.env.production.example

# .env.production.example - copy to .env.production or export these values in
# the deployment shell before running the production Compose overlay.
#
# DNS requirements:
# - ROOMOTE_APP_DOMAIN must have an A/AAAA record pointing at the host.
# - *.ROOMOTE_PREVIEW_DOMAIN must also point at the host so Caddy can route
#   task previews.
# - Ports 80 and 443 must be reachable from the public internet.

ROOMOTE_APP_DOMAIN=roomote.example.com
ROOMOTE_PREVIEW_DOMAIN=roomote.example.com
PREVIEW_PROXY_SUBDOMAIN_SUFFIX=preview
# Deploy Compose defaults R_APP_ENV to production. Set R_APP_ENV=preview in
# the separate develop soak env file.
# R_APP_ENV=production

# How long an API shutdown lets in-flight Fast turns finish before aborting
# the remainder so they resume on the next process. Keep it under the
# platform's SIGTERM-to-SIGKILL grace window; 0 aborts active turns
# immediately. The bullmq service, which runs the turns the queue resumes,
# uses the same window unless R_BULLMQ_SHUTDOWN_DRAIN_MS overrides it.
# R_API_SHUTDOWN_DRAIN_MS=20000
# R_BULLMQ_SHUTDOWN_DRAIN_MS=20000
# Set to true to keep inference retry backoff inside the process that owns
# the Fast turn instead of scheduling it durably (kill switch for durable
# retry scheduling).
# R_FAST_DURABLE_RETRY_DISABLED=true

# Replace local defaults before exposing a shared deployment.
DATABASE_URL=postgres://postgres:password@postgres:5432/roomote_development
REDIS_URL=redis://redis:6379
TRPC_URL=https://roomote.example.com/_roomote-api
S3_ENDPOINT=http://minio:9000
# Production Caddy routes /$S3_BUCKET_ARTIFACTS/* to MinIO, so hosted workers
# can upload artifacts through the public app origin without a separate object
# storage hostname.
S3_PRESIGN_ENDPOINT=https://roomote.example.com
S3_REGION=us-east-1
S3_ACCESS_KEY_ID=roomote
S3_SECRET_ACCESS_KEY=
S3_BUCKET_ARTIFACTS=roomote-artifacts
# Set to true to create the artifacts bucket at api boot when it is missing
# (MinIO does not auto-create buckets; compose installs also run minio-init).
# S3_AUTO_CREATE_BUCKET=true
# Base64-encoded P-256 PEM keypairs generated by the operator.
# Private keys use PKCS8; public keys use standard public-key PEM.
# Alternatively, leave all four unset and set R_AUTO_GENERATE_KEYS=true
# to have Roomote generate the keypairs at first startup and persist them
# encrypted (with ENCRYPTION_KEY) in the database. Useful on platforms that
# cannot run openssl during provisioning (Railway, Render, and similar).
JOB_AUTH_PRIVATE_KEY=
JOB_AUTH_PUBLIC_KEY=
PREVIEW_AUTH_PRIVATE_KEY=
PREVIEW_AUTH_PUBLIC_KEY=
# R_AUTO_GENERATE_KEYS=true
# Random single-line secrets generated by the operator.
ENCRYPTION_KEY=
# Only while rotating ENCRYPTION_KEY: the old key, so secrets stored before the
# rotation stay readable until `reencrypt-secrets` moves them to the new key.
# ENCRYPTION_KEY_PREVIOUS=
# Shared internal secret for Discord-gateway→API event delivery (API + BullMQ).
# Required when Discord is enabled. The installer and Railway/Render/Coolify
# templates generate it; UI Discord save also mints it when missing, and the
# runtime auto-heals when Discord is already configured without one.
# R_DISCORD_GATEWAY_SECRET=
ARTIFACT_SIGNING_KEY=
DASHBOARD_PASSWORD=
# Optional dedicated secret for signing sign-in session cookies (>=32 chars).
# Falls back to ENCRYPTION_KEY_PREVIOUS while set, then ENCRYPTION_KEY, when
# unset; setting it later logs users out.
# BETTER_AUTH_SECRET=
# One-time token required by the /setup bootstrap wizard until initial setup
# completes. Strongly recommended for any publicly reachable deployment; the
# one-command installer generates it automatically.
SETUP_TOKEN=

# Optional env-level model provider overrides. Use models.dev-style provider/model
# ids. Leave unset to manage task models through Roomote runtime settings.
# R_MODEL=openrouter/anthropic/claude-sonnet-4
# R_SMALL_MODEL=openrouter/openai/gpt-4.1-mini
# R_VISION_MODEL=openrouter/openai/gpt-5.6-sol
# R_CODE_REVIEW_MODEL=openrouter/openai/gpt-5.6-sol
# R_EXPLORE_MODEL=openrouter/openai/gpt-5.6-luna
# R_MODEL_ENV_KEYS=CUSTOM_PROVIDER_API_KEY
# CUSTOM_PROVIDER_API_KEY=
OPENROUTER_API_KEY=
# Optional capped key mapped to OPENROUTER_API_KEY only in environment workers.
SANDBOX_OPENROUTER_API_KEY=
# OPENAI_API_KEY=
# ANTHROPIC_API_KEY=
# GOOGLE_GENERATIVE_AI_API_KEY=
# GEMINI_API_KEY=
# MOONSHOT_API_KEY=
# KIMI_API_KEY=
# MINIMAX_API_KEY=
# ZAI_API_KEY=
# ZAI_REGION=global
# ZAI_CODING_PLAN_API_KEY=
# ZAI_CODING_PLAN_REGION=global
# OPENCODE_API_KEY=

# Compute provider. Use docker for a single-host deployment, or
# modal/e2b/daytona/blaxel/box/azure for a hosted worker runtime.
DEFAULT_COMPUTE_PROVIDER=docker
# Optional on published app images: when unset, the app derives the worker
# image as ghcr.io/roocodeinc/roomote-worker:<baked release version>.
# Override ROOMOTE_WORKER_IMAGE_REPO to derive from a fork or mirror repo.
# DOCKER_WORKER_IMAGE=roomote-worker:local
# ROOMOTE_WORKER_IMAGE_REPO=ghcr.io/roocodeinc/roomote-worker
# Optional Memory image override. When unset, the brain profile uses
# ${IMAGE_REGISTRY}/${IMAGE_NAMESPACE}/roomote-gbrain:${ROOMOTE_VERSION}.
# GBRAIN_IMAGE=ghcr.io/roocodeinc/roomote-gbrain:v0.1.0
# DOCKER_WORKER_PLATFORM=linux/amd64
# DOCKER_WORKER_NETWORK=roomote_worker
# DOCKER_WORKER_RELEASE_PATH=/roomote/releases/worker-current.tar.gz
# DOCKER_WORKER_CPU_LIMIT=2
# DOCKER_WORKER_MEMORY_LIMIT=4g
# DOCKER_TASK_DAEMON_MEMORY_LIMIT=8g
# DOCKER_WORKER_PIDS_LIMIT=512
# DOCKER_WORKER_DISK_LIMIT=20g
# DOCKER_WORKER_ALLOW_UNBOUNDED_DISK=false
# DOCKER_WORKER_LOG_MAX_SIZE=10m
# DOCKER_WORKER_LOG_MAX_FILES=3
# DOCKER_WORKER_EGRESS_POLICY=internet
# DOCKER_STANDBY_MAX_COUNT=10
# DOCKER_STANDBY_MAX_AGE_HOURS=24
# MODAL_TOKEN_ID=
# MODAL_TOKEN_SECRET=
# Leave blank: the installer and deployer keep it in sync with the matching
# DOCKER_WORKER_IMAGE, and on published app images the app derives it from
# the effective worker image at runtime, so Modal only needs the token pair.
# Set a value only to pin a custom base image; it is then never overwritten.
# MODAL_BASE_IMAGE_REF=
# MODAL_ENDPOINT=
# MODAL_ENVIRONMENT=
# MODAL_APP_NAME=
# MODAL_REGISTRY_USERNAME=
# MODAL_REGISTRY_PASSWORD=
# MODAL_ECR_OIDC_ROLE_ARN=
# MODAL_ECR_REGION=
# DAYTONA_API_KEY=
# DAYTONA_API_URL=
# DAYTONA_TARGET=
# Name of the Daytona snapshot registered from the public Roomote worker image.
# DAYTONA_SNAPSHOT_NAME=
# Box sandbox provider. Only BOX_API_KEY is required; setup does not
# build a Box worker artifact. Box does not support environment snapshots.
# BOX_API_KEY=
# BOX_API_BASE_URL=
# BOX_MACHINE_TYPE=default
# BOX_TIMEOUT_MS=
# BOX_STANDBY_MAX_COUNT=
# BOX_STANDBY_MAX_AGE_HOURS=

# Sign-in providers.
# R_ALLOWED_EMAILS=
# Optional paid-seat license key (RMLK1.…). Takes precedence over Settings → Users.
# R_LICENSE_KEY=
# R_SLACK_CLIENT_ID=
# R_SLACK_CLIENT_SECRET=

# Required GitHub App.
# R_GITHUB_APP_SLUG=
# Optional comma-separated GitHub App slugs that are also trusted as Roomote-managed.
# R_GITHUB_ADDITIONAL_APP_SLUGS=
# Self-run Brain embeddings (embeddings stay on your hardware; chat
# synthesis keeps using the configured provider). With the bundled service,
# set COMPOSE_PROFILES=brain,local-inference and ALL of the settings below —
# the model name and dimensions must match what the inference server
# serves, and the embedding pair is create-time: set everything BEFORE the
# Brain's first boot. gbrain's defaults (text-embedding-3-small, 1536) name
# models the bundled server does not serve, so the URL alone is not a
# working configuration. Self-run model names pass through unchanged and
# must exactly match the ids served by the upstream.
# R_BRAIN_EMBEDDINGS_UPSTREAM_URL=http://infinity:7997
# R_BRAIN_INFERENCE_UPSTREAM_API_KEY=
# R_BRAIN_EMBEDDING_MODEL=BAAI/bge-m3
# R_BRAIN_EMBEDDING_DIMENSIONS=1024
# Self-run judgment model for routing and triage decisions. Any server that
# answers the typed decisions request at /v1/decisions works; the bundled one
# is COMPOSE_PROFILES=judgment with R_JUDGMENT_UPSTREAM_URL=http://judgment:8080
# and R_JUDGMENT_MODEL=roomote (a CPU model, about 1.5 GB; JUDGMENT_CPUS and JUDGMENT_MEMORY_LIMIT size it,
# JUDGMENT_IMAGE and JUDGMENT_MODEL override the image and the checkpoint).
# Configure it as the selected route with R_JUDGMENT_MODEL=roomote; decision
# text is processed on your hardware. To compare Jev with this upstream, select Jev and set
# R_JUDGMENT_SHADOW=on. The key is optional for a private-network upstream.
# R_JUDGMENT_UPSTREAM_URL=
# R_JUDGMENT_UPSTREAM_API_KEY=
# Shadow scoring compares each Jev judgment with the upstream and logs
# per-question agreement for calibration.
# R_JUDGMENT_SHADOW=off
# `on` writes every answered decision (scrubbed) to the artifact bucket under
# judgment-capture/, to build a training set from. Keeps decision text.
# R_JUDGMENT_CAPTURE=off
# Choose a judgment route: `roomote` (the upstream above), `typesafe`,
# `openrouter`, `vercel`, or `off`. A TypeSafe key selects Jev via TypeSafe
# when Settings has no saved route. This environment value takes precedence
# over the Settings choice when set.
# R_JUDGMENT_MODEL=
# R_GITHUB_APP_ID=
# Raw GitHub App private-key PEM with newlines escaped as \n; do not base64 it.
# R_GITHUB_APP_PRIVATE_KEY=
# R_GITHUB_CLIENT_ID=
# R_GITHUB_CLIENT_SECRET=
# R_GITHUB_WEBHOOK_SECRET=
# GITLAB_CLIENT_ID=
# GITLAB_CLIENT_SECRET=
# GITLAB_WEBHOOK_SECRET=
# GITLAB_WEBHOOK_SIGNING_TOKEN=

# Optional integrations.
# Set to true to prevent curated integrations from being configured or used.
# Existing connections remain stored and become available again once unset.
# R_CURATED_INTEGRATIONS_DISABLED=true
# SLACK_APP_ID=
# R_SLACK_SIGNING_SECRET=
# R_TELEGRAM_BOT_TOKEN=
# R_TELEGRAM_WEBHOOK_SECRET=
# R_LINEAR_CLIENT_ID=
# R_LINEAR_CLIENT_SECRET=
# R_LINEAR_WEBHOOK_SECRET=

# Optional private-network completion webhook receiver ranges (comma-separated
# CIDRs). Unset keeps delivery public-only. Set only the receiver's range.
# R_SESSION_DONE_WEBHOOK_ALLOWED_PRIVATE_CIDRS=127.0.0.1/32