.env.example

# Copy to .env and fill in the secrets, then (local, all-in-one):
#   docker compose -f docker-compose.yaml -f docker-compose.postgres.yml -f docker-compose.traefik.yml up -d --build

# --- Environment ---
ENV=production
# Log verbosity: DEBUG | INFO | WARNING | ERROR
LOG_LEVEL=INFO

# --- Reverse proxy (bundled Traefik) ---
# Host ports the bundled Traefik (docker-compose.traefik.yml) publishes. Locally the dashboard is at
# http://localhost:${HTTP_PORT} and the API at http://localhost:${HTTP_PORT}/api. For a real deployment set
# HTTP_PORT=80 and HTTPS_PORT=443 (see the production block at the bottom).
HTTP_PORT=8080
HTTPS_PORT=8443

# --- Public domain ---
# Host the proxy is served on. Leave as localhost for the local setup; set it to your domain for a real deployment
# (dashboard at https://${DOMAIN}/, API at https://${DOMAIN}/api). Also used as the CORS origin.
DOMAIN=localhost

# --- Database ---
# With the bundled Postgres (docker-compose.postgres.yml), leave POSTGRES_HOST=postgres (the compose service name).
# To use your own Postgres, point it there and omit docker-compose.postgres.yml from the up command.
POSTGRES_HOST=postgres
POSTGRES_PORT=5432
POSTGRES_USER=claude_proxy
POSTGRES_PASSWORD=change-me-postgres
POSTGRES_DB=claude_code_proxy

# --- Secrets (REQUIRED; the backend refuses to start with empty/placeholder/weak values) ---
# Encrypts pooled-account OAuth tokens at rest.
# Generate: python -c "from cryptography.fernet import Fernet; print(Fernet.generate_key().decode())"
FERNET_KEY=
# Dashboard admin login.
ADMIN_USERNAME=admin
ADMIN_PASSWORD=
# Signs admin session JWTs (must be >= 32 chars).
# Generate: python -c "import secrets; print(secrets.token_urlsafe(48))"
JWT_SECRET=

# Rotation policy (per-account threshold, cooldown, failover budget) is configured per account in the dashboard,
# not here. New accounts start at 1.0 / 60s / 3.

# How often the quota-refresher sidecar re-probes each account's usage + subscription tier (seconds).
QUOTA_REFRESH_INTERVAL_SECONDS=60

# Demand-triggered account-window warm-up. No synthetic traffic is sent while
# idle; after real traffic pushes aggregate five-hour pool usage to this
# threshold, all other eligible cold accounts are warmed in one batch.
WARMUP_ENABLED=true
FALLBACK_GENERATION_CANARY_ENABLED=true
FALLBACK_CANARY_MAX_OUTPUT_TOKENS=1
MODEL_CONCURRENCY_LIMITS_JSON={}
TIER_CONCURRENCY_LIMITS_JSON={}
WARMUP_TRIGGER_POOL_USAGE_PCT=0.20
WARMUP_WEEKLY_RESERVE_PCT=0.90
WARMUP_MODEL=claude-haiku-4-5

# Comma-separated model IDs exposed by the local catalog and dashboard.
# Defaults shown here; remove an entry or add a model ID to change the catalog.
ALLOWED_MODELS=claude-fable-5,claude-fable-5-1,claude-haiku-4-5-20251001,claude-opus-4-6,claude-opus-4-8,claude-opus-5,claude-opus-5-5,claude-sonnet-5

# Default proxy rate limit (requests/minute) for API keys with no explicit override; 0 = unlimited.
DEFAULT_KEY_RATE_LIMIT_PER_MINUTE=0

# Optional approved outbound paths. The first enabled target is the default.
# `proxy_url` points to listeners from the
# separate host-network relay project; use unique host ports per proxy project.
# Never commit the real relay token.
EGRESS_TARGETS_JSON=
DEFAULT_EGRESS_MAX_CONCURRENCY=32
EGRESS_RELAY_USERNAME=recallr
EGRESS_RELAY_TOKEN=
EGRESS_RELAY_HEALTH_PORT=18090
# EGRESS_RELAY_ALLOWED_HOSTS=api.anthropic.com,anthropic.com,.anthropic.com

# --- Raw request/response archive (S3-compatible, e.g. MinIO) ---
# The proxy forwards response chunks immediately while buffering only its private
# archive copy, then writes one complete raw response.json object.
ARCHIVE_ENABLED=false
ARCHIVE_REQUIRED=true
ARCHIVE_S3_ENDPOINT_URL=http://minio:9000
ARCHIVE_S3_REGION=us-east-1
ARCHIVE_S3_BUCKET=cc-proxy
ARCHIVE_S3_PREFIX=
ARCHIVE_S3_ACCESS_KEY_ID=
ARCHIVE_S3_SECRET_ACCESS_KEY=
ARCHIVE_S3_FORCE_PATH_STYLE=true
ARCHIVE_S3_MAX_ATTEMPTS=4
ARCHIVE_HOT_RETENTION_DAYS=2
ARCHIVE_RETENTION_ENABLED=false
ARCHIVE_RETENTION_INTERVAL_SECONDS=3600
ARCHIVE_BORG_HOST_DIR=/srv/claude-code-proxy/borg
ARCHIVE_BORG_REPOSITORY=/borg/repository
ARCHIVE_RETENTION_WORK_DIR=/borg/work
ARCHIVE_RETENTION_BATCH_BYTES=536870912
ARCHIVE_RETENTION_MIN_FREE_GIB=10
ARCHIVE_RETENTION_DELETE_MINIO=false

# --- Production HTTPS (bundled Traefik + Let's Encrypt) ---
# For a real deployment, set DOMAIN above to your host, then uncomment these and set HTTP_PORT=80 / HTTPS_PORT=443.
# TRAEFIK_ENTRYPOINT switches the routers from plain HTTP (`web`) to TLS (`websecure`); ACME_EMAIL is the contact
# Let's Encrypt registers for the certificate.
# TRAEFIK_ENTRYPOINT=websecure
# ACME_EMAIL=you@example.com
# Requests wait briefly for a cooling/refreshing account before returning 503.
POOL_WAIT_TIMEOUT_SECONDS=150
POOL_WAIT_POLL_INTERVAL_SECONDS=2
TRANSIENT_UPSTREAM_COOLDOWN_SECONDS=5