# --- Runtime -------------------------------------------------------------
NODE_ENV=production
PORT=3000
# Public origin used in emails, auth callbacks and canonical links. No trailing slash.
PUBLIC_APP_URL=https://www.polyllm.io

# --- Database ------------------------------------------------------------
DATABASE_URL=postgres://localhost:5432/polyllm
DB_POOL_MAX=10

# --- Auth ----------------------------------------------------------------
# 32+ random bytes, hex or base64. `openssl rand -hex 32`
AUTH_SECRET=

# --- Email (Resend) ------------------------------------------------------
RESEND_API_KEY=
RESEND_FROM_EMAIL="PolyLLM <polyllm@mail.spboucher.ai>"
# Set to 1 to log emails instead of sending (development).
EMAIL_DRY_RUN=0

# --- Encryption of user provider keys (AES-256-GCM, server-side only) ----
# 32+ random bytes. Rotating this secret invalidates every stored key.
API_KEY_ENCRYPTION_SECRET=

# --- Owner / development provider keys (TEST ONLY — never used for users) -
OPENAI_API_KEY=
ANTHROPIC_API_KEY=
GOOGLE_GEMINI_API_KEY=
XAI_API_KEY=
MISTRAL_API_KEY=
DEEPSEEK_API_KEY=
KIMI_API_KEY=
OPENROUTER_API_KEY=
CEREBRAS_API_KEY=

# --- Custom OpenAI-compatible endpoints (Settings → Endpoints) -----------
# The PolyLLM *server* calls user-defined endpoints. Private/loopback/link-local
# addresses (localhost, 10/8, 172.16/12, 192.168/16, 169.254/16, ::1, fc00::/7…)
# are rejected to prevent SSRF. Set to 1 only for a self-hosted PolyLLM that runs
# next to Ollama / LM Studio / vLLM on the same machine or LAN.
ALLOW_PRIVATE_ENDPOINTS=0

# --- Admin ---------------------------------------------------------------
# Comma-separated emails with access to /admin.
ADMIN_EMAILS=
# Model catalog refresh interval (minutes). 0 disables the scheduler.
MODEL_SYNC_INTERVAL_MINUTES=360