.env.example

# Django Configuration
SECRET_KEY=your-secret-key-here
DEBUG=False
ALLOWED_HOSTS=localhost,127.0.0.1,yourdomain.com
CSRF_TRUSTED_ORIGINS=https://yourdomain.com

# Database Configuration (for PostgreSQL)
DATABASE_ENGINE=django.db.backends.postgresql
DATABASE_NAME=cbeam_db
DATABASE_USER=cbeam_user
DATABASE_PASSWORD=your-db-password
DATABASE_HOST=localhost
DATABASE_PORT=5432

# Security Settings
SECURE_HSTS_SECONDS=31536000
SECURE_HSTS_INCLUDE_SUBDOMAINS=True
SECURE_HSTS_PRELOAD=True

# Logging
LOG_LEVEL=WARNING
DJANGO_LOG_LEVEL=WARNING
APP_LOG_LEVEL=WARNING
LOG_FILE_PATH=c-beamd/logs/c-beam.log
LOG_MAX_BYTES=10485760
LOG_BACKUP_COUNT=5
LOG_FORMAT=json

# MQTT broker (c-beam publishes station state here)
# MQTT_CLIENT_PASSWORD was previously hardcoded in c-beamd/cbeamdcfg.py and is
# present in git history - rotate it on the broker before relying on this.
MQTT_CLIENT_NAME=c-beam
MQTT_CLIENT_PASSWORD=your-mqtt-password
MQTT_SERVER=c-beam.cbrp3.c-base.org
MQTT_SERVER_TLS=False
MQTT_SERVER_CERT=/etc/ssl/certs/c-beam-mqtt.crt
CBEAM_LOGFILE=/var/log/c-beam/c-beam.log
# c_out/tts on shout. leave empty to disable the client while shout is down
# COUT_URL=http://shout.cbrp3.c-base.org:1775/

# topic the airlock led stripe (c_leuse_leds.py) listens on
C_LEUSE_LED_TOPIC=c_leuse/led_pattern

# Firebase Cloud Messaging service account (push notifications for the app).
# defaults to <BASE_DIR>/fcm.json, i.e. /opt/c-beamd/fcm.json in the container,
# which is where podman-compose.yml mounts it. FCM_PROJECT_ID must match the
# `project_id` field inside that file.
FCM_SERVICE_ACCOUNT_FILE=
FCM_PROJECT_ID=c-beam

# Cookies - set both to True wherever c-beam is served over https
SESSION_COOKIE_SECURE=False
CSRF_COOKIE_SECURE=False

# Bootstrap superuser created by c-beamd/start (docker entrypoint).
# If DJANGO_SUPERUSER_PASSWORD is unset, the start script skips creating one.
DJANGO_SUPERUSER_NAME=admin
DJANGO_SUPERUSER_EMAIL=admin@example.com
DJANGO_SUPERUSER_PASSWORD=

# OAuth2 resource server (cbeamd/oauth.py). the c-base identity provider,
# built on django-oauth-toolkit, issues the tokens; c-beam only validates them.
# leave OAUTH_ISSUER blank to disable bearer authentication.
OAUTH_ISSUER=
# defaults to <OAUTH_ISSUER>/.well-known/jwks.json
OAUTH_JWKS_URL=
# optional: only accept tokens minted for this audience / carrying this scope
OAUTH_AUDIENCE=
OAUTH_REQUIRED_SCOPE=
# claim that carries the crew nickname (falls back to `username`, then `sub`)
OAUTH_USERNAME_CLAIM=preferred_username
# optional rfc 7662 fallback for opaque tokens, with c-beam's own client at the idp
OAUTH_INTROSPECTION_URL=
OAUTH_CLIENT_ID=
OAUTH_CLIENT_SECRET=
# browser login through the same idp (authorization code + pkce, as the same
# confidential client). the client needs grant type "authorization code" and
# this host's callback among its redirect uris, e.g. http://localhost:4254/oauth/callback/
# endpoints default to <OAUTH_ISSUER>/authorize/ and <OAUTH_ISSUER>/token/
OAUTH_AUTHORIZATION_URL=
OAUTH_TOKEN_URL=
OAUTH_LOGIN_SCOPE=openid
# pin the callback url when c-beam sits behind a proxy that hides its host
OAUTH_REDIRECT_URI=

# web assistant (AI-ASSISTANT.md): the station's openai-compatible ai server and
# the qdrant knowledge base, both only reachable from the crew network. django
# talks to them on the browser's behalf. leave AI_URL empty to disable the
# assistant; leave RAG_KEY empty to run it without the knowledge base.
AI_URL=https://ai.cbrp3.c-base.org/ollama/v1
AI_MODEL=gemma4:e4b
AI_WHISPER_MODEL=Whisper-Large-v3-Turbo
AI_EMBED_MODEL=nomic-embed-text-v1-GGUF
AI_CONNECT_TIMEOUT=5
AI_READ_TIMEOUT=60
RAG_URL=http://lazee-nerdserv.cbrp3.c-base.org:8123
RAG_KEY=
RAG_COLLECTION=cbase_knowledge
# qdrant or sandy (sandy strands over its voice websocket; slower, text only)
KNOWLEDGE_SOURCE=qdrant
SANDY_URL=wss://ai.cbrp3.c-base.org:8444/ws/voice