# familiar — remote HTTP / Docker deployment settings.
# Copy to .env and fill in. .env is gitignored; never commit real secrets.

# --- Image (published to Gitea by .gitea/workflows/docker.yml) -------------- #
# Prod channel: :latest or :main. Dev channel: :dev. Or pin :sha-<12>.
FAMILIAR_IMAGE=git.hiddenden.cafe/hiddenden/familiar:latest

# --- Bind + path ----------------------------------------------------------- #
# The image binds 0.0.0.0:8080 internally; only the reverse proxy reaches it.
# FAMILIAR_HTTP_PATH must match your proxy's location block.
FAMILIAR_HTTP_PATH=/mcp

# --- Auth mode ------------------------------------------------------------- #
# bearer (default) — a single static token (below). Works with every client.
# oauth  — validate external-issuer JWTs; needed only for the Claude web
#          connector (requires an external IdP with DCR). See doc/clients/claude-web.md.
FAMILIAR_AUTH_MODE=bearer

# --- Bearer auth (REQUIRED when FAMILIAR_AUTH_MODE=bearer) ------------------ #
# Token clients send as `Authorization: Bearer <token>`. Generate a strong one:
#   openssl rand -hex 32
FAMILIAR_HTTP_TOKEN=

# Escape hatch: allow a public (0.0.0.0) bind with NO token. Leave false unless
# authentication is handled entirely upstream.
# FAMILIAR_ALLOW_INSECURE_BIND=false

# --- OAuth 2.1 resource server (only when FAMILIAR_AUTH_MODE=oauth) --------- #
# FAMILIAR_OAUTH_ISSUER=https://idp.example.com/application/o/familiar/
# FAMILIAR_OAUTH_RESOURCE=https://familiar.example.com   # this server's public URL
# FAMILIAR_OAUTH_AUDIENCE=https://familiar.example.com   # defaults to RESOURCE
# FAMILIAR_OAUTH_JWKS_URI=                               # optional; else discovered from issuer

# --- Data / writes --------------------------------------------------------- #
# Host path holding the encrypted token store (token.enc + key), audit log, and
# write toggle. Produced by `familiar login` on a machine with a browser (or
# `familiar login --no-browser` on the host).
FAMILIAR_DATA_DIR_HOST=./data

# Writes off by default on a public instance. Set true to allow guarded writes.
FAMILIAR_ENABLE_WRITES=false

# --- Reverse proxy (Traefik labels in docker-compose.yml) ------------------ #
# Only used if you run Traefik. For nginx/Caddy, see doc/deployment.md.
FAMILIAR_DOMAIN=familiar.example.com
TRAEFIK_CERTRESOLVER=letsencrypt