.env.example

# Copy this file to .env for local development. Do not commit .env or any real secret.
# See docs/project-helpers/service-accounts.md for what each variable is, where to get it,
# and which requirement/ADR depends on it.

# --- Backend core ---
FLASK_ENV=development
FLASK_DEBUG=1
SECRET_KEY=replace-with-a-local-development-secret
# Ports 5433/6380, not the defaults: docker-compose.yml deliberately avoids 5432/6379 so Trueup
# cannot collide with another project's database running on the same machine.
REDIS_URL=redis://localhost:6380/0

# --- Database: three roles, three credentials (S0 §7.3) ---
# The web API's credential must NEVER be granted BYPASSRLS — tenant isolation is a credential
# boundary, not application discipline. Jobs and the outbox worker use their own bypass credential.
# These passwords are local docker-compose values only; deployed environments source them from
# Azure Key Vault.
DATABASE_URL=postgresql+psycopg://trueup_app:trueup_app@localhost:5433/trueup
DATABASE_URL_WORKER=postgresql+psycopg://trueup_worker:trueup_worker@localhost:5433/trueup
DATABASE_URL_OWNER=postgresql+psycopg://trueup_owner:trueup_owner@localhost:5433/trueup
# S11's chat assistant tool call (ADR 19) -- a fourth, narrower role granted SELECT on the
# curated chat views only. Required, no default: a missing value must fail startup, never
# silently fall back to a broader-privileged connection for the LLM's tool calls.
DATABASE_URL_CHAT=postgresql+psycopg://trueup_chat_readonly:trueup_chat_readonly@localhost:5433/trueup

# --- Alpaca: broker, market data, trading calendar (ADR 12, ADR 21) ---
ALPACA_API_KEY_ID=
ALPACA_API_SECRET_KEY=
ALPACA_BASE_URL=https://paper-api.alpaca.markets

# --- Plaid: bank linking, ACH, bounce/re-auth webhooks (S2) ---
PLAID_CLIENT_ID=
PLAID_SECRET=
PLAID_ENV=sandbox
PLAID_WEBHOOK_URL=

# --- Stripe: KYC identity + fee billing (ADR 9, ADR 10) ---
STRIPE_PUBLISHABLE_KEY=
STRIPE_SECRET_KEY=
STRIPE_WEBHOOK_SECRET_IDENTITY=
STRIPE_WEBHOOK_SECRET_BILLING=

# --- OpenAI: natural-language query assistant (ADR 18) ---
OPENAI_API_KEY=
OPENAI_ORG_ID=

# --- Optional market-data fallback (S0 §3, "if used") ---
POLYGON_API_KEY=
TWELVEDATA_API_KEY=

# --- Performance fee rate (S10 — required, no in-code default; a business decision) ---
# Set to 0.0 for now (DECISION-LOG.md, 2026-09-05): a real, explicit rate that happens to be zero,
# pending business/compliance sign-off on the actual value.
FEE_RATE_PCT=0.0
DUNNING_MAX_ATTEMPTS=4
DUNNING_BACKOFF_BASE_HOURS=24

# --- Azure (deployed environments only; sourced from Key Vault, not this file, in production) ---
AZURE_TENANT_ID=
AZURE_SUBSCRIPTION_ID=
AZURE_CLIENT_ID=
AZURE_CLIENT_SECRET=
AZURE_KEY_VAULT_URL=
APPLICATIONINSIGHTS_CONNECTION_STRING=

# --- Field-level encryption at rest (ADR 23) ---
# Envelope encryption: this RSA key stays in Key Vault and wraps each record's data key.
# Used for bank_link.plaid_access_token (S2 §3.3) and adviser TOTP secrets.
AZURE_KEYVAULT_WRAP_KEY_NAME=
# Local development and CI only. Ignored whenever AZURE_KEYVAULT_WRAP_KEY_NAME is set.
# Generate with: python -c "import os,base64; print(base64.b64encode(os.urandom(32)).decode())"
LOCAL_CIPHER_KEY=

# --- Frontend ---
# Used by the frontend API client when backend integration is added.
VITE_API_BASE_URL=http://localhost:5000