.env.local.template

# Next Auth secrets (v5 names; NEXTAUTH_SECRET / NEXTAUTH_URL also work as fallbacks)
AUTH_URL=http://localhost:3000/
AUTH_SECRET=SECRET
NEXT_PUBLIC_GOOGLE_ANALYTICS=ANALYTICS
PORT=3000
# ── CSV LOAD CSV temp storage ────────────────────────────────────────────────
# Storage backend for temporary CSV files used with LOAD CSV imports.
#
#   CSV_STORAGE=local   Force local filesystem. Two ways to hand the file to
#                       FalkorDB:
#                         - file:// mode (recommended for Docker): the app writes
#                           the CSV under a shared IMPORT_FOLDER and emits
#                           file://<id>.csv. Set CSV_LOCAL_LOAD_URI_MODE=file and
#                           mount the same directory into both containers.
#                         - HTTPS serve mode: FalkorDB fetches the file from
#                           /api/csv-temp/[id]. FalkorDB ONLY accepts https:// URIs
#                           (plain http:// is rejected), so CSV_SERVE_BASE_URL must
#                           be an HTTPS URL reachable from the database (e.g. behind
#                           a TLS-terminating proxy).
#                       Good for local dev or same-machine deployments.
#
#   CSV_STORAGE=s3      Force S3 / S3-compatible storage (private bucket,
#                       presigned GET URL with TTL). The presigned URL must be
#                       HTTPS-reachable by FalkorDB (self-hosted MinIO must sit
#                       behind TLS; plain http:// endpoints are rejected).
#
#   CSV_STORAGE=blob    Force Vercel Blob storage.
#
#   Auto mode (CSV_STORAGE unset):
#     - if S3 and Blob are both configured → S3
#     - else if S3_ACCESS_KEY_ID + S3_SECRET_ACCESS_KEY + S3_BUCKET are set → S3
#     - else if BLOB_READ_WRITE_TOKEN is set → Vercel Blob
#     - else → local filesystem
#
# CSV_STORAGE=local
# CSV_LOCAL_LOAD_URI_MODE=file            # recommended: emit file://<id>.csv (shared IMPORT_FOLDER)
#                                         # Docker default: file (non-docker defaults to file unless an explicit HTTPS CSV_SERVE_BASE_URL is set)
#                                         # Requires FalkorDB IMPORT_FOLDER to point to same mounted directory
# CSV_LOCAL_TEMP_DIR=./falkordb-import    # host path where app writes CSV temp files
#                                         # Docker default: /var/lib/FalkorDB/import
# CSV_SERVE_BASE_URL=https://csv.example.com  # ONLY for http serve mode; MUST be https (FalkorDB rejects http)
#
# S3 / Cloudflare R2 / MinIO — set these to enable S3 storage mode.
# S3_ACCESS_KEY_ID=your-access-key
# S3_SECRET_ACCESS_KEY=your-secret-key
# S3_REGION=us-east-1
# S3_BUCKET=my-falkordb-csv-temp
# S3_ENDPOINT=                      # blank = real AWS S3
#                                   # https://<account>.r2.cloudflarestorage.com = Cloudflare R2
#                                   # https://minio.example.com = MinIO (must be HTTPS for FalkorDB to fetch)
# S3_KEY_PREFIX=csv-temp/           # optional object key prefix (default: csv-temp/)
# S3_FORCE_PATH_STYLE=false         # true for MinIO / some R2 configs
# S3_URL_EXPIRES_IN=3600            # presigned GET URL TTL in seconds (default: 1 h)
#
# MinIO quick-start values (see docker-compose.minio.yml). NOTE: this exercises
# the S3 provider/upload path, but plain-http MinIO cannot complete LOAD CSV —
# FalkorDB only fetches https:// (or file://), so S3_ENDPOINT must resolve to an
# HTTPS URL the database can reach (real S3/R2, or MinIO behind TLS). For a simple
# local end-to-end import use CSV_STORAGE=local with CSV_LOCAL_LOAD_URI_MODE=file.
# CSV_STORAGE=s3
# S3_ACCESS_KEY_ID=minioadmin
# S3_SECRET_ACCESS_KEY=minioadmin
# S3_REGION=us-east-1
# S3_BUCKET=falkordb-csv-temp
# S3_ENDPOINT=https://minio.your-domain.example   # must be HTTPS-reachable by FalkorDB
# S3_FORCE_PATH_STYLE=true
#
# Vercel Blob (or force with CSV_STORAGE=blob)
# BLOB_READ_WRITE_TOKEN=vercel_blob_rw_xxx
# BLOB_KEY_PREFIX=csv-temp           # optional prefix/path inside blob store
# BLOB_ACCESS=private                # private (default) or public
# CSV_MAX_FILE_SIZE_MB=100           # max CSV upload size (streamed to storage; 413 if exceeded)
# CSV_TEMP_SIGNING_SECRET=change-me  # HMAC secret for owner scoping + local-serve capability tokens
#                                    # (falls back to ENCRYPTION_KEY / NEXTAUTH_SECRET / AUTH_SECRET)
# CSV_TEMP_TTL_SECONDS=1800          # stale-file cleanup age in seconds.
#                                    # MUST exceed your longest expected LOAD CSV
#                                    # import: cleanup only reaps objects older
#                                    # than this, so keeping it above the max
#                                    # import time avoids any cleanup/import race
#                                    # on an in-flight file. Do NOT set to 0 while
#                                    # the feature is enabled.
# CSV_TEMP_CLEANUP_SECRET=change-me  # secret for /api/csv-temp/cleanup (REQUIRED to enable cleanup)
# CRON_SECRET=change-me              # Vercel Cron sends Authorization: Bearer <CRON_SECRET>
API_TOKEN_STORAGE_PATH=.data/api_tokens.json
# Encryption key for external personal access token storage (REQUIRED)
ENCRYPTION_KEY="your-64-character-hex-string-here"

# CORS Configuration
# Comma-separated list of allowed origins for API requests
# In development (NODE_ENV=development), defaults to '*' if not set
# In production, should be explicitly set to allowed origins
# Example: ALLOWED_ORIGINS=https://example.com,https://app.example.com
ALLOWED_ORIGINS=http://localhost:3000

# CSP Configuration
# Comma-separated list of additional http(s) origins the browser app may
# connect to from the client. Keep this explicit; do not use wildcards.
# Example: CSP_CONNECT_SRC=https://graphrag.falkordb.com
CSP_CONNECT_SRC=

# Max number of active connections to FalkorDB instances (LRU cache size)
MAX_CONNECTION_CACHE_SIZE=100

# Rate limiting configuration
# Set RATE_LIMIT_MAX_REQUESTS=0 to disable rate limiting entirely.
RATE_LIMIT_MAX_REQUESTS=200