# .env.production.example - copy to .env.production or export these values in

# the deployment shell before running the production Compose overlay.

#

# DNS requirements:

# - ROOMOTE_APP_DOMAIN must have an A/AAAA record pointing at the host.

# - *.ROOMOTE_PREVIEW_DOMAIN must also point at the host so Caddy can route

# task previews.

# - Ports 80 and 443 must be reachable from the public internet.

ROOMOTE_APP_DOMAIN=roomote.example.com

ROOMOTE_PREVIEW_DOMAIN=roomote.example.com

PREVIEW_PROXY_SUBDOMAIN_SUFFIX=preview

# Deploy Compose defaults R_APP_ENV to production. Set R_APP_ENV=preview in

# the separate develop soak env file.

# R_APP_ENV=production

# How long an API shutdown lets in-flight Fast turns finish before aborting

# the remainder so they resume on the next process. Keep it under the

# platform's SIGTERM-to-SIGKILL grace window; 0 aborts active turns

# immediately. The bullmq service, which runs the turns the queue resumes,

# uses the same window unless R_BULLMQ_SHUTDOWN_DRAIN_MS overrides it.

# R_API_SHUTDOWN_DRAIN_MS=20000

# R_BULLMQ_SHUTDOWN_DRAIN_MS=20000

# Set to true to keep inference retry backoff inside the process that owns

# the Fast turn instead of scheduling it durably (kill switch for durable

# retry scheduling).

# R_FAST_DURABLE_RETRY_DISABLED=true

# Replace local defaults before exposing a shared deployment.

DATABASE_URL=postgres://postgres:password@postgres:5432/roomote_development

REDIS_URL=redis://redis:6379

TRPC_URL=https://roomote.example.com/_roomote-api

S3_ENDPOINT=http://minio:9000

# Production Caddy routes /$S3_BUCKET_ARTIFACTS/* to MinIO, so hosted workers

# can upload artifacts through the public app origin without a separate object

# storage hostname.

S3_PRESIGN_ENDPOINT=https://roomote.example.com

S3_REGION=us-east-1

S3_ACCESS_KEY_ID=roomote

S3_SECRET_ACCESS_KEY=

S3_BUCKET_ARTIFACTS=roomote-artifacts

# Set to true to create the artifacts bucket at api boot when it is missing

# (MinIO does not auto-create buckets; compose installs also run minio-init).

# S3_AUTO_CREATE_BUCKET=true

# Base64-encoded P-256 PEM keypairs generated by the operator.

# Private keys use PKCS8; public keys use standard public-key PEM.

# Alternatively, leave all four unset and set R_AUTO_GENERATE_KEYS=true

# to have Roomote generate the keypairs at first startup and persist them

# encrypted (with ENCRYPTION_KEY) in the database. Useful on platforms that

# cannot run openssl during provisioning (Railway, Render, and similar).

JOB_AUTH_PRIVATE_KEY=

JOB_AUTH_PUBLIC_KEY=

PREVIEW_AUTH_PRIVATE_KEY=

PREVIEW_AUTH_PUBLIC_KEY=

# R_AUTO_GENERATE_KEYS=true

# Random single-line secrets generated by the operator.

ENCRYPTION_KEY=

# Shared internal secret for Discord-gateway→API event delivery (API + BullMQ).

# Required when Discord is enabled. The installer and Railway/Render/Coolify

# templates generate it; UI Discord save also mints it when missing, and the

# runtime auto-heals when Discord is already configured without one.

# R_DISCORD_GATEWAY_SECRET=

ARTIFACT_SIGNING_KEY=

DASHBOARD_PASSWORD=

# Optional dedicated secret for signing sign-in session cookies (>=32 chars).

# Falls back to ENCRYPTION_KEY when unset; setting it later logs users out.

# BETTER_AUTH_SECRET=

# One-time token required by the /setup bootstrap wizard until initial setup

# completes. Strongly recommended for any publicly reachable deployment; the

# one-command installer generates it automatically.

SETUP_TOKEN=

# Optional env-level model provider overrides. Use models.dev-style provider/model

# ids. Leave unset to manage task models through Roomote runtime settings.

# R_MODEL=openrouter/anthropic/claude-sonnet-4

# R_SMALL_MODEL=openrouter/openai/gpt-4.1-mini

# R_VISION_MODEL=openrouter/openai/gpt-5.6-sol

# R_CODE_REVIEW_MODEL=openrouter/openai/gpt-5.6-sol

# R_EXPLORE_MODEL=openrouter/openai/gpt-5.6-luna

# R_MODEL_ENV_KEYS=CUSTOM_PROVIDER_API_KEY

# CUSTOM_PROVIDER_API_KEY=

OPENROUTER_API_KEY=

# Optional capped key mapped to OPENROUTER_API_KEY only in environment workers.

SANDBOX_OPENROUTER_API_KEY=

# OPENAI_API_KEY=

# ANTHROPIC_API_KEY=

# GOOGLE_GENERATIVE_AI_API_KEY=

# GEMINI_API_KEY=

# MOONSHOT_API_KEY=

# KIMI_API_KEY=

# MINIMAX_API_KEY=

# ZAI_API_KEY=

# ZAI_REGION=global

# ZAI_CODING_PLAN_API_KEY=

# ZAI_CODING_PLAN_REGION=global

# OPENCODE_API_KEY=

# Compute provider. Use docker for a single-host deployment, or

# modal/e2b/daytona/blaxel/box/azure for a hosted worker runtime.

DEFAULT_COMPUTE_PROVIDER=docker

# Optional on published app images: when unset, the app derives the worker

# image as ghcr.io/roocodeinc/roomote-worker:<baked release version>.

# Override ROOMOTE_WORKER_IMAGE_REPO to derive from a fork or mirror repo.

# DOCKER_WORKER_IMAGE=roomote-worker:local

# ROOMOTE_WORKER_IMAGE_REPO=ghcr.io/roocodeinc/roomote-worker

# Optional Memory image override. When unset, the brain profile uses

# ${IMAGE_REGISTRY}/${IMAGE_NAMESPACE}/roomote-gbrain:${ROOMOTE_VERSION}.

# GBRAIN_IMAGE=ghcr.io/roocodeinc/roomote-gbrain:v0.1.0

# DOCKER_WORKER_PLATFORM=linux/amd64

# DOCKER_WORKER_NETWORK=roomote_worker

# DOCKER_WORKER_RELEASE_PATH=/roomote/releases/worker-current.tar.gz

# DOCKER_WORKER_CPU_LIMIT=2

# DOCKER_WORKER_MEMORY_LIMIT=4g

# DOCKER_TASK_DAEMON_MEMORY_LIMIT=8g

# DOCKER_WORKER_PIDS_LIMIT=512

# DOCKER_WORKER_DISK_LIMIT=20g

# DOCKER_WORKER_ALLOW_UNBOUNDED_DISK=false

# DOCKER_WORKER_LOG_MAX_SIZE=10m

# DOCKER_WORKER_LOG_MAX_FILES=3

# DOCKER_WORKER_EGRESS_POLICY=internet

# DOCKER_STANDBY_MAX_COUNT=10

# DOCKER_STANDBY_MAX_AGE_HOURS=24

# MODAL_TOKEN_ID=

# MODAL_TOKEN_SECRET=

# Leave blank: the installer and deployer keep it in sync with the matching

# DOCKER_WORKER_IMAGE, and on published app images the app derives it from

# the effective worker image at runtime, so Modal only needs the token pair.

# Set a value only to pin a custom base image; it is then never overwritten.

# MODAL_BASE_IMAGE_REF=

# MODAL_ENDPOINT=

# MODAL_ENVIRONMENT=

# MODAL_APP_NAME=

# MODAL_REGISTRY_USERNAME=

# MODAL_REGISTRY_PASSWORD=

# MODAL_ECR_OIDC_ROLE_ARN=

# MODAL_ECR_REGION=

# DAYTONA_API_KEY=

# DAYTONA_API_URL=

# DAYTONA_TARGET=

# Name of the Daytona snapshot registered from the public Roomote worker image.

# DAYTONA_SNAPSHOT_NAME=

# Box sandbox provider. Only BOX_API_KEY is required; setup does not

# build a Box worker artifact. Box does not support environment snapshots.

# BOX_API_KEY=

# BOX_API_BASE_URL=

# BOX_MACHINE_TYPE=default

# BOX_TIMEOUT_MS=

# BOX_STANDBY_MAX_COUNT=

# BOX_STANDBY_MAX_AGE_HOURS=

# Sign-in providers.

# R_ALLOWED_EMAILS=

# Optional paid-seat license key (RMLK1.…). Takes precedence over Settings → Users.

# R_LICENSE_KEY=

# R_SLACK_CLIENT_ID=

# R_SLACK_CLIENT_SECRET=

# Required GitHub App.

# R_GITHUB_APP_SLUG=

# Optional comma-separated GitHub App slugs that are also trusted as Roomote-managed.

# R_GITHUB_ADDITIONAL_APP_SLUGS=

# Self-run Brain embeddings (embeddings stay on your hardware; chat

# synthesis keeps using the configured provider). With the bundled service,

# set COMPOSE_PROFILES=brain,local-inference and ALL of the settings below —

# the model name and dimensions must match what the inference server

# serves, and the embedding pair is create-time: set everything BEFORE the

# Brain's first boot. gbrain's defaults (text-embedding-3-small, 1536) name

# models the bundled server does not serve, so the URL alone is not a

# working configuration. Self-run model names pass through unchanged and

# must exactly match the ids served by the upstream.

# R_BRAIN_EMBEDDINGS_UPSTREAM_URL=http://infinity:7997

# R_BRAIN_INFERENCE_UPSTREAM_API_KEY=

# R_BRAIN_EMBEDDING_MODEL=BAAI/bge-m3

# R_BRAIN_EMBEDDING_DIMENSIONS=1024

# Self-run judgment model for routing and triage decisions. Any server that

# answers the typed decisions request at /v1/decisions works; the bundled one

# is COMPOSE_PROFILES=judgment with R_JUDGMENT_UPSTREAM_URL=http://judgment:8080

# and R_JUDGMENT_MODEL=roomote (a CPU model, about 1.5 GB; JUDGMENT_CPUS and JUDGMENT_MEMORY_LIMIT size it,

# JUDGMENT_IMAGE and JUDGMENT_MODEL override the image and the checkpoint).

# Configure it as the selected route with R_JUDGMENT_MODEL=roomote; decision

# text is processed on your hardware. To compare Jev with this upstream, select Jev and set

# R_JUDGMENT_SHADOW=on. The key is optional for a private-network upstream.

# R_JUDGMENT_UPSTREAM_URL=

# R_JUDGMENT_UPSTREAM_API_KEY=

# Shadow scoring compares each Jev judgment with the upstream and logs

# per-question agreement for calibration.

# R_JUDGMENT_SHADOW=off

# `on` writes every answered decision (scrubbed) to the artifact bucket under

# judgment-capture/, to build a training set from. Keeps decision text.

# R_JUDGMENT_CAPTURE=off

# Choose a judgment route: `roomote` (the upstream above), `typesafe`,

# `openrouter`, `vercel`, or `off`. A TypeSafe key selects Jev via TypeSafe

# when Settings has no saved route. This environment value takes precedence

# over the Settings choice when set.

# R_JUDGMENT_MODEL=

# R_GITHUB_APP_ID=

# Raw GitHub App private-key PEM with newlines escaped as \n; do not base64 it.

# R_GITHUB_APP_PRIVATE_KEY=

# R_GITHUB_CLIENT_ID=

# R_GITHUB_CLIENT_SECRET=

# R_GITHUB_WEBHOOK_SECRET=

# GITLAB_CLIENT_ID=

# GITLAB_CLIENT_SECRET=

# GITLAB_WEBHOOK_SECRET=

# GITLAB_WEBHOOK_SIGNING_TOKEN=

# Optional integrations.

# Set to true to prevent curated integrations from being configured or used.

# Existing connections remain stored and become available again once unset.

# R_CURATED_INTEGRATIONS_DISABLED=true

# SLACK_APP_ID=

# R_SLACK_SIGNING_SECRET=

# R_TELEGRAM_BOT_TOKEN=

# R_TELEGRAM_WEBHOOK_SECRET=

# R_LINEAR_CLIENT_ID=

# R_LINEAR_CLIENT_SECRET=

# R_LINEAR_WEBHOOK_SECRET=

# Optional private-network completion webhook receiver ranges (comma-separated

# CIDRs). Unset keeps delivery public-only. Set only the receiver's range.

# R_SESSION_DONE_WEBHOOK_ALLOWED_PRIVATE_CIDRS=127.0.0.1/32