.env.example

# Tinybird
TINYBIRD_HOST=http://localhost:7181
TINYBIRD_TOKEN=your-tinybird-token

# Database (optional)
MAPLE_DB_URL=
MAPLE_DB_AUTH_TOKEN=

# Base64-encoded 32-byte key (AES-256-GCM) used to encrypt private ingest keys at rest
MAPLE_INGEST_KEY_ENCRYPTION_KEY=
# HMAC key used to derive non-reversible ingest key lookup hashes
MAPLE_INGEST_KEY_LOOKUP_HMAC_KEY=

# Auth mode: clerk | self_hosted
MAPLE_AUTH_MODE=self_hosted
MAPLE_ROOT_PASSWORD=change-me

# Required when MAPLE_AUTH_MODE=clerk
# CLERK_SECRET_KEY=sk_test_xxx
# CLERK_PUBLISHABLE_KEY=pk_test_xxx
# Optional: networkless JWT verification
# CLERK_JWT_KEY=-----BEGIN PUBLIC KEY-----...

# Required when MAPLE_AUTH_MODE=self_hosted
MAPLE_DEFAULT_ORG_ID=default

# Web app overrides (auto-derived from above if not set)
# When running `bun dev:portless`, VITE_API_BASE_URL / VITE_INGEST_URL /
# VITE_CHAT_AGENT_URL are auto-set to https://<worktree>-<app>.localhost so
# multiple worktrees can run side by side. Values set here still win.
VITE_API_BASE_URL=http://localhost:3472
VITE_MAPLE_AUTH_MODE=self_hosted
VITE_CLERK_SIGN_IN_URL=/sign-in
VITE_CLERK_SIGN_UP_URL=/sign-up

# Landing app (Astro)
# PUBLIC_CLERK_PUBLISHABLE_KEY=pk_test_xxx

# Ingest service
INGEST_PORT=3474
INGEST_FORWARD_OTLP_ENDPOINT=http://127.0.0.1:4318
INGEST_FORWARD_TIMEOUT_MS=10000
INGEST_MAX_REQUEST_BODY_BYTES=20971520
INGEST_REQUIRE_TLS=false

# Billing (Autumn)
# AUTUMN_SECRET_KEY=am_sk_test_xxx

# OpenTelemetry (API self-observability)
# OTEL_ENVIRONMENT=local                    # "local" = Effect DevTools, other = OTLP export
# OTEL_BASE_URL=http://127.0.0.1:3474      # Ingest gateway endpoint (enriches with org_id)
# MAPLE_OTEL_INGEST_KEY=                    # Ingest key (maple_pk_* or maple_sk_*) for self-observability
# COMMIT_SHA=                               # Git commit SHA for service version