.env.example

# ============================================
# ARIA — Environment template
# Copy to .env and fill in real values.
# Variables are mandatory unless marked [optional].
# ============================================

# --- TimescaleDB ---
POSTGRES_USER=aria
POSTGRES_PASSWORD=aria_dev_password
POSTGRES_DB=aria
POSTGRES_PORT=5432
# [optional] DB host. Defaults to "timescaledb" (the Docker service name).
#            Override to "localhost" when running the backend outside Docker.
# POSTGRES_HOST=timescaledb

# --- Backend (FastAPI) ---
BACKEND_PORT=8000
JWT_SECRET_KEY=change-me-32-bytes-minimum-secret-key-aria
JWT_ACCESS_TTL_MINUTES=15
JWT_REFRESH_TTL_DAYS=7
MCP_API_KEY=change-me-mcp-api-key

# --- Frontend (Vite) ---
FRONTEND_PORT=5173
VITE_API_BASE_URL=http://localhost:8000

# --- Anthropic / Agents ---
ANTHROPIC_API_KEY=sk-ant-replace-me
# [optional] Model tier used by agents. Controls sonnet vs opus routing in
#            model_for() (backend/agents/anthropic_client.py).
#            Allowed values: sonnet (default, cheaper) | opus (demo day).
# ARIA_MODEL=sonnet

# --- Managed Agents (Investigator — #103 / M5.5) ---
# Routes Investigator through Claude Managed Agents (hosted agent loop,
# hosted MCP, cloud container). Off by default — M4.5 Messages API is the
# safe fallback for demo day. Flip takes <5 min (env var + restart).
INVESTIGATOR_USE_MANAGED=false
# Path secret that gates the MCP endpoint when hosted-MCP is in use.
# Generated with `openssl rand -hex 32`. The URL itself IS the secret —
# Anthropic's mcp_servers config does not forward custom headers.
ARIA_MCP_PATH_SECRET=change-me-to-a-random-32-byte-hex-token
# Public URL Anthropic's session calls to invoke MCP tools. Must include
# the path secret above. Leave empty to disable hosted MCP (managed
# Investigator will still work but without direct Anthropic→MCP calls).
#   Example: https://<tunnel>.trycloudflare.com/mcp/<secret>/
# ARIA_MCP_PUBLIC_URL=https://<your-cloudflare-hostname>/mcp/<ARIA_MCP_PATH_SECRET>/

# --- Cloudflare Tunnel (optional, hosted-MCP stable URL) ---
# Persistent tunnel token from the Cloudflare Zero Trust dashboard.
# Leave empty to use the quick-tunnel workflow (cloudflared --url ...)
# which generates an ephemeral *.trycloudflare.com URL.
# CF_TUNNEL_TOKEN=

# --- Simulator ---
# realtime: 1 simulated second = 1 real second — cells idle near nominal,
#           drift is barely visible over a 30-min rehearsal window. Use
#           this in normal operation; the demo endpoints inject the spike
#           when the presenter triggers a scene.
# demo:     compress 72h scenario into ~4 minutes — Filler will breach
#           on its own; only useful for a long-running self-running demo.
SIMULATOR_MODE=realtime
SIMULATOR_SCENARIO=bottle_filler
SIMULATOR_TICK_INTERVAL_S=1.0