anyplot/.env.example at main · MarkusNeusinger/anyplot · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
# anyplot Environment Variables
# Copy this file to .env and fill in your values

# ============================================================================
# Google Cloud Storage
# ============================================================================

# GCS bucket name for plot images
GCS_BUCKET=anyplot-images

# Path to service account JSON file (for local development)
# In production (Cloud Run), this is handled automatically via workload identity
GOOGLE_APPLICATION_CREDENTIALS=/path/to/service-account.json

# ============================================================================
# Database
# ============================================================================

# For local development (Cloud SQL public IP):
DATABASE_URL=postgresql+asyncpg://anyplot:PASSWORD@34.7.157.136:5432/anyplot

# For Cloud Run (uses Unix socket via Cloud SQL connector):
# DATABASE_URL=postgresql+asyncpg://anyplot:PASSWORD@/anyplot?host=/cloudsql/anyplot:europe-west4:anyplot-db

# For E2E tests (optional - defaults to 'test' database on same instance):
# TEST_DATABASE_URL=postgresql+asyncpg://anyplot:PASSWORD@34.7.157.136:5432/test

# ============================================================================
# API Configuration
# ============================================================================

# Environment (development, staging, production)
ENVIRONMENT=development

# API port (default: 8000)
PORT=8000

# ============================================================================
# Admin Auth (for /debug/* endpoints)
# ============================================================================

# GET /debug/status and GET /debug/ping can be authorized either by a valid
# Cloudflare Access JWT (production browser flow) or by ADMIN_TOKEN.
# Leave ADMIN_TOKEN unset if you only want Cloudflare Access auth.
# Set it for local development, CI, or as a break-glass fallback when
# Cloudflare Access is unavailable. Locally, any non-empty string works
# because these endpoints are only reachable on localhost.
# ADMIN_TOKEN=

# Cloudflare Access (Zero Trust) settings — only needed when verifying the
# Cf-Access-Jwt-Assertion header in production. Leave unset locally.
# CF_ACCESS_TEAM_DOMAIN=anyplot.cloudflareaccess.com
# CF_ACCESS_AUD=

# Comma-separated list of allowed Google account email addresses for the
# Cloudflare Access JWT path. Required for the JWT path to authorize anyone;
# requests with a valid JWT but an unlisted email return 403.
# ADMIN_ALLOWED_EMAILS=alice@example.com,bob@example.com

# ============================================================================
# AI Services (optional)
# ============================================================================

# Anthropic API key for Claude
# ANTHROPIC_API_KEY=sk-ant-...

# ============================================================================
# CLI Model Tier Configuration (optional)
# ============================================================================
# Override the default model for each tier per CLI tool.
# Tiers: small (fast/cheap), medium (balanced), large (complex)

# Claude Code models
# CLI_MODEL_CLAUDE_SMALL=haiku
# CLI_MODEL_CLAUDE_MEDIUM=sonnet
# CLI_MODEL_CLAUDE_LARGE=opus

# GitHub Copilot models
# CLI_MODEL_COPILOT_SMALL=gpt-4o-mini
# CLI_MODEL_COPILOT_MEDIUM=gpt-4o
# CLI_MODEL_COPILOT_LARGE=o1

# Gemini CLI models
# CLI_MODEL_GEMINI_SMALL=gemini-2.0-flash
# CLI_MODEL_GEMINI_MEDIUM=gemini-2.0-flash-thinking
# CLI_MODEL_GEMINI_LARGE=gemini-2.5-pro