.env.example

DATABASE_URI=postgres://osnova:osnova@localhost:5433/osnova
PAYLOAD_SECRET=change-me-payload-secret
SESSION_SECRET=change-me-session-secret-min-32-characters!!
APP_URL=http://localhost:3000

# Auth — emails listed here get the global system_admin role (both modes).
ADMIN_EMAILS=admin@example.com

# Authentication mode: 'proxy' (default) or 'oidc'. See docs/proxy-auth.md.
AUTH_MODE=proxy

# --- proxy mode (AUTH_MODE=proxy) ---------------------------------------------
# A trusted reverse proxy authenticates the user (corporate SSO) and injects their
# email in a header. The app trusts it — so the app MUST be reachable ONLY through
# the proxy (bind to 127.0.0.1) and the proxy MUST strip any client-supplied copy.
PROXY_AUTH_HEADER=X-User-UPN
PROXY_AUTH_NAME_HEADER=X-User-Name
# Optional given/family name headers (composed when the full-name header is absent). All name
# headers are optional — without any, the display name is derived from the email local-part.
PROXY_AUTH_GIVEN_NAME_HEADER=X-User-Given-Name
PROXY_AUTH_FAMILY_NAME_HEADER=X-User-Family-Name
# Optional defense-in-depth: require a secret header the proxy injects.
PROXY_AUTH_SHARED_SECRET=
PROXY_AUTH_SECRET_HEADER=X-Proxy-Secret
# Where /api/auth/logout redirects (the proxy/IdP sign-out URL); empty = home.
PROXY_LOGOUT_URL=
# Local dev only (ignored in production): act as this user without a real proxy.
PROXY_AUTH_DEV_USER=admin@example.com
# Fallback (default: true): if no identity header is present, offer OIDC login (below) instead
# of a "no session" notice. Only surfaces when KEYCLOAK_ISSUER is set. Set to false to disable.
PROXY_AUTH_OIDC_FALLBACK=true

# --- oidc mode (AUTH_MODE=oidc) -----------------------------------------------
# Only used when AUTH_MODE=oidc. The app performs an OIDC PKCE login itself.
KEYCLOAK_ISSUER=https://auth.example.com/realms/osnova
KEYCLOAK_CLIENT_ID=frontend
KEYCLOAK_CLIENT_SECRET=

WORKTREES_DIR=./data/worktrees
GITLAB_TOKEN=

# Avatars (optional, build-time public). Gravatar-style image URL derived from the user's
# email; {hash} = md5(lowercased email), {size} = pixels. Empty = render initials only.
# Example: NEXT_PUBLIC_AVATAR_URL_TEMPLATE=https://avatar.example.com/avatar/{size}/{hash}.jpg
NEXT_PUBLIC_AVATAR_URL_TEMPLATE=

# AI (opcjonalne) — dostawca LLM dla wcielania komentarzy. Status: /ai-health (system_admin).
# AI_PROVIDER wybiera aktywnego; pusty = pierwszy skonfigurowany (anthropic > openai > ollama).
AI_PROVIDER=
ANTHROPIC_API_KEY=
ANTHROPIC_MODEL=claude-sonnet-4-6
OPENAI_API_KEY=
OPENAI_MODEL=gpt-4o-mini
OPENAI_BASE_URL=
OLLAMA_BASE_URL=
OLLAMA_MODEL=llama3.1