# ============================================
# Hetzner Self-Hosted Stack — Environment Variables
# Copy to .env and fill in your values:
#   cp .env.example .env
# ============================================

# --- LLM Gateway ---
# Session secret (required for persistent sessions)
SESSION_SECRET=change-me-to-a-random-string
# Default admin (created on first run if no users exist)
ADMIN_USERNAME=admin
ADMIN_PASSWORD=change-me-min-8-chars
# Static API tokens (seeded on startup, leave empty to skip)
OPENWEBUI_API_KEY=sk-...
OPENCODE_API_KEY=sk-...
# Provider API keys
OPENROUTER_API_KEY=sk-or-...
SILICONFLOW_API_KEY=sk-...
DEEPINFRA_API_KEY=...
GROQ_API_KEY=gsk_...
CEREBRAS_API_KEY=...
PERPLEXITY_API_KEY=pplx-...
# Ollama Cloud API key (https://ollama.com → Settings → Keys)
OLLAMA_CLOUD_API_KEY=...

# --- Grafana ---
GRAFANA_ADMIN_PASSWORD=change-me-to-a-secure-password

# --- Cloudflare Tunnel ---
# Create a tunnel in Cloudflare Zero Trust dashboard → Networks → Tunnels
# Copy the token from the tunnel install command
CLOUDFLARE_TUNNEL_TOKEN=eyJ...

# --- Tailscale ---
# Generate at https://login.tailscale.com/admin/settings/keys
# Use a reusable + ephemeral key for unattended servers
TS_AUTHKEY=tskey-auth-...

# --- SearXNG ---
# Random secret key for SearXNG (generate with: openssl rand -hex 32)
SEARXNG_SECRET_KEY=change-me-to-a-random-hex-string