# MQTT broker (usually the mosquitto container on this host)
MQTT_BROKER=mosquitto
MQTT_PORT=1883
# Use the c2-core credential — must match MQTT_C2_USER/MQTT_C2_PASS in the
# top-level .env
MQTT_USER=drb-c2-core
MQTT_PASS=change-me-c2

# Same value as the top-level .env's MOSQUITTO_DYNSEC_PASSWORD — lets
# c2-core log in as mosquitto's built-in dynsec "admin" client to
# administer node MQTT credentials. See app/internal/dynsec.py.
MQTT_DYNSEC_ADMIN_PASS=change-me-dynsec-admin-min-12-chars

# GCP — path to service account JSON inside the container
GCP_CREDENTIALS_PATH=/app/gcp-key.json

# Firestore database name (use "(default)" if you didn't create a named database)
FIRESTORE_DATABASE=c2-server

# GCS bucket for audio storage
GCS_BUCKET=your-bucket-name

# How long (seconds) before a node is marked offline if no checkin received
NODE_OFFLINE_THRESHOLD=90

# Google Maps — for geocoding location strings extracted from transcripts
# Enable "Geocoding API" in Cloud Console for this key
GOOGLE_MAPS_API_KEY=
NY511_API_KEY=
# 511NY feed base URL from the DAA grant (default: legacy 511ny.org/api, dead since the 511x cutover)
NY511_API_BASE=
# Ontario 511 developer key (camera provider "ontario511"; providers default OFF)
ONTARIO511_API_KEY=
# NWS weather alerts / METAR wind (server-26#237). NWS requires app name + contact in the User-Agent
NWS_USER_AGENT=DRB (you@example.com)
# Comma list of NWS state/marine area codes served
NWS_AREA=NY

# OpenAI — transcription (whisper-1, and the STT fallback), extraction, embeddings
OPENAI_API_KEY=
# Since 2026-11-08 OpenAI also serves the correlation decision and transcript
# correction (CORR_CHEAP_MODEL / TRANSCRIPT_CORRECTION_MODEL, default gpt-4o-mini).
# GEMINI_API_KEY is only needed if you point either of those at a gemini-* model.
# OpenAI transcription model: whisper-1 | gpt-4o-mini-transcribe | gpt-4o-transcribe
STT_MODEL=whisper-1

# STT provider (server-26#297). Any OpenAI-compatible /audio/transcriptions API.
# auto (default): groq if GROQ_API_KEY is set, compat if STT_BASE_URL is set,
# otherwise openai — so leaving these blank keeps today's OpenAI behaviour.
STT_PROVIDER=auto
# Groq: whisper-large-v3-turbo, $0.04/audio-hour (min 10s billed per request).
GROQ_API_KEY=
# Model on the non-OpenAI provider.
STT_COMPAT_MODEL=whisper-large-v3-turbo
# Override the endpoint/key (blank = provider default: https://api.groq.com/openai/v1
# and GROQ_API_KEY). Set both for a self-hosted OpenAI-compatible server.
STT_BASE_URL=
STT_API_KEY=
# Retry on OpenAI STT_MODEL when the provider above fails (needs OPENAI_API_KEY).
STT_FALLBACK_TO_OPENAI=true
# Area places / local names / vocabulary in the STT prompt (non-OpenAI provider only).
STT_VOCAB_PROMPT_ENABLED=true
# Estimated prompt token budget (Whisper keeps only the last 224).
STT_PROMPT_MAX_TOKENS=200

# Scene extraction / embeddings models (server-26#298)
EXTRACTION_MODEL=gpt-4o-mini
EMBEDDING_MODEL=text-embedding-3-small
# Skip correction + extraction for radio housekeeping (roll call, bare 10-4s).
# Default false = shadow mode (verdict recorded, nothing skipped). Turn on only
# after a shadow window shows no real events flagged (server-26#127).
CHATTER_GATE_ENABLED=false
# In-process geocode cache (Maps terms allow caching lat/lng <= 30 days)
GEOCODE_CACHE_TTL_SECONDS=86400
GEOCODE_CACHE_NEGATIVE_TTL_SECONDS=3600
GEOCODE_CACHE_MAX_ENTRIES=5000

# Push-alert confidence gate (server-26#300). Below the floor -> held (admin-only
# GET /alerts/held). High-severity matches also need N calls on the incident or
# the high confidence bar.
ALERT_MIN_CONFIDENCE=0.5
ALERT_HIGH_SEVERITY_MIN_CONFIDENCE=0.85
ALERT_CORROBORATION_MIN_CALLS=2
ALERT_STT_REFERENCE=0.3
SUMMARY_INTERVAL_MINUTES=15
CORRELATION_WINDOW_HOURS=4
EMBEDDING_SIMILARITY_THRESHOLD=0.82

# Browser origins allowed to call this API cross-origin (JSON list). The only
# browser caller is the frontend's Archive page (GET /calls/search). Set this
# to the exact origin the frontend is served from — scheme + host, no path.
# Defaults to https://drb.cusano.net. A "*" entry works for local dev but is
# logged as a probable misconfiguration and never gets a credentialed response.
CORS_ORIGINS=["https://drb.cusano.net"]

# Fleet-wide token edge nodes present as X-Enrollment-Token on first boot
# (POST /nodes/enroll). Shared across every node — NOT a per-node secret.
# Generate with: openssl rand -hex 32
ENROLLMENT_TOKEN=

# Shared key the Discord bot presents to reach C2 without Firebase.
# Generate with: openssl rand -hex 32
SERVICE_KEY=

# Agent/automation key for the unattended work session's headless routes
# (GET/PUT /admin/features). DELIBERATELY a different value from SERVICE_KEY —
# reusing the bot's key would make both principals indistinguishable in
# audit_log, which is the whole point of server-26#64. Leave blank to keep the
# agent path closed; the routes still take a Firebase admin token either way.
# Generate with: openssl rand -hex 32
AGENT_SERVICE_KEY=