.env.example

# Server
PORT=3001
HOST=0.0.0.0
# Max time (ms) allowed for a single HTTP request before the server aborts it
REQUEST_TIMEOUT_MS=120000

# Logging
# Log verbosity: fatal, error, warn, info, debug, trace
LOG_LEVEL=info

# Public origin advertised to AI agents in /api/v1/creator/agent and /startup.
# Required for any internet-reachable deployment: without it the origin is taken
# from request headers (Host/X-Forwarded-Host/Origin), which the client controls.
# Example: https://artemisa-backend-xxxxx.ondigitalocean.app
PUBLIC_BASE_URL=

# Number of trusted proxy hops in front of the server (Express "trust proxy").
# Set to 1 behind a single reverse proxy/load balancer so rate limiting keys on
# the real client IP. Leave empty when the server is directly exposed: trusting
# X-Forwarded-For without a proxy lets clients spoof their IP.
TRUST_PROXY=

# CORS — comma-separated list of allowed origins
# Production (DigitalOcean App Platform): set to your Netlify frontend URL
# Example: https://artemisa-ai.netlify.app
CORS_ALLOWED_ORIGINS=http://localhost:3000,http://localhost:5173

# Metrics endpoint protection (required in production)
METRICS_SECRET=

# Frontend (build-time for Next.js, set in docker-compose or .env.local)
# Public URL used by the Creator UI to call the backend.
# Production: set to your DigitalOcean App Platform URL (e.g. https://artemisa-backend-xxxxx.ondigitalocean.app)
NEXT_PUBLIC_API_URL=http://localhost:3001
# Optional public API key used by the Creator UI for protected generate routes.
# Do not commit a real production key here.
NEXT_PUBLIC_API_KEY=
# Canonical site URL used for metadata, robots.txt and sitemap.xml.
NEXT_PUBLIC_SITE_URL=http://localhost:3000

# Bypass secret for emergency override of auth checks
# Set this to a strong random value; it will be redacted from logs automatically
BYPASS_SECRET=

# Rate Limiting (requests per minute)
RATE_LIMIT_GLOBAL=100
# The Creator re-evaluates the decision tree per step; a full Auto-largo run is
# ~35 requests, so this must stay well above the number of questions in the tree.
RATE_LIMIT_CREATOR=120
# Dedicated limit for the public /api/v1/creator/agent/* endpoints. A normal
# agent onboarding flow costs ~30 requests per minute, so the default matches it.
RATE_LIMIT_AGENT=30

# Authentication
# Authentication is ENABLED by default. Set to false for local development only.
# In production, auth is enforced and the server will refuse to start without keys.
AUTH_REQUIRED=false
# Comma-separated list of valid API keys
ARTEMISA_API_KEYS=