.env.example

# Core runtime
GEMINI_API_KEY=your_managed_default_key
RUN_TIMEOUT_SECONDS=600

# Docker / service credentials
POSTGRES_DB=orchflow
POSTGRES_USER=orchflow
POSTGRES_PASSWORD=replace_with_a_strong_random_password
REDIS_PASSWORD=replace_with_a_strong_random_password

# Direct URLs for non-Docker local dev
# DATABASE_URL=postgresql://postgres:postgres@localhost:5432/orchflow
# REDIS_URL=redis://localhost:6379

# Provider encryption
# Generate with:

ENCRYPTION_KEY=your_base64_32_byte_key

# Deployment mode
# hosted: allows managed trial runs without provider_id
# self_hosted: BYOK-first behavior
ORCHFLOW_MODE=hosted
MANAGED_TRIAL_RUNS_ENABLED=true
MANAGED_TRIAL_RUNS_COUNT=3
ALLOW_MANAGED_RUNS_WITHOUT_PROVIDER=true

# Security / deploy
# Hosted deploys should set explicit frontend origins.
# Example: CORS_ALLOW_ORIGINS=https://orchflow.cloud,https://www.orchflow.cloud
CORS_ALLOW_ORIGINS=https://orchflow.cloud,https://www.orchflow.cloud

# Hosted deploys should usually keep this false to block localhost/private webhook targets.
ALLOW_PRIVATE_WEBHOOK_HOSTS=false