# --- Redis (BullMQ + domain-event stream `factory:events`) ---
REDIS_URL=redis://localhost:6379

# --- Postgres (Prisma; schema at prisma/schema.prisma) ---
DATABASE_URL=postgresql://factory:factory@localhost:5432/factory

# --- Object storage (S3-compatible; MinIO in dev) ---
S3_ENDPOINT=http://localhost:9000
S3_REGION=us-east-1
S3_BUCKET=factory-files
S3_ACCESS_KEY=minioadmin
S3_SECRET_KEY=minioadmin
S3_PUBLIC_BASE=http://localhost:9001

# --- OpenSearch (indexer + search; basic auth) ---
SEARCH_URL=http://localhost:9200
SEARCH_USERNAME=admin
SEARCH_PASSWORD=changeme

# --- Secrets / crypto ---
# 32+ char key; webhook signing secrets are AES-256-GCM-encrypted at rest.
MASTER_ENCRYPTION_KEY=

# --- AI (OpenAI-compatible; Phase 12 wires the full gateway) ---
AI_API_KEY=
AI_PROVIDER=openai
AI_BASE_URL=
AI_MODEL=gpt-4o-mini

# --- SMTP (outbound email; empty host = dev-safe no-op sender) ---
SMTP_HOST=
SMTP_PORT=587
SMTP_USER=
SMTP_PASS=
SMTP_FROM=noreply@factory.local

# --- ClamAV (empty host = dev default: scans skipped, files pass through) ---
CLAMAV_HOST=
CLAMAV_PORT=3310

# --- Worker tuning ---
WORKER_CONCURRENCY=10
WORKER_ID=worker-1
# Retention job runs in dry-run (report only) unless:
WORKER_RETENTION_EXECUTE=false