.env.example

# === CLI MVP (required for hero-loop commands) ===
# LIFEOS_GRAPH_PATH is configured via app config defaults/local profile.
# Security: JWT Signing Secrets
# JWT signing secret — REQUIRED in all non-development environments.
# JwtService throws at startup if this is not set (unless NODE_ENV=development
# AND LIFEOS_JWT_ALLOW_INSECURE_DEFAULT=true, which is only for local dev).
# Precedence: LIFEOS_JWT_SECRET → LIFEOS_MASTER_KEY → throw (in production)
# LIFEOS_JWT_SECRET=

# Optional fallback signing secret. When set, used if LIFEOS_JWT_SECRET is absent.
# Prefer setting LIFEOS_JWT_SECRET explicitly in new deployments.
# Both vars should be rotated on the same schedule.
# LIFEOS_MASTER_KEY=

# Set to 'true' only for local development when you want to skip setting a real secret.
# LIFEOS_JWT_ALLOW_INSECURE_DEFAULT=

# === Optional: NATS transport (for module reactions and sync) ===
NATS_URL=nats://nats:4222
LIFEOS_NATS_URL=nats://127.0.0.1:4222

# NATS NKey/JWT Auth
# Populated by scripts/provision-nats-identities.sh
NATS_OPERATOR_JWT=CHANGEME
NATS_ACCOUNT_JWT=CHANGEME
NATS_CREDS_DIR=.nats/creds

# === Optional: Household and Home Node ===
LIFEOS_HOUSEHOLD_DB_PATH=./data/household.db
LIFEOS_HOME_NODE_PORT=3010
LIFEOS_HOME_NODE_DB_PATH=./data/home-node.db
LIFEOS_HOME_NODE_SURFACE_SECRET=CHANGEME # Protects all home-node display lifecycle routes (homes provisioning, zones provisioning, surface registration/deregistration/heartbeat, display-feed, display-feed-hints, and snapshot endpoints) via the x-lifeos-surface-secret header or request body field
LIFEOS_WHISPER_ENDPOINT=http://127.0.0.1:9000/whisper
LIFEOS_WHISPER_TIMEOUT_MS=8000
LIFEOS_HOME_NODE_VOICE_RETAIN_AUDIO=false
LIFEOS_HOME_NODE_VOICE_SESSION_TTL_MS=60000 # Voice session TTL in milliseconds; defaults to 60000 (60 s) if unset; used by VoiceSessionManager
LIFEOS_DASHBOARD_BASE_URL=http://localhost:3000 # Base URL of the dashboard service used by the display feed aggregator; defaults to http://localhost:3000 if unset

# === Extended Platform Stack (not required for CLI MVP) ===
POSTGRES_USER=lifeos
POSTGRES_PASSWORD=CHANGEME
POSTGRES_DB=lifeos
NEO4J_AUTH=neo4j/CHANGEME
LIFEOS_GOAL_ENGINE_DB_PASSWORD=CHANGEME
LIFEOS_APPROVAL_WORKFLOW_DB_PASSWORD=CHANGEME
LIFEOS_EVENT_STORE_DB_PASSWORD=CHANGEME
LIFEOS_AUTH_DB_PASSWORD=CHANGEME
LIFEOS_SECRETS_DB_PASSWORD=CHANGEME
LIFEOS_SERVICE_CATALOG_DB_PASSWORD=CHANGEME
LIFEOS_FEATURE_FLAGS_DB_PASSWORD=CHANGEME
LIFEOS_SCHEDULER_DB_PASSWORD=CHANGEME
LIFEOS_OBSERVABILITY_DB_PASSWORD=CHANGEME
LIFEOS_LIFE_GRAPH_REL_DB_PASSWORD=CHANGEME
GRAFANA_ADMIN_PASSWORD=CHANGEME