# Backend Environment Variables

This document describes all environment variables used by the backend.

## Quick Start

1. Copy the template below to create your `.env` file:
```bash
cp ENV_VARIABLES.md .env
# Then edit .env and fill in your values
```

2. **DO NOT commit `.env` file to version control**

## Required Variables

### MongoDB Configuration
```bash
# Required: MongoDB connection string
MONGODB_URI=mongodb://localhost:27017
MONGODB_DB_NAME=cucu_note
```

### Authentication
```bash
# Required for production: Clerk authentication
CLERK_SECRET_KEY=sk_test_...
CLERK_JWKS_URL=https://your-clerk-instance.clerk.accounts.dev/.well-known/jwks.json
CLERK_ISSUER=https://your-clerk-instance.clerk.accounts.dev
```

### AI Services
```bash
# Required: OpenAI API key for embeddings
OPENAI_API_KEY=sk-...
```

## Optional Variables

### Server Configuration
- `PORT` - Server port (default: `5000`)

### MongoDB Connection Pooling
- `MONGODB_MAX_POOL_SIZE` - Maximum pool size (default: `50`)
- `MONGODB_MIN_POOL_SIZE` - Minimum pool size (default: `10`)
- `MONGODB_MAX_IDLE_TIME_MS` - Max idle time in milliseconds (default: `45000`)

### Redis Configuration
- `REDIS_HOST` - Redis host (default: `localhost`)
- `REDIS_PORT` - Redis port (default: `6379`)
- `REDIS_USERNAME` - Redis username (optional)
- `REDIS_PASSWORD` - Redis password (optional)
- `REDIS_CACHE_URL` - Redis cache host (default: from `REDIS_HOST`)
- `REDIS_CACHE_PORT` - Redis cache port (default: `6379`)
- `REDIS_CACHE_DB` - Redis cache database number (default: `2`)
- `REDIS_CACHE_TURN_ON` - Enable Redis cache (default: `true`)

### CORS Configuration
- `CORS_ORIGINS` - Comma-separated list of allowed origins, or `*` for all (default: `*`)
  - Example: `http://localhost:3001,https://yourdomain.com`

### Rate Limiting
- `RATE_LIMIT_GUEST` - Daily message limit for guests (default: `10`)
- `RATE_LIMIT_USER` - Daily message limit for authenticated users (default: `100`)
- `RATE_LIMIT_BLOCK_MINUTES` - Block duration after exceeding limit (default: `5`)
- `RATE_STORAGE_URI` - Rate limit storage URI (default: `memory://`)
  - Use `redis://host:port/db` for production
  - Or `memory://` for development (not suitable for multiple instances)
- `RATE_LIMIT_REDIS_DB` - Redis DB number for rate limiting (default: `0`)

### Development/Testing
- `DISABLE_AUTH` - Disable authentication (default: `false`, **NOT for production!**)
- `USE_SQLITE_HISTORY` - Use SQLite for chat history (default: `true`)
- `SQLITE_DB_PATH` - SQLite database path (default: `./data/chat_history.db`)
- `MEMO_DB_PATH` - Memo database path (default: `./db/memos.db`)

### Encryption Configuration
- `ENCRYPTION_KEY` - Fernet encryption key for sensitive data (API keys, etc.) (required for production)
  - Generate with: `python -c "from cryptography.fernet import Fernet; print(Fernet.generate_key().decode())"`
  - Must be a 32-byte base64-encoded string
  - **CRITICAL**: Do not commit to version control
  - If not set, will use password-based derivation (NOT secure for production)
- `ENCRYPTION_PASSWORD` - Fallback password for key derivation (dev only, NOT for production)

### Other Services
- `GOOGLE_API_KEY` - Google API key (optional)
- `GROQ_API_KEY` - Groq API key (optional)
- `DEFAULT_MODEL` - Default AI model (default: `gpt-4o-mini`)
- `FIRECRAWL_API_KEY` - Firecrawl API key (optional)
- `LANGFUSE_PUBLIC_KEY` - Langfuse public key (optional)
- `LANGFUSE_SECRET_KEY` - Langfuse secret key (optional)
- `LANGFUSE_BASE_URL` - Langfuse base URL (default: `https://cloud.langfuse.com`)

## Production Checklist

Before deploying to production, ensure:

1. ✅ `MONGODB_URI` is set (no hardcoded credentials)
2. ✅ `CLERK_SECRET_KEY`, `CLERK_JWKS_URL`, `CLERK_ISSUER` are configured
3. ✅ `CORS_ORIGINS` is set to specific origins (not `*`)
4. ✅ `REDIS_HOST` is configured for caching and rate limiting
5. ✅ `RATE_STORAGE_URI` uses Redis (not `memory://`)
6. ✅ `DISABLE_AUTH=false` (authentication enabled)
7. ✅ `ENCRYPTION_KEY` is set (required for user API key encryption)
8. ✅ All API keys are set and valid

