# Praxis — Environment Configuration (v0.2)
# Copy to `.env` and fill in real values.
# Voice-service keys are in .ciagent/.env.secrets (not this file).
# Proxmox deployment vars are sourced from ~/coreci/.ciagent/.env.secrets (D-026).

# ─── Voice services ──────────────────────────────────────────────────────────
# Deepgram Nova-3 ASR (D-013). Get from https://console.deepgram.com/
DEEPGRAM_API_KEY=

# Cartesia Sonic TTS (D-014, primary). Get from https://cartesia.ai/
CARTESIA_API_KEY=

# Ollama Cloud direct API (D-020). Get from https://ollama.com/ → Settings → API Keys
OLLAMA_API_KEY=

# ─── TTS selection (D-014) ────────────────────────────────────────────────────
# cartesia (default, cloud, ~120ms first-audio) | piper (self-hosted, ~80ms, R4 mitigation)
PRAXIS_TTS=cartesia

# ─── Ollama Cloud endpoints (D-020) ───────────────────────────────────────────
# Direct API mode (no local daemon). Pipecat's OLLamaLLMService uses the OpenAI-compatible path.
OLLAMA_BASE_URL=https://ollama.com/v1
OLLAMA_CHAT_URL=https://ollama.com/api/chat
# Role-play fast path (256K ctx, low-latency)
OLLAMA_ROLEPLAY_MODEL=gemma4:cloud
# Debrief + branch classifier (1M ctx, no-think mode for latency)
OLLAMA_DEBRIEF_MODEL=deepseek-v4-flash:cloud

# ─── Server ───────────────────────────────────────────────────────────────────
PRAXIS_HOST=0.0.0.0
PRAXIS_PORT=8789
# In Docker: /app/data/praxis.db (volume-mounted). Local dev: ./praxis.db
PRAXIS_DB_PATH=./praxis.db
PRAXIS_SCENARIOS_DIR=./scenarios
# Client dist directory (for FastAPI StaticFiles serving, D-023)
PRAXIS_CLIENT_DIST=client/dist

# ─── Deepgram live options (D-013) ────────────────────────────────────────────
DEEPGRAM_MODEL=nova-3
DEEPGRAM_LANGUAGE=en
DEEPGRAM_REGION=na

# ─── Cartesia voice (D-006 — one voice for role-play + mentor) ────────────────
CARTESIA_VOICE_ID=a3536a36-1d18-4efb-a95a-7c44b7b5e384

# ─── Proxmox LXC deployment (v0.2) ────────────────────────────────────────────
# These are sourced from ~/coreci/.ciagent/.env.secrets (D-026 — same cluster).
# Listed here for documentation; do NOT duplicate in .ciagent/.env.secrets.
# PROXMOX_API_URL=https://proxmox:8006/api2/json
# PROXMOX_API_TOKEN=root@pam!praxis-deploy=SECRET
# PROXMOX_NODE=ns1003845
# PROXMOX_STORAGE=local
# PROXMOX_TEMPLATE_VOLID=local:vztmpl/debian-12-standard_12.2-1_amd64.tar.zst
# PROXMOX_LXC_VMID=auto
# PROXMOX_TLS_SKIP_VERIFY=true
# v0.4: bumped to 6144 (Postgres ~400MB + praxis ~500MB + Docker ~200MB
# + build headroom ~1GB + margin — REQ-NFR-MT-01).
# PROXMOX_MEMORY_MB=6144

# ─── CI/Gitea (operational — not voice) ───────────────────────────────────────
# GITEA_TOKEN is provisioned in .ciagent/.env.secrets (not this file).
# PRAXIS_VERSION (git ref to deploy, default: main)

# ─── v0.4 Operator Tier (Postgres + Auth) ────────────────────────────────────
# These configure the operator surface (cohort dashboard, auth, VC migration).
# Real values are secrets — put them in .ciagent/.env.secrets, not here.
# This file is documentation-only (committed); .env.secrets is gitignored.

# Postgres password. Secret. Used in the DSN below + docker-compose postgres
# service (POSTGRES_PASSWORD). Generate with: openssl rand -base64 32
PRAXIS_PG_PASSWORD=

# Postgres DSN (D-050). host=postgres is the docker-compose service DNS name
# on the praxis-net bridge. Format:
#   postgresql://praxis:${PRAXIS_PG_PASSWORD}@postgres:5432/praxis
# When unset/empty, the server starts in graceful no-pool mode (learner voice
# loop works; operator auth + cohort endpoints return 503).
PRAXIS_PG_DSN=

# Cookie signing secret (D-056, R-AUTH-01). >=32 random bytes, base64 or hex.
# Secret. Generate with: openssl rand -base64 48
# When unset, the server generates an ephemeral random secret (dev ONLY —
# sessions won't survive a restart; NOT for pilot/production).
PRAXIS_COOKIE_SECRET=

# Cookie Secure flag (D-041, R-AUTH-01, G-031). Default true (HTTPS).
# Set to false ONLY for the HTTP pilot (no TLS in the LXC pilot — D-030).
# NOTE (G-031): the PRIMARY mitigation for a sniffed cookie is the k-anon
# defense-in-depth (the cohort dashboard reads only k-anonymized aggregates,
# so a sniffed operator cookie leaks NO learner PII). This flag is the
# SECONDARY mitigation (operational convenience for when TLS arrives).
PRAXIS_COOKIE_SECURE=true

# Bootstrap operator credentials (D-052). Secret. Used by
# scripts/create-operator.py on first run to create the initial operator.
# If either is missing, the CLI exits 1 (R-BOOT-02).
PRAXIS_BOOTSTRAP_OPERATOR_USER=
PRAXIS_BOOTSTRAP_OPERATOR_PASS=

# VC issuer root key (v0.3 + v0.4). Secret. Used by nacl.SecretBox to encrypt
# Ed25519 private keys at rest (D-042). In v0.4 the migration script
# (server/vc/migrate_keys.py) uses this to encrypt the fresh v0.4 keypair;
# the v0.3 root key is kept for the v0.3 SQLite verification path (R-VC-MIG-02).
# Generate with: python3 -c "import nacl.utils; print(nacl.utils.random(32).hex())"
PRAXIS_VC_ISSUER_KEY=

# Issuer URL (D-042). The public base URL for VC issuer + key identifiers.
# v0.4 changes the default to /issuers/v0.4 (v0.3 VCs keep their v0.3 URLs
# embedded in their proofs — verification fetches keys by id, not by URL).
PRAXIS_ISSUER_URL=https://praxis.example/issuers/v0.4