.env.example

# FlashGen environment — copy to .env (cp .env.example .env && edit values).
#
# This file is for LOCAL CLI use only. The Docker deployment no longer reads
# .env: the flashgen-mcp container reads every secret it needs from Docker
# file-secrets (see below), so nothing here lands in the container env or
# `docker inspect`. The legacy systemd unit that loaded this file is disabled.

# TTS / generation providers for the CLI (set at least the one you use).
# read_secret() falls back to these env vars when no *_FILE secret is mounted.
OPENAI_API_KEY=
GEMINI_API_KEY=

# Container secrets are NOT set here. They are mounted into the flashgen-mcp
# container as Docker Compose file-secrets so they never land in the container
# env or `docker inspect`. Create them on the host (gitignored, deploy-rsync-
# excluded) and chmod 600:
#   mkdir -p deploy/secrets
#   printf %s '<bearer-token>' > deploy/secrets/flashgen_mcp_token
#   printf %s 'sk-...'         > deploy/secrets/openai_api_key
#   printf %s 'AIza...'        > deploy/secrets/gemini_api_key
#   printf %s 'you@example.com'> deploy/secrets/ankiweb_username
#   printf %s 'your-password'  > deploy/secrets/ankiweb_password
#   chmod 600 deploy/secrets/*
# The app reads each via <NAME>_FILE (flashgen.read_secret); the flashgen-sync
# addon reads ANKIWEB_USERNAME_FILE / ANKIWEB_PASSWORD_FILE.
#
# FLASHGEN_MCP_TOKEN is the bearer token Claude presents to the MCP server
# (the OAuth token endpoint echoes it).

# NOTE: do NOT set ANKI_CONNECT_URL here. The flashgen-mcp container overrides it
# to http://anki:8765 in docker-compose.yml so it reaches AnkiConnect over the
# private compose network. The CLI defaults to http://127.0.0.1:8765.