# Copy to .env (never commit .env). All values are placeholders.
APP_URL=http://localhost:8540
PORT=8540
# Full-privilege connection used by the admin API, worker, migrations and imports.
DATABASE_URL=postgres://tools_app:CHANGE_ME@127.0.0.1:5432/tools_spboucher
# Read-only role used by every PUBLIC page/API (SELECT on public views only). Falls back to DATABASE_URL if unset (dev only).
DATABASE_URL_PUBLIC=postgres://tools_reader:CHANGE_ME@127.0.0.1:5432/tools_spboucher
# 32+ random bytes, hex. Used for CSRF double-submit tokens and signed values.
SESSION_SECRET=CHANGE_ME_64_HEX_CHARS
# WebAuthn relying party (production: tools.spboucher.ai / https://tools.spboucher.ai)
WEBAUTHN_RP_ID=localhost
WEBAUTHN_ORIGIN=http://localhost:8540
# Owner bootstrap (first run of `pnpm bootstrap`); the password must be changed after first login.
OWNER_EMAIL=owner@example.com
OWNER_INITIAL_PASSWORD=CHANGE_ME_LONG_RANDOM
# Optional AI provider for semantic search / suggestions. Leave empty to run with lexical search only.
AI_PROVIDER=none            # none | openai | anthropic
OPENAI_API_KEY=
ANTHROPIC_API_KEY=
AI_MONTHLY_BUDGET_USD=5
# Backups
BACKUP_DIR=./backups
BACKUP_PASSPHRASE=CHANGE_ME
BACKUP_REMOTE=               # optional rsync target, e.g. user@host:~/backups/tools-spboucher-ai
# Worker
WORKER_POLL_MS=5000
OUTBOUND_USER_AGENT=tools-spboucher-ai-linkcheck/1.0