# familiar — remote HTTP / Docker deployment settings.
# Copy to .env and fill in. .env is gitignored; never commit real secrets.

# --- Image (published to Gitea by .gitea/workflows/docker.yml) -------------- #
# Prod channel: :latest or :main. Dev channel: :dev. Or pin :sha-<12>.
FAMILIAR_IMAGE=git.hiddenden.cafe/hiddenden/familiar:latest

# --- Bind + path ----------------------------------------------------------- #
# The image binds 0.0.0.0:8080 internally; only the reverse proxy reaches it.
# FAMILIAR_HTTP_PATH must match your proxy's location block.
FAMILIAR_HTTP_PATH=/mcp

# --- Auth mode ------------------------------------------------------------- #
# bearer (default) — a single static token (below). Works with every client.
# oauth  — validate external-issuer JWTs; needed only for the Claude web
#          connector (requires an external IdP with DCR). See doc/clients/claude-web.md.
FAMILIAR_AUTH_MODE=bearer

# --- Bearer auth (REQUIRED when FAMILIAR_AUTH_MODE=bearer) ------------------ #
# Token clients send as `Authorization: Bearer <token>`. Generate a strong one:
#   openssl rand -hex 32
FAMILIAR_HTTP_TOKEN=

# Escape hatch: allow a public (0.0.0.0) bind with NO token. Leave false unless
# authentication is handled entirely upstream.
# FAMILIAR_ALLOW_INSECURE_BIND=false

# --- OAuth 2.1 resource server (only when FAMILIAR_AUTH_MODE=oauth) --------- #
# familiar only validates JWTs; the login/DCR side lives in an external IdP.
# FAMILIAR_OAUTH_ISSUER=https://idp.example.com/application/o/familiar/
# FAMILIAR_OAUTH_RESOURCE=https://familiar.example.com   # this server's public URL
# FAMILIAR_OAUTH_AUDIENCE=https://familiar.example.com   # defaults to RESOURCE
# FAMILIAR_OAUTH_JWKS_URI=                               # optional; else discovered from issuer
#
# Using Gitea as the issuer (RS256 JWTs + JWKS + OIDC discovery — config only,
# see doc/deployment.md). Register an OAuth2 app in Gitea first; Gitea puts the
# app's CLIENT ID in the token `aud`, so set AUDIENCE to that, not the resource.
# NOTE: Gitea has no Dynamic Client Registration — works for clients with a
# pre-registered client ID/secret, but NOT the claude.ai web connector (needs DCR).
# FAMILIAR_OAUTH_ISSUER=https://gitea.example.com        # no trailing /login/oauth
# FAMILIAR_OAUTH_RESOURCE=https://familiar.example.com
# FAMILIAR_OAUTH_AUDIENCE=<gitea-oauth-app-client-id>

# --- Data / writes --------------------------------------------------------- #
# Host path holding the encrypted token store (token.enc + key), audit log, and
# write toggle. Produced by `familiar login` on a machine with a browser (or
# `familiar login --no-browser` on the host).
FAMILIAR_DATA_DIR_HOST=./data

# Writes off by default on a public instance. Set true to allow guarded writes.
FAMILIAR_ENABLE_WRITES=false

# --- Reverse proxy --------------------------------------------------------- #
# The container joins the external `proxy` network and exposes :8080; the proxy
# (Pangolin, or nginx/Caddy — see doc/deployment.md) terminates TLS and forwards
# to it. The public hostname and certs are configured in the proxy, not here.