DATABASE_URL=postgresql://user:password@host/gluecron
GIT_REPOS_PATH=./repos
PORT=3000

# ─── SSH git server (Block SSH-1) ─────────────────────────────────────────
# Port for the SSH git daemon. 2222 by default (use 22 in production
# if you expose it directly, or put it behind an SSH proxy).
# Set SSH_PORT=0 to disable the SSH server entirely.
SSH_PORT=2222
# PEM-encoded Ed25519 (or RSA) private key for the SSH host.
# If unset, an ephemeral key is generated on startup — fine for dev but
# clients will see "host key changed" warnings on restart.
# Generate with: ssh-keygen -t ed25519 -f /etc/gluecron/ssh_host_key -N ''
# Then paste the contents here (or use \\n for newlines in single-line form).
SSH_HOST_KEY=
# ──────────────────────────────────────────────────────────────────────────
GATETEST_URL=https://gatetest.ai/api/events/push
GATETEST_API_KEY=
# Inbound GateTest callback auth — set one so GateTest can POST results back.
# See GATETEST_HOOK.md for payload + endpoint details.
# Generate a secret with: openssl rand -hex 32
GATETEST_CALLBACK_SECRET=
GATETEST_HMAC_SECRET=
# ─── For the GateTest side, NOT Gluecron ─────────────────────────────────
# When you point GateTest at gluecron.com to scan the live site, GateTest
# needs the two values below in ITS environment (set them in the gatetest.ai
# scanner config, not here). Issue the token from /admin/ops → "GateTest
# scanner credentials" while signed in as site admin.
#   GLUECRON_BASE_URL=https://gluecron.com
#   GLUECRON_API_TOKEN=<paste from /admin/ops, shown once>
# ─────────────────────────────────────────────────────────────────────────
# Vapron (formerly Crontech) deploy integration. Legacy CRONTECH_* names
# are still honored as fallbacks for already-configured deployments.
VAPRON_DEPLOY_URL=https://vapron.ai/api/webhooks/gluecron-push
# BLK-016 — only fire the Vapron deploy webhook for pushes to this
# `<owner>/<name>` (default `ccantynz-alt/vapron`). All other repo pushes
# are ignored.
VAPRON_REPO=ccantynz-alt/vapron
# Shared HMAC secret used to sign the outbound Vapron deploy webhook.
# Sent as `X-Gluecron-Signature: sha256=<hex>` of the JSON body. Must match
# the secret configured on the Vapron deploy-agent. Unset → header omitted
# and Vapron rejects with 401. (Legacy fallbacks: CRONTECH_HMAC_SECRET,
# GLUECRON_WEBHOOK_SECRET.) Prefer setting this on /admin/integrations.
VAPRON_HMAC_SECRET=
# Inbound bearer token Vapron MUST present on deploy.succeeded /
# deploy.failed callbacks to POST /api/events/deploy (Signal Bus P1 — E3/E4).
# Generate with: openssl rand -hex 32. Unset → endpoint refuses every call.
# (Legacy fallback: CRONTECH_EVENT_TOKEN.)
VAPRON_EVENT_TOKEN=
ANTHROPIC_API_KEY=
# Email (Block A8). Provider=log just writes to stderr (safe default).
# Switch to "resend" in prod and set RESEND_API_KEY.
EMAIL_PROVIDER=log
EMAIL_FROM=gluecron <no-reply@gluecron.local>
RESEND_API_KEY=
# Used to build absolute URLs in outbound emails + webhooks.
APP_BASE_URL=http://localhost:3000
# Cross-product platform-status endpoints (Vapron / Gluecron / GateTest).
# Used by the /admin/platform widget. Defaults point at production hosts.
VAPRON_STATUS_URL=https://vapron.ai/api/platform-status
GLUECRON_STATUS_URL=https://gluecron.com/api/platform-status
GATETEST_STATUS_URL=https://gatetest.io/api/platform-status
# Error tracking (optional). If unset, errors are logged to stderr only.
# ERROR_WEBHOOK_URL — POST JSON {timestamp,message,stack,context,env} on unhandled errors.
ERROR_WEBHOOK_URL=
# SENTRY_DSN — if set, errors POST to the Sentry envelope endpoint directly (no SDK).
SENTRY_DSN=
# CLI: gluecron server host for remote commands (default: localhost).
GLUECRON_HOST=localhost
# Preflight script: port the running server listens on (default matches PORT).
PREFLIGHT_PORT=3000
# Preflight script: set to 1 to run the backup drill check.
PREFLIGHT_BACKUP_DRILL=
# Set to 1 to enable verbose AI review debug output.
DEBUG_AI_REVIEW=
# Autopilot: poll interval in milliseconds (default: 60000).
AUTOPILOT_INTERVAL_MS=60000
# Set to 1 to disable the autopilot background task entirely.
AUTOPILOT_DISABLED=
# WebAuthn / Passkey relying-party settings.
WEBAUTHN_RP_ID=localhost
WEBAUTHN_ORIGIN=http://localhost:3000
WEBAUTHN_RP_NAME=gluecron
# Set to 1 to enable verbose PR triage debug output.
DEBUG_PR_TRIAGE=
# Voyage AI API key for semantic (vector) code search.
VOYAGE_API_KEY=
# AES-256-GCM key (hex, 64 chars) for encrypting workflow secrets at rest.
WORKFLOW_SECRETS_KEY=
# AES-256-GCM key (hex, 64 chars) for encrypting server-target SSH private
# keys and per-target env vars at rest (Block ST — /admin/servers).
# Generate with: openssl rand -hex 32. If unset, all server-target
# operations refuse cleanly (no panics, no plaintext fallbacks).
SERVER_TARGETS_KEY=
# Block CW — Claude on the web (/:owner/:repo/claude).
# Per-session working directories live under this dir on the web server.
# Default: /var/lib/gluecron/claude-web. Should be on a disk with room
# for full repo clones and writable by the gluecron service user.
CLAUDE_WEB_WORKDIR=
# Path to the Claude Code CLI binary. Default: `claude` (i.e. on PATH).
# Override if `claude` is installed somewhere non-standard on the box.
CLAUDE_BIN=
# Set to "production" or "test" to override NODE_ENV for Bun.
BUN_ENV=
# Injected at build time; the deployed git commit SHA for the platform-status endpoint.
APP_VERSION=
# Injected at build time; the deployed git commit SHA shown on the status page.
GIT_COMMIT=

# ── Documented 2026-06-10 (audit pass) — vars used in src/lib/config.ts ──
# Opt-in: AI scans push diffs and opens issues for problems it finds.
AI_AUTO_ISSUES=
# Opt-in: dependency scanner runs on push (advisory cross-reference).
DEPENDENCY_SCAN_ENABLED=
# Directory for the OCI container-registry blob store. Default: ./oci-store
OCI_STORE_PATH=
# Wildcard domain for PR preview deployments (e.g. previews.example.com).
# Empty disables branch previews.
PREVIEW_DOMAIN=
# Redis/Valkey connection for cross-node SSE fan-out. Empty = in-process
# broadcaster (single-node only). Either name is accepted.
REDIS_URL=
VALKEY_URL=

# ── "Sign in with Google" bootstrap (2026-06-12) ─────────────────────────
# Setting this pair enables the Google sign-in button without touching the
# /admin/google-oauth page (a DB config saved there takes precedence).
# Create a Web OAuth client at console.cloud.google.com/apis/credentials.
# The callback auto-resolves from the request (honours X-Forwarded-Proto),
# so register https://<your-public-host>/login/google/callback in the
# Console — no APP_BASE_URL required for Google sign-in to work.
GOOGLE_OAUTH_CLIENT_ID=
GOOGLE_OAUTH_CLIENT_SECRET=
# Optional: set to 0 to refuse auto-creating accounts on first Google login.
GOOGLE_OAUTH_AUTO_CREATE=
# Optional: comma-separated email domains allowed to sign in with Google.
GOOGLE_OAUTH_ALLOWED_DOMAINS=

# ── 2026-06-12 build block (flywheel + SSRF + model routing) ──────────────
# Kill-switch: set to 1 to force every AI task onto Sonnet, ignoring the
# Haiku allowlist in src/lib/ai-client.ts modelForTask(). Read per-call.
AI_FORCE_SONNET=
# Escape hatch for self-hosted/dev setups whose webhooks or mirrors
# legitimately target private addresses. Default: private IPs blocked.
SSRF_ALLOW_PRIVATE=