DB-stored passwords (set via UI) override this env var.
# OPENCODE_SERVER_PASSWORD=

# Optional - Basic Auth username (default: opencode)
# OPENCODE_SERVER_USERNAME=opencode

# Optional - import an existing standalone OpenCode install on first startup
# Useful for Docker when your host OpenCode data is bind-mounted into the container
# OPENCODE_IMPORT_CONFIG_PATH=/import/opencode-config/opencode.json
# OPENCODE_IMPORT_STATE_PATH=/import/opencode-state

# ============================================
# Database
# ============================================
DATABASE_PATH=./data/opencode.db

# ============================================
# Workspace Configuration
# ============================================
WORKSPACE_PATH=./workspace

# Optional - convenience vars for Docker bind mounts documented in docs/configuration/docker.md
# OCM_REPOS_HOST_PATH=/Users/you/Development
# OCM_OPENCODE_CONFIG_HOST_PATH=/Users/you/.config/opencode
# OCM_OPENCODE_STATE_HOST_PATH=/Users/you/.local/share/opencode

# ============================================
# Timeouts (milliseconds)
# ============================================
PROCESS_START_WAIT_MS=2000
PROCESS_VERIFY_WAIT_MS=1000
HEALTH_CHECK_INTERVAL_MS=5000
HEALTH_CHECK_TIMEOUT_MS=30000

# ============================================
# File Limits (MB)
# ============================================
MAX_FILE_SIZE_MB=50
MAX_UPLOAD_SIZE_MB=50

# ============================================
# Logging
# ============================================
DEBUG=false

# ============================================
# Authentication (Better Auth)
# ============================================
# AUTH_SECRET is required - generate with: openssl rand -base64 32
AUTH_SECRET=CHANGE_ME_GENERATE_WITH_openssl_rand_base64_32

# Trusted origins for authentication (comma-separated)
# Add your server's external URL when accessing remotely
# AUTH_TRUSTED_ORIGINS=http://localhost:5173,http://localhost:5003

# Admin Account (optional - for pre-configured single-user mode)
# When set, admin user is created on first startup and self-registration is disabled
# ADMIN_EMAIL=admin@example.com
# ADMIN_PASSWORD=your-secure-password

# Password Reset (set to true to force password update from ADMIN_PASSWORD)
# Remove after resetting password
# ADMIN_PASSWORD_RESET=false

# Secure Cookies (set to false when running HTTP without a reverse proxy)
# Defaults to true in production, false in development
# AUTH_SECURE_COOKIES=true

# OAuth Providers (optional - enable by providing client ID and secret)
# GITHUB_CLIENT_ID=
# GITHUB_CLIENT_SECRET=
# GOOGLE_CLIENT_ID=
# GOOGLE_CLIENT_SECRET=
# DISCORD_CLIENT_ID=
# DISCORD_CLIENT_SECRET=

# Passkey/WebAuthn Configuration
PASSKEY_RP_ID=localhost
PASSKEY_RP_NAME=OpenCode Manager
PASSKEY_ORIGIN=http://localhost:5003

# ============================================
# Push Notifications (VAPID)
# Enables push notifications for the PWA (background alerts for agent
# questions, permission requests, errors, and session completions).
#
# Setup:
#   1. Generate keys:  pnpm dlx web-push generate-vapid-keys
#   2. Set VAPID_PUBLIC_KEY and VAPID_PRIVATE_KEY from the output
#   3. Set VAPID_SUBJECT to a mailto: address (REQUIRED for iOS/Safari)
#
# IMPORTANT: VAPID_SUBJECT MUST use the mailto: format for iOS/Safari
# push notifications to work. Apple's push service rejects https:// subjects.
# Example: mailto:you@yourdomain.com
#
# Browser requirements:
# - HTTPS required (except localhost)
# - Safari/iOS: Requires mailto: VAPID_SUBJECT and HTTPS
# ============================================
# VAPID_PUBLIC_KEY=
# VAPID_PRIVATE_KEY=
# VAPID_SUBJECT=mailto:you@yourdomain.com

# ============================================
# Frontend Configuration (Vite)
# These are optional - frontend uses defaults if not set
# ============================================
# VITE_API_URL=http://localhost:5003
# VITE_SERVER_PORT=5003
# VITE_OPENCODE_PORT=5551
# VITE_MAX_FILE_SIZE_MB=50
# VITE_MAX_UPLOAD_SIZE_MB=50
