env.example

# OpenRouter API Configuration
# Two keys for spend isolation: internal (imas-codex workers) and
# claude-code (Claude Code clients). Create keys at:
# https://openrouter.ai/settings/keys
OPENROUTER_API_KEY_IMAS_CODEX=sk-or-v1-your_internal_key_here
OPENROUTER_API_KEY_CLAUDE_CODE=sk-or-v1-your_claude_code_key_here

# GHCR Authentication (required for pushing graph artifacts)
# Graph is public, so pulling doesn't require auth
# Create a PAT at https://github.com/settings/tokens with write:packages scope
GHCR_TOKEN=ghp_your_token_here

# Neo4j Configuration
# Generate a secure password: imas-codex graph secure
# The password must match between .env and the running Neo4j instance.
# After changing, restart Neo4j: imas-codex graph stop && imas-codex graph start
NEO4J_PASSWORD=

# Named graph profiles allow switching between instances at runtime.
# IMAS_CODEX_GRAPH_LOCATION selects which location's ports to use.
# Each location maps to convention-based ports (iter=7687, tcv=7688, etc.)
# Override: IMAS_CODEX_GRAPH_LOCATION=local
# IMAS_CODEX_GRAPH_LOCATION=iter

# Env var overrides (escape hatches, applied over any profile)
# NEO4J_URI=bolt://localhost:7687
# NEO4J_USERNAME=neo4j

# Tunnel port overrides (only needed for dual-instance case)
# When accessing a remote graph AND a local graph simultaneously,
# the tunnel must bind a different local port to avoid conflict.
# Format: IMAS_CODEX_TUNNEL_BOLT_{HOST}=PORT (host upper-cased, hyphens → _)
# Then set up tunnel: ssh -f -N -L {PORT}:localhost:{graph_bolt_port} {host}
# Example: Run local iter-dev on 7687 + tunneled iter on 17687:
# IMAS_CODEX_TUNNEL_BOLT_ITER=17687
# Then: ssh -f -N -L 17687:localhost:7687 iter

# Private config sync via GitHub Gist
# Set this to auto-sync private facility YAML files via commit hooks
# IMAS_PRIVATE_GIST_ID=your_gist_id_here

# LiteLLM Proxy (imas-codex llm start)
# Routes all LLM calls through a single proxy with cost tracking
LITELLM_MASTER_KEY=sk-litellm-<generate-with-secrets.token_hex(24)>
LITELLM_PROXY_URL=http://localhost:18400
# Virtual key for imas-codex workers (generate via: imas-codex llm keys create)
# LITELLM_API_KEY=sk-imas-codex-your_virtual_key_here
# PostgreSQL database for virtual keys and spend tracking
# Port 18450 follows the facility offset convention (18450 + offset)
LITELLM_DATABASE_URL=postgresql://user:password@localhost:18450/litellm

# Claude Code / External Client Configuration
# Set these in ~/.bashrc or ~/.claude/settings.json (not in .env)
# ANTHROPIC_BASE_URL=http://localhost:18400
# ANTHROPIC_AUTH_TOKEN=sk-external-your_virtual_key_here

# Langfuse Observability (optional, enables cost tracking dashboards)
# Sign up at https://cloud.langfuse.com (free tier: 50k observations/month)
# LANGFUSE_PUBLIC_KEY=pk-lf-xxx
# LANGFUSE_SECRET_KEY=sk-lf-xxx
# LANGFUSE_HOST=https://cloud.langfuse.com