.env.example

# --- Supabase (audit log persistence) ---
# Project URL from https://app.supabase.com/project/<id>/settings/api
RAGCOMPLIANCE_SUPABASE_URL=
# Service role key (server-side only, never expose to browser)
RAGCOMPLIANCE_SUPABASE_KEY=
# Tenant key for this deployment; row-level security uses this
RAGCOMPLIANCE_WORKSPACE_ID=default
# Table name (defaults to rag_audit_logs)
RAGCOMPLIANCE_TABLE_NAME=rag_audit_logs
# Flip off in prod if you ever want to short-circuit logging
RAGCOMPLIANCE_ENABLED=true
# Dev mode prints records to stdout instead of Supabase (local hacking)
RAGCOMPLIANCE_DEV_MODE=false
# Hard-block on quota exceeded (default soft-warn only)
RAGCOMPLIANCE_ENFORCE_QUOTA=false
# Fire-and-forget audit writes on a daemon worker (default true)
RAGCOMPLIANCE_ASYNC_WRITES=true
# Bounded in-memory buffer when Supabase is slow or unreachable
RAGCOMPLIANCE_ASYNC_MAX_QUEUE=1000
# Seconds to wait on process exit for the worker to drain
RAGCOMPLIANCE_ASYNC_SHUTDOWN_TIMEOUT=5.0

# --- Slack alerts (optional, opt-in) ---
# Incoming webhook URL — leave empty to disable alerting entirely
RAGCOMPLIANCE_SLACK_WEBHOOK_URL=
# Dashboard URL for "View in dashboard" link in alert payloads
RAGCOMPLIANCE_SLACK_DASHBOARD_URL=
# Alert when max chunk similarity falls below this threshold
RAGCOMPLIANCE_SLACK_MIN_SIMILARITY=0.3
# Alert when a chain takes longer than this many milliseconds end-to-end
RAGCOMPLIANCE_SLACK_SLOW_CHAIN_MS=10000

# --- OIDC SSO for the dashboard (optional) ---
# Leave all four unset to keep the dashboard open (useful for local dev).
# Set all four to turn SSO on via standards OIDC discovery.
RAGCOMPLIANCE_OIDC_ISSUER=
RAGCOMPLIANCE_OIDC_CLIENT_ID=
RAGCOMPLIANCE_OIDC_CLIENT_SECRET=
RAGCOMPLIANCE_OIDC_REDIRECT_URI=
# Comma-separated allowlist of email domains; leave blank to allow any.
RAGCOMPLIANCE_OIDC_ALLOWED_DOMAINS=
# 32+ char random string used to sign session cookies. Generate with:
#   python -c "import secrets; print(secrets.token_urlsafe(48))"
# Must be set in prod so sessions survive restarts.
RAGCOMPLIANCE_SESSION_SECRET=

# --- Stripe (billing) ---
# Publishable key (safe to expose client-side)
STRIPE_PUBLISHABLE_KEY=
# Secret key (server-side only)
STRIPE_SECRET_KEY=
# Price IDs from https://dashboard.stripe.com/test/products
STRIPE_PRICE_ID_TEAM=
STRIPE_PRICE_ID_ENTERPRISE=
# Webhook signing secret from https://dashboard.stripe.com/test/webhooks
STRIPE_WEBHOOK_SECRET=
# Public-facing base URL, used to build success/cancel URLs
APP_BASE_URL=http://localhost:8000