.env.example

# --- Shared env vars ---
LOG_LEVEL=INFO

# --- App and DB env vars ---
# One of `dev`, `staging`, or `production`
TRACECAT__APP_ENV=dev
# Used to encrypt/decrypt sensitive keys in the database
# Can be generated using `python -c "from cryptography.fernet import Fernet; print(Fernet.generate_key().decode())"`
TRACECAT__DB_ENCRYPTION_KEY=your-tracecat-db-fernet-key
# Used to authenticate with Tracecat services
# Can be generated using `openssl rand -hex 32`
TRACECAT__SERVICE_KEY=your-tracecat-service-key
# Used to generate private webhook URLs
# Can be generated using `openssl rand -hex 32`
TRACECAT__SIGNING_SECRET=your-tracecat-signing-secret
# API Service URL
TRACECAT__API_URL=http://api:8000
# Runner Service URL
# We recommend using ngrok here, but feel free to use any other service
# Run `ngrok http --domain=INSERT_STATIC_NGROK_DOMAIN_HERE 8001` to start ngrok and get the forwarding URL
TRACECAT__RUNNER_URL=https://your-ngrok-runner-url

# --- RabbitMQ ---
RABBITMQ_DEFAULT_PASS=guest
RABBITMQ_DEFAULT_USER=guest
RABBITMQ_URI=amqp://${RABBITMQ_DEFAULT_USER}:${RABBITMQ_DEFAULT_PASS}@host.docker.internal/

# --- Postgres ---
POSTGRES_USER=postgres
POSTGRES_PASSWORD=postgres
TRACECAT__DB_URI=postgresql+psycopg://${POSTGRES_USER}:${POSTGRES_PASSWORD}@host.docker.internal:5432/postgres

# --- Shared frontend env vars ---
# Important: environment variables prefixed with `NEXT_PUBLIC_` are exposed to the browser client
# You may need to adjust the domain (default `localhost`) based on your setup
# Containers in the same network can communicate with each other using the service name
# Or you can use the host.docker.internal to communicate with the host machine
NODE_ENV=development
NEXT_PUBLIC_APP_ENV=development
# The frontend app URL
NEXT_PUBLIC_APP_URL=http://localhost:3000
# Allows the browser to communicate with the backend
NEXT_PUBLIC_API_URL=http://localhost:8000

# --- Authentication + Clerk ---
# Controls auth for both the API and the frontend server + client
# Setting this to '1' or 'true' will DISABLE authentication
# Any other value will ENABLE authentication
# We recommend disabling auth for local usage
TRACECAT__DISABLE_AUTH=1
# Used for Clerk JWKS endpoint and to verify JWT `iss`
CLERK_FRONTEND_API_URL=your-clerk-frontend-api-url
# If using Clerk, the secret key and publishable key are required
CLERK_SECRET_KEY=your-clerk-secret-key
NEXT_PUBLIC_CLERK_PUBLISHABLE_KEY=your-clerk-publishable-key
# This must be set to use `auth().redirectToSignIn` API.
NEXT_PUBLIC_CLERK_SIGN_IN_URL=/sign-in
NEXT_PUBLIC_CLERK_SIGN_UP_URL=/sign-up

# --- Cloud only ---
# Tracecat Cloud only, please ignore if self-hosted:
NEXT_PUBLIC_POSTHOG_KEY=
NEXT_PUBLIC_POSTHOG_INGEST_HOST=https://www.your-domain.com/ingest
NEXT_PUBLIC_POSTHOG_HOST=https://app.posthog.com
NEXT_PUBLIC_DISABLE_SESSION_RECORDING=true

# --- Integrations env vars (optional) ---
OPENAI_API_KEY=your-openai-api-key
RESEND_API_KEY=your-resend-api-key