.env.sample

# Local development environment variables.
# Copy this file to .env in the project root and fill in your values.
# All apps and docker-compose read from this single file.

# ── Database (shared by backend-services and temporal worker) ─────────────────
DATABASE_URL="postgresql://postgres:postgres@localhost:5432/ai_doc_intelligence?schema=public"
# Database Connection Pool
# Maximum number of database connections per pod (default: 10)
# Scale this based on: concurrent requests per pod, pod count, and Postgres max_connections (default: 100)
# Example: 5 backend pods * 10 connections + 4 worker pods * 3 = 62 total connections
DB_POOL_MAX=10

# ── MinIO (object storage) ────────────────────────────────────────────────────
MINIO_ROOT_USER=minioadmin
MINIO_ROOT_PASSWORD=minioadmin
MINIO_ENDPOINT=http://localhost:19000
MINIO_ACCESS_KEY=minioadmin
MINIO_SECRET_KEY=minioadmin
MINIO_DOCUMENT_BUCKET=document-blobs

# ── Blob storage provider ─────────────────────────────────────────────────────
# Options: minio | azure
BLOB_STORAGE_PROVIDER=minio

# If BLOB_STORAGE_PROVIDER=azure, these must be set:
AZURE_STORAGE_CONNECTION_STRING=
AZURE_STORAGE_ACCOUNT_NAME=
AZURE_STORAGE_ACCOUNT_KEY=

# ── Temporal ──────────────────────────────────────────────────────────────────
TEMPORAL_ADDRESS=localhost:7233
TEMPORAL_NAMESPACE=default
TEMPORAL_TASK_QUEUE=ocr-processing

# ── Backend services (NestJS) ─────────────────────────────────────────────────
FRONTEND_URL=http://localhost:3000
BACKEND_URL=http://localhost:3002

# BC Gov SSO
SSO_AUTH_SERVER_URL=https://dev.loginproxy.gov.bc.ca/auth/realms/standard/protocol/openid-connect
SSO_REALM=standard
SSO_CLIENT_ID=xxxxxxxxxxxxxxxx
SSO_CLIENT_SECRET=xxxxxx

# Azure Document Intelligence
# Endpoint without /documentintelligence suffix — the SDK adds it automatically.
AZURE_DOCUMENT_INTELLIGENCE_ENDPOINT=https://your-endpoint.cognitiveservices.azure.com
AZURE_DOCUMENT_INTELLIGENCE_API_KEY=your-api-key-here

# When true, submit/poll OCR activities use synthetic responses (no calls to Azure).
# Use for load tests or local runs without Document Intelligence. Does not affect Nest backend routes that call Azure directly.
MOCK_AZURE_OCR=false

# Document Intelligence behavior: live (default) or mock (deterministic stubs, no Azure calls for classification polling / labeling OCR; training APIs return 503)
# DOCUMENT_INTELLIGENCE_MODE=live

# Comma-separated list of allowed model IDs
AZURE_DOC_INTELLIGENCE_MODELS=prebuilt-layout

# Document model training
TRAINING_SAS_EXPIRY_DAYS=7
TRAINING_MIN_DOCUMENTS=5
TRAINING_POLL_INTERVAL_SECONDS=10
TRAINING_MAX_POLL_ATTEMPTS=60

# Benchmarking
BENCHMARK_TASK_QUEUE=benchmark-processing
ENABLE_BENCHMARK_QUEUE=true

# Seed: your SSO "sub" claim (GUID) — adds you to the default group on seed
SEED_USER_SUB=
SEED_USER_EMAIL=

# Integration test authentication
TEST_API_KEY=xxxxxx
WORKFLOW_TEMPLATE=standard-ocr-workflow
TEST_FILE=test-document.jpg

# ── Temporal worker ───────────────────────────────────────────────────────────
# Mistral Document AI OCR
MISTRAL_API_KEY=
# Set to true for local tests without calling Mistral (deterministic mock result)
MOCK_MISTRAL_OCR=false

# Azure OpenAI (optional — for LLM enrichment when enableLlmEnrichment is true)
AZURE_OPENAI_ENDPOINT=https://your-openai-resource.openai.azure.com
AZURE_OPENAI_API_KEY=your-openai-api-key
AZURE_OPENAI_DEPLOYMENT=gpt-4o
AZURE_OPENAI_API_VERSION=2024-12-01-preview

# Optional: redact PII (SIN, phone, $ amounts) in text sent to the LLM
# ENRICHMENT_REDACT_PII=true

# ── Frontend (Vite — only VITE_ prefixed vars are exposed to the browser) ─────
# Note: VITE_SSO_* must mirror the bare SSO_* values above — Vite only exposes
# vars with the VITE_ prefix, so both are needed in the same .env file.
VITE_API_BASE_URL=http://localhost:3002/api
# Don't populate VITE_TEST_API_KEY unless actively testing. Will cause unexpected 401s.
VITE_TEST_API_KEY=
VITE_APP_NAME=AI OCR Frontend
VITE_APP_VERSION=1.0.0
VITE_SSO_AUTH_SERVER_URL=https://dev.loginproxy.gov.bc.ca/auth/realms/standard/protocol/openid-connect
VITE_SSO_REALM=standard
VITE_SSO_CLIENT_ID=xxxxxxxxxxxxxx
VITE_HITL_MAX_CONFIDENCE=0.9
VITE_TEMPORAL_UI_URL=http://localhost:8088

# ── Logging ───────────────────────────────────────────────────────────────────
# Options: debug | info | warn | error  (default: info)
LOG_LEVEL=info

# ── Monitoring stack (only needed when running docker compose --profile monitoring) ──
# Grafana admin credentials
GRAFANA_ADMIN_USER=admin
GRAFANA_ADMIN_PASSWORD=admin

# ches-adapter: shared Bearer token that Alertmanager uses to authenticate.
# Alertmanager reads this from a mounted Kubernetes Secret file (credentials_file:) — not from the ConfigMap.
CHES_ADAPTER_SECRET=

# CHES OAuth2 client credentials (from your CHES service account).
CHES_CLIENT_ID=
CHES_CLIENT_SECRET=

# Keycloak token endpoint for CHES authentication.
# Example: https://dev.loginproxy.gov.bc.ca
CHES_AUTH_HOST=

# CHES API base URL.
# Dev:        https://ches-dev.api.gov.bc.ca
# Test:       https://ches-test.api.gov.bc.ca
# Production: https://ches.api.gov.bc.ca
CHES_HOST=

# Email sender address (must be an approved CHES sender for your team).
CHES_FROM_EMAIL=

# Comma-separated list of recipient email addresses for alert notifications.
# Example: ops-team@example.com,oncall@example.com
CHES_TO_EMAILS=

# Set to true if you want the system to delete Azure classifiers not recorded in the database
# This could be an issue if used in a shared development environment
# where multiple databases exist but all systems use the same Azure namespace
ENABLE_CLASSIFIER_ORPHAN_CLEANUP=

# Email address from your IDIR account to allow for initial user setup
BOOTSTRAP_ADMIN_EMAIL=