.env.example

# embd secrets — copy to .env and fill in values.
# .env is loaded automatically by embd; it is git-ignored.

# Anthropic Claude API key (required when backend = "claude")
ANTHROPIC_API_KEY=

# embd retrieval API key for `embd serve` (required for POST /query)
# Also required for Docker Compose nginx (Bearer check). Generate: openssl rand -hex 32
EMBD_API_KEY=

# Public URL for OpenAPI `servers` (ChatGPT Actions requires port 443).
# EMBD_OPENAPI_BASE_URL=https://embd.example.com

# HuggingFace token (optional — public models like BAAI/bge-m3 work without it;
# setting this silences the "unauthenticated requests" warning and raises rate limits)
# HF_TOKEN=

# --- Docker Compose / nginx (optional; see README) ---

# Production (Let's Encrypt on host): merge the LE overlay so nginx can read
# /etc/letsencrypt/... inside the container. Without this, ONLY ./deploy/certs is mounted.
# COMPOSE_FILE=docker-compose.yml:deploy/docker-compose.le.yml

# Host port → container 443 (ChatGPT Actions requires standard 443)
# EMBD_LISTEN_PORT=443
# Host port → container 80 (HTTP→HTTPS in nginx). If host 80 is taken, use e.g. 8099
# EMBD_LISTEN_HTTP=8099

# server_name in nginx:
# EMBD_PUBLIC_HOST=embd.example.com

# HTTP → HTTPS redirect target (no trailing slash):
# EMBD_REDIRECT_TO_HTTPS=https://embd.example.com

# Host path bind-mounted to /etc/nginx/certs (self-signed dev writes here)
# CERT_HOST_PATH=./deploy/certs

# Real TLS files inside the container (use with docker-compose.le.yml overlay):
# EMBD_TLS_FULLCHAIN=/etc/letsencrypt/live/embd.example.com/fullchain.pem
# EMBD_TLS_PRIVKEY=/etc/letsencrypt/live/embd.example.com/privkey.pem

# 1 = generate self-signed PEMs when no real certs (local dev only). Production: 0
# ALLOW_SELF_SIGNED=1