.env.example

# Finima — Environment Variables
#
# Copy this file to .env and fill in the values you want to override.
# The backend loads this file automatically via dotenvy at startup.
# Docker Compose also reads it for container configuration.
#
# FORMAT RULES (this file is shared by Make, Docker Compose, and dotenvy):
#   - Use plain KEY=VALUE only (no spaces around =)
#   - Do NOT quote values   — WRONG: PASSWORD="secret"  RIGHT: PASSWORD=secret
#   - Do NOT prefix export  — WRONG: export PASSWORD=x  RIGHT: PASSWORD=x
#   - Do NOT use ${VAR} interpolation — values are read literally

# ── Docker infrastructure credentials ────────────────────────
# Used by docker-compose.yml for container initialization.
POSTGRES_PASSWORD=finima_dev
MINIO_ROOT_USER=finima
MINIO_ROOT_PASSWORD=finima_dev

# ── Backend application overrides ────────────────────────────
# These use the APP__ prefix with __ as separator, matching the
# Rust config crate's Environment source.  They override values
# in config/default.yaml.
#
# Database connection URL.  Must use the same password as
# POSTGRES_PASSWORD above.  If unset, the backend constructs
# the URL from host/user/password/name in config/default.yaml.
APP__DATABASE__URL=postgres://finima:finima_dev@localhost:5432/finima

# JWT signing secret (generate with: openssl rand -base64 32).
# Must be at least 32 bytes.  The default in config/default.yaml
# is a placeholder that is rejected in production.
APP__AUTH__JWT_SECRET=change-me-to-a-random-secret

# Resend API key for magic-link emails (https://resend.com).
# When set, Finima sends real emails via the Resend API (in any
# environment, including development).  Leave empty to print
# magic links in the backend log instead.
APP__RESEND__API_KEY=

# Sender address for magic-link emails.  Must use a domain that
# is verified in your Resend dashboard (https://resend.com/domains).
# For local development without a verified domain, use Resend's
# shared test address: Finima <onboarding@resend.dev>
# (delivers only to the email on your Resend account).
# Default (from config/default.yaml): Finima <auth@finima.app>
# APP__AUTH__FROM_EMAIL=Finima <onboarding@resend.dev>

# Public-facing base URL embedded in magic-link emails.  Must
# point to the frontend origin so that clicking the link in the
# email opens the correct page in your browser.
# Default: http://localhost:5173  (local frontend dev server)
# In production, set this to your public frontend URL, e.g.:
# APP__AUTH__PUBLIC_URL=https://finima.app
APP__AUTH__PUBLIC_URL=http://localhost:5173

# ── Optional overrides ───────────────────────────────────────
# Uncomment to override defaults from config/default.yaml.
#
# APP__S3__ENDPOINT_URL=http://localhost:9000
# APP__S3__BUCKET=finima-uploads
# APP__S3__ACCESS_KEY_ID=finima
# APP__S3__SECRET_ACCESS_KEY=finima_dev

# ── LLM / AI Categorization ─────────────────────────────────
# Finima supports three LLM modes: Candle (in-process), Ollama
# (HTTP), or stub.  The Makefile defaults to Candle with
# auto-detected GPU acceleration.
#
# Option 1: Candle (default — in-process inference via mistral.rs)
#   No extra setup needed.  The Makefile auto-detects your hardware:
#     make dev               – uses Metal on macOS, CUDA on NVIDIA, CPU otherwise
#     make dev-candle        – explicit alias (same as above)
#   On first run the model downloads from HuggingFace (~4-5 GB for
#   Gemma 4 E4B Q4_K_M).  Set APP__LLM__CANDLE__MODEL_PATH to a
#   local .gguf file to skip the download.
#   To pre-download before first startup:
#     make download-model-candle
#
# Option 2: Ollama (HTTP inference via Docker container)
#     make dev LLM=ollama    – starts Ollama container automatically
#     make dev-ollama        – explicit alias
#   Then pull a model:
#     make download-model-ollama
#
# Option 3: Stub (no real LLM)
#     make dev LLM=stub      – skips all LLM features
#     make dev-stub          – explicit alias
#   All transactions are categorized as "other" with confidence 0.5.
#
# See docs/guides/maintainer-guide.md § "LLM Backend Configuration"
# for full details.
#
# APP__LLM__PROVIDER=candle
# APP__LLM__CANDLE__MODEL_ID=google/gemma-4-E4B-it
# APP__LLM__CANDLE__MODEL_PATH=
# APP__LLM__CANDLE__QUANTIZATION=Q4_K_M
# APP__LLM__CANDLE__DEVICE=auto
# APP__LLM__CANDLE__CONTEXT_LENGTH=8192
# APP__LLM__CANDLE__THREADS=0
# APP__LLM__OLLAMA__URL=http://localhost:11434
# APP__LLM__OLLAMA__MODEL=gemma4:26b-a4b-it-q4_K_M

# ── Database backups ─────────────────────────────────────────
BACKUP_RETENTION_DAYS=30

# ── Observability (SigNoz) ───────────────────────────────────
# SIGNOZ_ENDPOINT=http://signoz:4317