.env.example

# Netclode Environment Variables
# Copy to .env and fill in values

# LLM provider (at least one required - see docs/sdk-support.md)
ANTHROPIC_API_KEY=sk-ant-...

# Tailscale OAuth for Kubernetes operator (required)
# Create at: https://login.tailscale.com/admin/settings/oauth
# Required scopes: Devices (write), Auth Keys (write)
TS_OAUTH_CLIENT_ID=
TS_OAUTH_CLIENT_SECRET=

# Tailscale auth key for host SSH access (optional)
# Get from: https://login.tailscale.com/admin/settings/keys
# If not set, authenticate manually on the host: tailscale up --ssh
TAILSCALE_AUTHKEY=

# JuiceFS S3 backend (DigitalOcean Spaces)
DO_SPACES_ACCESS_KEY=
DO_SPACES_SECRET_KEY=
JUICEFS_BUCKET=https://nyc3.digitaloceanspaces.com/your-bucket
JUICEFS_META_URL=redis://localhost:6379/0

# Deployment target (Tailscale hostname or IP)
DEPLOY_HOST=your-server

# OpenCode API Key (optional, for opencode.ai / openrouter.ai)
# OPENCODE_API_KEY=

# GitHub Copilot Token (optional, required for SDK_TYPE_COPILOT)
# Create a fine-grained PAT at: https://github.com/settings/tokens?type=beta
# Required permissions: Account permissions > Copilot > Read-only
GITHUB_COPILOT_TOKEN=

# GitHub App for repository access (optional)
# Create a GitHub App at: https://github.com/settings/apps/new
# Required permissions: Contents (read & write), Metadata (read)
# Install the app on your account/org, then note the Installation ID
GITHUB_APP_ID=
GITHUB_APP_PRIVATE_KEY_B64=  # Base64-encoded private key (cat key.pem | base64)
GITHUB_INSTALLATION_ID=

# GitHub Webhook Secret for github-bot (optional)
# Generate with: openssl rand -hex 32
# Must match the webhook secret configured in the GitHub App settings
GITHUB_WEBHOOK_SECRET=

# Session limits (optional)
# MAX_ACTIVE_SESSIONS=5
# IDLE_TIMEOUT_MINUTES=30

# Kata VM Resources (optional, defaults shown)
KATA_VM_CPUS=4
KATA_VM_MEMORY_MB=4096

# NVIDIA GPU Support (optional)
# Set to true to install NVIDIA drivers and container toolkit on the host
NVIDIA_ENABLED=false

# MOK Password for Secure Boot (required if NVIDIA_ENABLED=true and Secure Boot is on)
# This password is entered at the blue MOK Management screen during reboot
# to enroll the DKMS signing key. Choose something simple - it's only used once.
MOK_PASSWORD=

# Ollama Local Inference (optional)
# Set to true to deploy Ollama with GPU support for local model inference
# Requires NVIDIA_ENABLED=true for GPU acceleration
OLLAMA_ENABLED=false

# Ollama URL for control-plane to pass to agents (set automatically when OLLAMA_ENABLED=true)
# OLLAMA_URL=http://ollama.netclode.svc.cluster.local:11434

# Datadog Observability (optional)
# Sign up at https://www.datadoghq.com/ and get API/APP keys from
# https://app.datadoghq.com/organization-settings/api-keys
DD_API_KEY=
DD_APP_KEY=
DD_SITE=datadoghq.com