.env.example

# =============================================================================
# Atlas — Environment Variables
# Copy this file to `.env` and fill in real values. Never commit `.env`.
# =============================================================================

# --- App ---------------------------------------------------------------------
NODE_ENV=development
PORT=3000
# Canonical URL the app is served from (used by Auth.js for callback URLs)
AUTH_URL=http://localhost:3000

# --- Auth (PocketID OIDC) ----------------------------------------------------
# Generate AUTH_SECRET with: openssl rand -base64 32
AUTH_SECRET=replace-me-with-a-32-byte-random-string

# PocketID OIDC provider — see docs/adr/0002-auth-via-pocketid.md
# Issuer is the base URL of your PocketID instance (Auth.js does discovery).
OIDC_ISSUER_URL=https://id.example.com
OIDC_CLIENT_ID=
OIDC_CLIENT_SECRET=

# --- Database ----------------------------------------------------------------
# Format: postgres://user:password@host:port/database. This is read by host-
# side tooling (`pnpm dev`, `pnpm db:*`); the containers build their own URL
# from POSTGRES_PASSWORD below.
DATABASE_URL=postgres://atlas:atlas@localhost:5432/atlas

# Postgres password for the Docker stack. The compose files interpolate it into
# the postgres container, the app/worker connection strings, and the backup
# job, so you set it in one place. Defaults to `atlas` for local dev; the
# production overlay refuses to start until you change it (openssl rand -base64
# 24). Container-only deployments need nothing else — the app and worker build
# their connection string from this. Only if you run host-side tooling
# (`pnpm db:*`, `pnpm dev`) against a non-default password do you also need to
# update the password in DATABASE_URL above.
POSTGRES_PASSWORD=atlas

# --- Document storage (local filesystem) -------------------------------------
# Default is project-relative so `pnpm dev` works out of the box on a host
# (resolves to ./data/documents under the project root). docker-compose
# overrides this with the absolute container path /app/data/documents and
# bind-mounts ./data/documents from the host onto that path.
STORAGE_DIR=./data/documents
# Per-upload size limit in bytes (default 20MB)
STORAGE_MAX_BYTES=20971520
# Comma-separated list of allowed MIME types (magic-byte validated, not header-based)
STORAGE_ALLOWED_MIMES=application/pdf,image/jpeg,image/png,image/heic,image/webp,application/vnd.apple.pkpass,message/rfc822

# --- Maps --------------------------------------------------------------------
# Self-hosted Protomaps PMTiles basemap — see ADR-0011.
#
# Operators run `pmtiles extract` once (recommended ~33 GB Z0-13 worldwide).
# Use yesterday's daily build — today's may still be propagating. Note that
# the Source Coop S3 mirror only carries schema v3 and older; current
# schema v4 is daily-build-only.
#   pmtiles extract \
#     https://build.protomaps.com/<YYYYMMDD>.pmtiles \
#     data/tiles/world.pmtiles --maxzoom=13 --download-threads=4 --overfetch=0
#
# TILES_DIR is the host-side directory the bind mount serves. Default is
# project-relative for `pnpm dev`; docker-compose overrides to the absolute
# container path /app/data/tiles and bind-mounts ./data/tiles onto it (RO).
# In a git worktree, set this to an ABSOLUTE path to the main checkout's
# data/tiles — the relative default points at the worktree's own empty dir,
# and symlinking data/tiles into a worktree crashes Turbopack.
TILES_DIR=./data/tiles

# Browser-side URL of the PMTiles file. The tile-route handler at
# /api/tiles/[...path] serves this from TILES_DIR. Currently hard-coded
# inside buildBasemapStyle() — this env var documents the contract
# for any future operator override.
PROTOMAPS_PMTILES_URL=/api/tiles/world.pmtiles

# --- Geocoding (Nominatim) ---------------------------------------------------
# Atlas geocodes hotel / activity / transit segments through a two-provider
# ladder — Photon first (venue-name matching), Nominatim on a Photon null
# (structured-address backstop + Plus Code reverse lookups) — so places
# appear on the trip-detail map. See ADR-0010 and ADR-0018.
#
# Nominatim's usage policy REQUIRES an identifying User-Agent with a
# contact address — set this to a real address you'd like upstream to
# reach if our usage ever caused them concern. Photon sends the same
# User-Agent. The geocoder throws at startup if this is empty.
NOMINATIM_CONTACT_EMAIL=
# Optional overrides for the provider endpoints. Default to the public
# instances (https://photon.komoot.io, https://nominatim.openstreetmap.org).
# Point at self-hosted containers when usage outgrows the public-instance
# budget (see ADR-0018 "When to revisit").
# PHOTON_URL=
# NOMINATIM_URL=

# --- Document extraction (Ollama, local-only) --------------------------------
# Atlas runs structuring against a self-hosted Ollama instance. No cloud LLM
# calls. See docs/adr/0006-ollama-only-llm-extraction.md.
#
# The default model is `atlas-extract:latest`, a derived variant of qwen2.5:7b
# with extraction-tuned parameters and a JSON-only SYSTEM prompt baked in.
# Build it once on the Ollama host (see docker/ollama/README.md):
#   ollama create atlas-extract -f docker/ollama/atlas-extract.Modelfile
#
# To skip that step on a fresh host, fall back to `qwen2.5:7b` — extraction
# still works but the runtime may truncate inputs and sampling is non-
# deterministic.
OLLAMA_URL=http://localhost:11434
OLLAMA_MODEL=atlas-extract:latest

# OCR — PLANNED, NOT YET WIRED. The extractor lineup is currently hard-coded in
# src/lib/ocr/index.ts (pdf-text → Tesseract → .eml); no code reads these vars,
# so setting OCR_ENGINE=paddle is silently ignored. They document the intended
# contract for when the PaddleOCR sidecar path lands.
# OCR_ENGINE=tesseract
# PADDLEOCR_URL=http://localhost:8868

# --- Worker schedules (pg-boss host) -----------------------------------------
# The `worker` compose service runs scripts/worker.ts (`pnpm worker`) and
# hosts every background job: extraction, geocoding, prune, status sweep
# — see ADR-0012. Schedules use standard 5-field cron syntax
# (`min hour day month weekday`).
#
# Defaults:
#   CRON_PRUNE_SCHEDULE   03:40 UTC daily (just after the documents snapshot)
#   CRON_STATUS_SCHEDULE  00:05 UTC daily (transitions trips planned→active,
#                                          active→completed by date)
# Set CRON_TZ to an IANA zone (e.g. Europe/Berlin) to shift the prune run
# window into local time. It does NOT affect CRON_STATUS_SCHEDULE: the
# status sweep always runs in UTC because its date math is UTC (ADR-0016) —
# a non-UTC trigger would fire it in the prior UTC day and lag every trip
# transition by a day.
#
# Upgrading from a pre-pg-boss Atlas: pg-boss's cron parser also accepts
# the 6-field croner format (`sec min hour ...`), so a legacy value like
# `0 40 3 * * *` keeps working unchanged. The 5-field form is preferred
# going forward.
CRON_PRUNE_SCHEDULE="40 3 * * *"
CRON_STATUS_SCHEDULE="5 0 * * *"
CRON_TZ=UTC

# --- Notifications (ntfy, self-hosted) — PLANNED, NOT YET WIRED ---------------
# Forward contract only. No code reads these yet; `src/lib/notifications/`
# does not exist. The vars are documented here so the deployment shape is
# settled before the feature lands.
#
# Once built: Atlas will push short reminders (upcoming flight, hotel
# check-in) and extraction success/failure events to a self-hosted ntfy
# server. Per-user topics keep household members on separate streams.
# Notification bodies must never contain PNRs, passport numbers, or full
# document contents — titles/bodies stay short and generic. NTFY_TOKEN is
# only needed when the server enforces auth.
NTFY_URL=
NTFY_TOKEN=

# --- Dev-only --------------------------------------------------------------
# Comma-separated list of extra hosts allowed to talk to `next dev` (HMR +
# RSC). Use this to exercise the app from a phone on the same LAN:
#   ATLAS_DEV_ORIGINS=192.168.1.42,10.0.0.5
# Dev-only — production builds ignore this. Leave unset/empty to keep the
# Next.js defaults (localhost variants).
ATLAS_DEV_ORIGINS=

# --- Display -----------------------------------------------------------------
# Calendar-date format for raw ISO YYYY-MM-DD surfaces (document card
# summaries, hotel check-in / check-out, multi-leg date ranges).
# Does NOT affect locale-aware headers like "Mon, 1 Jun 2026" used on
# trip cards — those keep their en-GB form.
#
# Allowed: iso (default — 2026-02-19) · eu (19/02/2026) · us (02/19/2026)
#
# NEXT_PUBLIC_ prefix is required so Next.js inlines the value into the
# client bundle. Changing it requires a rebuild.
NEXT_PUBLIC_ATLAS_DATE_FORMAT=iso

# Distance unit for the /stats dashboard's "distance flown" figure.
# Distance is computed server-side in kilometres; this only controls the
# display unit and label. No NEXT_PUBLIC_ prefix — the stats page is a
# Server Component and reads this server-side.
#
# Allowed: km (default) · mi
ATLAS_DISTANCE_UNIT=km

# --- Logging -----------------------------------------------------------------
LOG_LEVEL=info
# Set to true in dev to pretty-print; production stays JSON
LOG_PRETTY=false

# --- Deployment --------------------------------------------------------------
# GHCR image tag the prod overlay pulls. ONE tag drives BOTH images: the app at
# ghcr.io/sebbogit/atlas:$ATLAS_IMAGE_TAG and the worker at
# ghcr.io/sebbogit/atlas:$ATLAS_IMAGE_TAG-worker. Defaults to `latest`; pin to a
# released version (e.g. 1.0.0) for reproducible deploys. The release workflow
# publishes both images on every `v*` tag.
ATLAS_IMAGE_TAG=latest