.env.example

# ─────────────────────────────────────────────────────────────────────────────
# Blacknode environment. Copy to `.env` (gitignored) and fill in.
#   cp .env.example .env
#
# In production, provide API keys HERE via env — not through the editor UI key
# panel — so secrets are never written to editor-server/api_keys.json (which the
# /settings/api-keys endpoint can read back). Env-provided keys are used by the
# runtime but never returned by that endpoint.
# ─────────────────────────────────────────────────────────────────────────────

# ── Model / inference keys ───────────────────────────────────────────────────
NVIDIA_API_KEY=
OPENAI_API_KEY=
ANTHROPIC_API_KEY=
# Local NIM container launch (NGC) — only if you run a local NIM container:
NGC_API_KEY=

# ── Chat drivers (optional) ──────────────────────────────────────────────────
SLACK_BOT_TOKEN=
TELEGRAM_BOT_TOKEN=

# ── Image pinning (production) ───────────────────────────────────────────────
# Pin to a published 12-char commit SHA instead of `latest` for reproducible
# deploys, e.g. BLACKNODE_IMAGE_TAG=1a2b3c4d5e6f
BLACKNODE_IMAGE_TAG=latest
# Override registries only if you mirror the images:
# BLACKNODE_SERVER_IMAGE=ghcr.io/temiroff/blacknode-server
# BLACKNODE_EDITOR_IMAGE=ghcr.io/temiroff/blacknode-editor

# ── Front door (docker compose --profile proxy: Caddy, TLS + Basic Auth) ──────
# Public hostname Caddy serves. `localhost` uses Caddy's internal CA (local
# testing); a real domain gets an automatic Let's Encrypt certificate.
BLACKNODE_DOMAIN=localhost
# Basic Auth applied to every request through the proxy. Generate the hash with:
#   docker run --rm caddy:2.8-alpine caddy hash-password --plaintext 'your-password'
BLACKNODE_BASICAUTH_USER=admin
BLACKNODE_BASICAUTH_HASH=