# Copy to .env next to docker-compose.yml. Only variables Kanesh reads are listed.

# Image and port
KANESH_IMAGE=ghcr.io/kaneshdev/kanesh:latest
PUBLISH_PORT=8080

# Database: sqlite (default), postgres or mysql
DATABASE_DRIVER=sqlite
# DB_PASSWORD=change-me
# PostgreSQL: DATABASE_URL=postgres://kanesh:change-me@postgres:5432/kanesh?sslmode=disable
# MySQL (go-sql-driver DSN, not mysql://): DATABASE_URL=kanesh:change-me@tcp(mysql:3306)/kanesh
# DATABASE_URL=

# First owner (new installs only). Prefer ADMIN_PASSWORD_FILE with a secret.
# ADMIN_EMAIL=you@example.com
# ADMIN_PASSWORD=
# ADMIN_PASSWORD_FILE=/run/secrets/admin_password
# BOOTSTRAP_TOKEN=

# Agents
MCP_ENABLED=false
# AUTH_TOKEN_HEADER=X-Api-Key

# HTTPS and security
COOKIE_SECURE=false
# HSTS_ENABLED=true
# CONTENT_SECURITY_POLICY=
# CORS_ENABLED=false
# CORS_ORIGINS=https://app.example.com
RATE_LIMIT_ENABLED=true
# RATE_LIMIT_POINTS=600
# RATE_LIMIT_DURATION=1m
# TRUSTED_PROXIES=10.0.0.0/8
# SETTINGS_ENCRYPTION_KEY=at-least-16-characters

# Access policy
# PASSWORD_MIN_LENGTH=12
# SESSION_LIFETIME=8h
# LOGIN_MAX_ATTEMPTS=5
# LOGIN_LOCKOUT=1m
# TOKEN_MAX_LIFETIME=8760h

# Email (SMTP relay)
# SMTP_HOST=smtp.example.com
# SMTP_PORT=587
# SMTP_TLS=starttls
# SMTP_USERNAME=
# SMTP_PASSWORD=
# SMTP_FROM=noreply@example.com

# Logging and shutdown
LOG_LEVEL=info
LOG_FORMAT=json
SHUTDOWN_TIMEOUT=10s

# Public demo only: shows ADMIN_EMAIL/ADMIN_PASSWORD (the owner) on the login screen.
DEMO_MODE=false

# File storage: database blobs today. S3 / MinIO is planned; there are no S3 variables yet.