# Nexus Production Environment Configuration
# Copy this file to .env and fill in all values before deploying.

# ── PostgreSQL ──────────────────────────────────────────
POSTGRES_DB=nexus
POSTGRES_USER=nexus
POSTGRES_PASSWORD=***

# ── Connection String (inferred from above when using compose) ──
# ConnectionStrings__Nexus=Host=localhost;Database=${POSTGRES_DB};Username=${POSTGRES_USER};Password=${POSTGRES_PASSWORD}

# ── JWT ─────────────────────────────────────────────────
# Generate with: openssl rand -base64 48
JWT_KEY=***        # at least 32 bytes (base64-encoded)
JWT_ISSUER=nexus
JWT_AUDIENCE=nexus-web

# ── Bootstrap Owner (first seed only) ───────────────────
BOOTSTRAP_OWNER_EMAIL=***
BOOTSTRAP_OWNER_PASSWORD=*** # at least 10 characters; never written to logs

# ── Trusted reverse proxies ──────────────────────────────
# Keep empty unless the API is behind a known proxy. Use one exact proxy IP
# and/or a narrow CIDR for the private container network.
FORWARDED_HEADERS_KNOWN_PROXY=
FORWARDED_HEADERS_KNOWN_NETWORK=
FORWARDED_HEADERS_FORWARD_LIMIT=1

# ── OpenClaw Integration ────────────────────────────────
# Base URL of the OpenClaw gateway.
# Direct loopback can use a trusted backend shared secret. A remote or
# host.docker.internal topology also needs a paired backend device identity.
OPENCLAW_BASE_URL=http://host.docker.internal:18789
# Version pin is fail-fast and must match the deployed Gateway.
OPENCLAW_REQUIRED_VERSION=2026.7.1
OPENCLAW_GATEWAY_TOKEN=***
OPENCLAW_GATEWAY_PASSWORD=***
# Nexus will not impersonate OpenClaw's reserved gateway-client/backend identity.
# Keep false until the pinned OpenClaw build explicitly registers the external
# `nexus` client id. A patched or future supported build may set this to true.
OPENCLAW_EXTERNAL_CLIENT_ID_SUPPORTED=false
# Remote wss:// endpoints require a confirmed SHA-256 certificate fingerprint.
OPENCLAW_TLS_FINGERPRINT=
# The persisted primary profile is the only management gate. Enable it through
# the owner-only Attach & Adopt flow after read-only adoption and scope upgrade.
# High-risk unattended command/on-exit cron payloads remain disabled by default.
OPENCLAW_ALLOW_COMMAND_CRON=false