# familiar — HTTP / Docker deployment settings.
# Copy to .env and fill in. `.env` is gitignored; never commit real secrets.

# --- Transport ------------------------------------------------------------- #
# stdio (default, local) or http (Docker / public). The image sets http.
FAMILIAR_TRANSPORT=http

# Bind + path. In Docker the container binds 0.0.0.0 internally; the reverse
# proxy is the only thing that reaches it. Leave HTTP_HOST unset locally to keep
# the safe 127.0.0.1 default.
# FAMILIAR_HTTP_HOST=0.0.0.0
FAMILIAR_HTTP_PORT=8000
FAMILIAR_HTTP_PATH=/mcp

# --- Auth (REQUIRED for any non-loopback bind) ----------------------------- #
# Bearer token clients must send as `Authorization: Bearer <token>`.
# Generate a strong one, e.g.:  python -c "import secrets; print(secrets.token_urlsafe(32))"
FAMILIAR_HTTP_AUTH_TOKEN=

# Escape hatch to bind a public interface WITHOUT a token. Leave false.
# FAMILIAR_ALLOW_INSECURE_BIND=false

# --- Data / writes --------------------------------------------------------- #
# Host path holding the encrypted token store (token.enc + key), audit log, and
# write toggle. Produced by `familiar login` on a machine with a browser.
FAMILIAR_DATA_DIR_HOST=./data

# Writes off by default on a public instance. Set true to allow guarded writes.
FAMILIAR_ENABLE_WRITES=false

# --- Image (published to Gitea by .gitea/workflows/docker.yml) -------------- #
# Prod channel: :latest or :main. Dev channel: :dev. Or pin a :sha-xxxxxxxx tag.
FAMILIAR_IMAGE=git.hiddenden.cafe/hiddenden/familiar:latest

# --- Reverse proxy (Traefik labels in docker-compose.yml) ------------------ #
FAMILIAR_DOMAIN=familiar.example.com
TRAEFIK_CERTRESOLVER=letsencrypt