.env.example

# Deployment mode:
# - self_hosted: local PostgreSQL + local filesystem attachment storage.
# - cloud: Neon PostgreSQL + Cloudflare R2 attachment storage.
AGENT_SPACE_DEPLOYMENT_MODE=self_hosted

# Self-hosted PostgreSQL.
SELF_HOSTED_DATABASE_URL=postgres://agent_space:agent_space@127.0.0.1:5432/agent_space
SELF_HOSTED_DATABASE_DIRECT_URL=postgres://agent_space:agent_space@127.0.0.1:5432/agent_space

# Self-hosted attachment storage.
SELF_HOSTED_ATTACHMENT_LOCAL_ROOT=/var/lib/agentspace/workspaces

# Cloud mode: Neon PostgreSQL.
# All Neon-owned values use the `NEON_` prefix. Replace <NEON_DB_PASSWORD>
# in your real deployment env; do not commit it.
NEON_DATABASE_URL=postgresql://<NEON_DATABASE_USER>:<NEON_DB_PASSWORD>@<NEON_POOLER_HOST>/<NEON_DATABASE_NAME>?sslmode=require&channel_binding=require
NEON_DATABASE_DIRECT_URL=postgresql://<NEON_DATABASE_USER>:<NEON_DB_PASSWORD>@<NEON_DIRECT_HOST>/<NEON_DATABASE_NAME>?sslmode=require&channel_binding=require
NEON_DATABASE_USER=<NEON_DATABASE_USER>
NEON_DATABASE_NAME=<NEON_DATABASE_NAME>
NEON_DATABASE_POOLER_HOST=<NEON_POOLER_HOST>
NEON_DATABASE_DIRECT_HOST=<NEON_DIRECT_HOST>

# E2E tests: Playwright creates a temporary Neon branch through the Neon API
# and points the web server at that branch. Keep NEON_API_KEY out of .env;
# put it in the shell, CI secret, or a local ignored .env.neon file.
# AGENT_SPACE_E2E_NEON_PROJECT_ID=<NEON_PROJECT_ID>
# AGENT_SPACE_E2E_NEON_ORG_ID=<NEON_ORG_ID>
# AGENT_SPACE_E2E_NEON_PARENT_BRANCH=production
# AGENT_SPACE_E2E_NEON_SUSPEND_TIMEOUT_SECONDS=300
# NEON_API_KEY=<store outside this file>

# Cloud mode: Cloudflare R2 object storage.
# All Cloudflare-owned values use the `CLOUDFLARE_` prefix.
CLOUDFLARE_ACCOUNT_ID=<CLOUDFLARE_ACCOUNT_ID>
CLOUDFLARE_R2_BUCKET=<CLOUDFLARE_R2_BUCKET>
CLOUDFLARE_R2_REGION=auto
CLOUDFLARE_R2_ENDPOINT=https://<CLOUDFLARE_ACCOUNT_ID>.r2.cloudflarestorage.com
CLOUDFLARE_R2_ACCESS_KEY_ID=replace_with_r2_access_key_id
CLOUDFLARE_R2_SECRET_ACCESS_KEY=replace_with_r2_secret_access_key
CLOUDFLARE_R2_FORCE_PATH_STYLE=true

# The application should resolve runtime database and attachment settings from
# AGENT_SPACE_DEPLOYMENT_MODE. Do not duplicate provider URLs into legacy
# aliases such as AGENT_SPACE_PG_URL or DATABASE_URL in new deployments.

# Attachment download and upload policy.
ATTACHMENT_SIGNED_URL_TTL_SECONDS=300
ATTACHMENT_MAX_UPLOAD_BYTES=52428800
ATTACHMENT_PUBLIC_BASE_URL=

# Local attachment root and migration fallback.
ATTACHMENT_LOCAL_ROOT=${SELF_HOSTED_ATTACHMENT_LOCAL_ROOT}
ATTACHMENT_ENABLE_LOCAL_FALLBACK=true

# AgentSpace web app base URL
AGENT_SPACE_APP_URL=http://127.0.0.1:1455

# Required for self-hosted production builds that use Next.js Server Actions.
# Use the same value for every web instance and every build of the same deployment.
# Generate with:
# node -e "console.log(require('crypto').randomBytes(32).toString('base64'))"
NEXT_SERVER_ACTIONS_ENCRYPTION_KEY=replace_with_base64_encoded_32_byte_key

# Used to sign OAuth state / nonce cookies
AGENT_SPACE_OAUTH_STATE_SECRET=replace_with_a_long_random_hex_string

# Optional: configure Google OAuth only if you need Google login locally.
AGENT_SPACE_GOOGLE_CLIENT_ID=replace_with_google_client_id
AGENT_SPACE_GOOGLE_CLIENT_SECRET=replace_with_google_client_secret
AGENT_SPACE_GOOGLE_CALLBACK_URL=http://127.0.0.1:1455/api/auth/google/callback

# Optional: configure Google Workspace / Google Sheets integration.
# See GOOGLE_WORKSPACE_SETUP.md.
AGENT_SPACE_GOOGLE_WORKSPACE_CLIENT_ID=replace_with_google_workspace_client_id
AGENT_SPACE_GOOGLE_WORKSPACE_CLIENT_SECRET=replace_with_google_workspace_client_secret
AGENT_SPACE_GOOGLE_WORKSPACE_CALLBACK_URL=http://127.0.0.1:1455/api/integrations/google/callback
# Generate with:
# node -e "console.log(require('crypto').randomBytes(32).toString('base64'))"
AGENT_SPACE_GOOGLE_WORKSPACE_TOKEN_ENCRYPTION_KEY=replace_with_base64_encoded_32_byte_key
# Optional Drive folder id for newly created Google Sheets.
AGENT_SPACE_GOOGLE_DRIVE_PARENT_FOLDER_ID=