# OpenVibe.Actor — environment (production: /etc/openvibe/actor.env). Names only; never commit values.

NODE_ENV=production
PORT=4950
HOST=127.0.0.1
BASE_URL=https://openvibe.actor
TRUST_PROXY=2
# PostgreSQL (ADR-035), written by OpenVibe.Host roles/data/add-service.sh actor: the runtime role through PgBouncer,
# the owner on a direct connection (migrations), and Valkey (shared limit counters).
# Without DATABASE_URL, development uses an embedded PGlite database in data/pglite.
DATABASE_URL=
DATABASE_DIRECT_URL=
VALKEY_URL=
VALKEY_PREFIX=
# Per-caller limits (server/http/caller-limits.js): reads one caller may make to the API per minute and per hour.
#ACTOR_LIMITS_MINUTE=120
#ACTOR_LIMITS_HOUR=3000

# OpenVibe.Network: SSO (OAuth client `actor`, PKCE S256) and its JWKS; app tokens for audience openvibe.actor.
OV_NETWORK_URL=https://openvibe.network
OV_NETWORK_INTERNAL_URL=http://127.0.0.1:4000
OV_OAUTH_CLIENT_ID=actor
OV_OAUTH_CLIENT_SECRET=
# OV_OAUTH_REDIRECT_URI=https://openvibe.actor/auth/callback
# ACTOR_AUDIENCE=openvibe.actor

# OpenVibe.AI (the model gateway a person's own keys live in; server/runtime/models.js). The catalog flag is off by
# default: with it on, Actor reads GET /v1/models with its service token and offers the aliases and exact ids where a
# person picks the model their tasks run on.
# OV_AI_URL=https://ai.openvibe.services
# ACTOR_AI_CATALOG=1

# OpenVibe.Events → Actor (ADR-033 account export and deletion): the secret signs a delivery (comma-separated for
# rotation, 32+ characters each; unset makes POST /internal/events answer 503); the url is where the two subscriptions
# are created at boot (off when unset); ACTOR_EVENTS_SUBSCRIBE=0 turns that off.
ACTOR_EVENTS_SECRET=
ACTOR_EVENTS_URL=
#ACTOR_EVENTS_ENDPOINT=http://127.0.0.1:4950/internal/events

# OpenVibe.AI: the AI layer of this product (the owner, 11-06: every product on the one router). With
# ACTOR_AI_ROUTER=1 every model call is a run of ai.complete on AI, which picks the offer by price, latency and
# policy and says which model ran; Actor then needs NO provider key below. The person a task belongs to rides as
# on_behalf_of, so their allowance and their Balance pay; the run is theirs.
# Hosted production defaults on; a self-hosted Actor leaves it off and keeps its own model below.
ACTOR_AI_ROUTER=
# Hosted turns use Exchange's compatible API with Actor's existing service token. A slow class or
# targeted run still uses AI's runs API; 0 rolls ordinary turns back to the runs API.
# ACTOR_EXCHANGE_ROUTER=0
# ACTOR_EXCHANGE_URL=https://api.openvibe.exchange
# The token is Actor's service token for audience openvibe.ai (ai.run.create, namespace ai.complete).
# OV_AI_URL=https://ai.openvibe.services
# ACTOR_AI_TIMEOUT_MS=180000
# ACTOR_AI_WAIT_MS=120000
# Each tier's policy on the router (economy | balanced | fast | auto | private), or an exact id
# (<org>/<model>@<revision>) when AI's catalog is on.
# ACTOR_AI_MODEL_FAST=openvibe/economy
# ACTOR_AI_MODEL_SMART=openvibe/balanced
# ACTOR_AI_MODEL_BEST=openvibe/auto
# ACTOR_AI_MODEL_CHECK=openvibe/economy
# ACTOR_AI_MODEL_VISION=openvibe/auto
# The per-call ceiling (USD, exact decimal) AI holds against the person's Balance. Unset: no cap.
# ACTOR_AI_MAX_COST_USD=

# The model providers behind the agents (server/agents/catalog.js). Unused when ACTOR_AI_ROUTER=1; keep them for a
# self-hosted Actor (docs/self-host.md). An agent without its key is listed as unavailable.
ACTOR_DEEPSEEK_API_KEY=
# ACTOR_DEEPSEEK_MODEL=deepseek-flash
ACTOR_OPENAI_API_KEY=
# ACTOR_OPENAI_MODEL=gpt-5-mini
# ACTOR_OPENAI_CHECK_MODEL=gpt-5-nano
# The checker for answers backed by tool results (it compares them; the nano model did not):
# ACTOR_OPENAI_GROUNDED_CHECK_MODEL=gpt-5-mini
# The open model on this server (private mode): an OpenAI-compatible server such as llama.cpp.
ACTOR_LOCAL_LLM_URL=
ACTOR_LOCAL_LLM_MODEL=

# The runtime on any OpenAI-compatible model instead of DeepSeek (a self-hosted Actor's usual choice; docs/self-host.md):
# its endpoint, model, key (if any) and price per million tokens (0 for your own hardware).
ACTOR_RUNTIME_URL=
ACTOR_RUNTIME_MODEL=
ACTOR_RUNTIME_API_KEY=
ACTOR_RUNTIME_INPUT_USD_PER_MTOK=0
ACTOR_RUNTIME_OUTPUT_USD_PER_MTOK=0

# A self-hosted Actor (docs/self-host.md): one owner, no OpenVibe.Network. `npm run selfhost:init` writes these.
# ACTOR_SELF_HOSTED=1
# ACTOR_OWNER_NAME=
# ACTOR_OWNER_SUBJECT=
# ACTOR_OWNER_PASSWORD_HASH=
# ACTOR_OWNER_TOKEN=
# ACTOR_SESSION_SECRET=
# DATA_DIR=
# The OpenVibe services the runtime acts through.
# Direct coding tasks use Actor's shared loop and Codes tool by default; set 0 to use the old Codes adapter.
# ACTOR_UNIFIED_CODE_RUNS=1
# Mid-run model switching and the Codes session bridge are on by default; set either to 0 to turn it off.
# ACTOR_A4_MODEL_SWITCH=1
# ACTOR_CODES_SESSION_BRIDGE=1
# ACTOR_SEARCH_URL=https://search.openvibe.network
# ACTOR_TOOLS_URL=https://openvibe.tools
# OpenVibe.Space: the person's own spaces, which their agent builds (plan 2026-10-22 §Z stage Z1). With this
# address the space_* tools are offered to a person's task; without it they are off.
# ACTOR_SPACE_URL=http://127.0.0.1:4940
# OpenVibe.Watch: a trigger's subscription lives there, created and changed with the person's own token. Empty
# turns triggers off.
# ACTOR_WATCH_URL=http://127.0.0.1:4730
# The files and charts a task makes (Actor v2, stage V2-4) live in Actor's own PostgreSQL, private to the person who
# asked, and are served from the task's own page (server/runtime/artifacts.js says why they are not on OpenVibe.Media).
# The largest single file a task may make, and the most one task may hold.
# ACTOR_ARTIFACT_MAX_FILE_BYTES=262144
# ACTOR_ARTIFACT_MAX_TASK_BYTES=2097152

# Durable runs (Actor v2, stage V2-9): a checkpoint after every step, sealed with AES-256-GCM under this key (64 hex
# characters). Unset means checkpoints are off and a restart fails a running task as before. Never commit the value.
# ACTOR_CHECKPOINT_KEY=
# The last N checkpoints kept per task (older ones are pruned), and how many times a task may resume after a restart.
# ACTOR_CHECKPOINT_KEEP=50
# ACTOR_CHECKPOINT_MAX_RESUMES=2


# Money: the free tier per person, and the operator's ceiling over everyone in one UTC day (USD).
#ACTOR_FREE_TASKS_PER_DAY=20
#ACTOR_FREE_PER_TASK_USD=0.05
#ACTOR_FREE_PER_DAY_USD=0.05
#ACTOR_MAX_COST_USD_PER_DAY=2
#ACTOR_MAX_RUNNING=4
#ACTOR_TASK_TIMEOUT_MS=180000
# Personal agents: maximum definitions per person and due agents claimed per scheduler tick.
#ACTOR_AGENTS_MAX_PER_OWNER=10
#ACTOR_AGENTS_TICK_MAX=5
# Task webhooks: how often due deliveries go out, and how long one delivery may take
#ACTOR_WEBHOOK_INTERVAL_MS=5000
#ACTOR_WEBHOOK_TIMEOUT_MS=10000

# optional: defaults to true in production
# COOKIE_SECURE=true