# ═══════════════════════════════════════════════════════════════
# openvibe.news — environment configuration (names only; never commit values)
# Copy to .env for development. Production: /etc/openvibe/news.env (0600).
# ═══════════════════════════════════════════════════════════════

# Server
PORT=4820
HOST=127.0.0.1
NODE_ENV=development
# Public origin: canonical URLs, feeds, sitemaps and JSON-LD are built from it
BASE_URL=http://localhost:4820
# Proxy hops that set X-Forwarded-For (Cloudflare → nginx → Node = 2)
TRUST_PROXY=2
# Per-actor limits (server/http/actor-limits.js): API reads one caller (a signed-in person, an app,
# else an address) may make per minute and per hour; past them 429 rate_limited with Retry-After.
# Signed-out reads keep the per-address limit only. Writes, AI drafts and pulls have their own numbers
# (README). The per-address limits stay.
#NEWS_LIMITS_MINUTE=120
#NEWS_LIMITS_HOUR=3000

# PostgreSQL (ADR-035), written by OpenVibe.Host roles/data/add-service.sh news: the runtime role through PgBouncer,
# the owner on a direct connection (migrations), and Valkey (shared limit counters).
# Without DATABASE_URL, development uses an embedded PGlite database in data/pglite.
DATABASE_URL=
DATABASE_DIRECT_URL=
VALKEY_URL=
VALKEY_PREFIX=

# OpenVibe.Network — SSO (OAuth2), JWKS, client-credentials tokens
OV_NETWORK_URL=https://openvibe.network
OV_NETWORK_INTERNAL_URL=http://127.0.0.1:4000
# OAuth client `news` (redirect https://openvibe.news/auth/callback). The same client is News'
# service principal svc:news for client-credentials grants (see README, "Grants").
OV_OAUTH_CLIENT_ID=news
OV_OAUTH_CLIENT_SECRET=
# Production: https://openvibe.news/auth/callback (default: BASE_URL + /auth/callback)
#OV_OAUTH_REDIRECT_URI=
# Cookies: Secure by default in production; set false for plain-http local development
#COOKIE_SECURE=false
# Signs the editor-desk form tokens (CSRF). Unset: random per process.
#NEWS_FORM_SECRET=

# Editors: Network subjects (usr_…), comma-separated (a product role). Staff with staff.editorial.manage
# (Network admins) are editors too.
NEWS_EDITORS=

# OpenVibe.Sources — news items (sources.item.read; optionally sources.source.read for outlet names)
OV_SOURCES_INTERNAL_URL=http://127.0.0.1:4720
# Cursor pull (backstop for missed webhook deliveries); 0 turns it off
#NEWS_PULL_INTERVAL_MS=300000
#NEWS_PULL_PAGE_SIZE=100
#NEWS_PULL_MAX_PAGES=20
#NEWS_SOURCES_TIMEOUT_MS=8000

# Licensing: the longest source summary kept (and only when the source's terms allow short summaries)
#NEWS_SUMMARY_MAX_CHARS=280
# Indexing: independent sources a story must cite to be indexable (fewer: published but noindex,
# out of sitemaps). Items from one Sources source, one publisher's domain or one outlet, or copies
# of one report, count once. Minimum 1.
#NEWS_MIN_INDEPENDENT_SOURCES=2
# Clustering window
#NEWS_CLUSTER_WINDOW_HOURS=72

# OpenVibe.Events — the outbox relay runs only when EVENTS_URL and OV_OAUTH_CLIENT_SECRET are set
#EVENTS_URL=http://127.0.0.1:4300
#EVENTS_RELAY_INTERVAL_MS=2000
# Signing secret(s) of News' subscriptions (sources.item.*, sources.fetch.failed), comma-separated
# during rotation. Generate before `npm run subscribe` (e.g. `openssl rand -hex 32`).
# Unset = webhook off (503); the cursor pull still runs.
#NEWS_EVENTS_SECRET=

# OpenVibe.Community — the comment thread of each public story (referenced by id, never copied).
# Needs the grants community.comment.write and community.comment.moderate (audience openvibe.community);
# without them a story page says comments are unavailable.
# optional: defaults to https://openvibe.community
# OV_COMMUNITY_URL=https://openvibe.community
# optional: defaults to http://127.0.0.1:4200
# OV_COMMUNITY_INTERNAL_URL=http://127.0.0.1:4200

# OpenVibe.AI (optional) — news.summarize_story / news.compare_perspectives drafts (ai.run.create).
# Unset: no AI; editors write every story from the source items.
#OV_AI_INTERNAL_URL=http://127.0.0.1:4700
#NEWS_AI_WAIT_MS=30000

# Background worker (the Sources pull); off: NEWS_WORKER=off
#NEWS_WORKER=on

# Browser origins that may call /api/v1 with a Bearer Network JWT
#API_CORS_ORIGINS=https://openvibe.network,https://openvibe.live,https://openvibe.community

# release.json (openvibe-shared/release): the deployed commit when git is not available
#RELEASE_COMMIT=
#MIN_CLIENT_RELEASE=