# Langfuse v3 — copy to `.env` on the server and fill REAL secrets, then
# `docker compose up -d`. NEVER commit the real `.env`.
#
# Generate secrets (use hex to stay safe inside DATABASE_URL + .env parsing):
#   openssl rand -hex 32   → ENCRYPTION_KEY (must be exactly 64 hex chars)
#   openssl rand -hex 32   → NEXTAUTH_SECRET, SALT
#   openssl rand -hex 16   → the passwords
#   uuidgen                → the pk-lf-/sk-lf- INIT keys

# --- Core ---
# Host port for the web UI. 3000 is taken by gitea on ana-docker → use 3001.
# NEXTAUTH_URL must match the URL you browse to (host:LANGFUSE_PORT).
LANGFUSE_PORT=3001
NEXTAUTH_URL=http://10.250.50.70:3001
NEXTAUTH_SECRET=CHANGEME           # openssl rand -hex 32
SALT=CHANGEME                      # openssl rand -hex 32
ENCRYPTION_KEY=CHANGEME            # openssl rand -hex 32  (exactly 64 hex chars)

# --- Postgres (password must match in DATABASE_URL) ---
POSTGRES_PASSWORD=CHANGEME
DATABASE_URL=postgresql://postgres:CHANGEME@postgres:5432/postgres

# --- ClickHouse / Redis ---
CLICKHOUSE_PASSWORD=CHANGEME
REDIS_AUTH=CHANGEME

# --- MinIO (S3 backend). The 3 S3 secret keys MUST equal MINIO_ROOT_PASSWORD;
#     access-key-ids stay the compose default "minio" (= MINIO_ROOT_USER). ---
MINIO_ROOT_PASSWORD=CHANGEME
LANGFUSE_S3_EVENT_UPLOAD_SECRET_ACCESS_KEY=CHANGEME
LANGFUSE_S3_MEDIA_UPLOAD_SECRET_ACCESS_KEY=CHANGEME
LANGFUSE_S3_BATCH_EXPORT_SECRET_ACCESS_KEY=CHANGEME

# --- Auto-provision org/project/user + API keys on first boot ---
# The PUBLIC/SECRET keys become LiteLLM's LANGFUSE_PUBLIC_KEY / LANGFUSE_SECRET_KEY.
LANGFUSE_INIT_ORG_ID=pfi
LANGFUSE_INIT_ORG_NAME=PFI
LANGFUSE_INIT_PROJECT_ID=gateway
LANGFUSE_INIT_PROJECT_NAME=LiteLLM Gateway
LANGFUSE_INIT_PROJECT_PUBLIC_KEY=pk-lf-CHANGEME
LANGFUSE_INIT_PROJECT_SECRET_KEY=sk-lf-CHANGEME
LANGFUSE_INIT_USER_EMAIL=lkraven@lkraven.com
LANGFUSE_INIT_USER_NAME=lkraven
LANGFUSE_INIT_USER_PASSWORD=CHANGEME   # initial UI login password