# Cepheus API — production template (copy to .env, never commit secrets)
# HF_TOKEN — local only for CLI/API; set GitHub secret HF_TOKEN for CI deploy

CEPHEUS_CLOUD=1
# Local dev face recognition (browser camera + search): keep CI stub OFF
# CEPHEUS_CI_STUB_VISION=0
# CEPHEUS_GOSSIP_ROOT=MK
# Cloud Run + L4 GPU: set CEPHEUS_GPU_VISION=1 to load YOLO/InsightFace (not the stub).
# CEPHEUS_GPU_VISION=1
# Cloud CPU deploys (for example Hugging Face Spaces): force the full vision engine.
# CEPHEUS_FORCE_FULL_VISION=1
# InsightFace model pack (must match enrollment embeddings; HF uses buffalo_sc)
# FACE_MODEL_PACK=buffalo_sc
# FACE_MODEL_ROOT=/app/model_cache
# FACE_MATCH_THRESHOLD=0.22
# Force CPU inference even when CUDA is present (local debug):
# CEPHEUS_FORCE_CPU=1
CEPHEUS_API_KEY=rotate-me-long-random-key
# Optional: document automation key purpose (audit only)
# CEPHEUS_API_KEY_SCOPE=guest-sos-automation
# Optional: read-only automation key (role readonly on GET routes)
# CEPHEUS_READONLY_API_KEY=
# Guest mobile app SOS scope (POST /sos/guest)
# CEPHEUS_GUEST_API_KEY=
# Disable gossip auto-start on API boot (default on for local dev)
# CEPHEUS_GOSSIP_AUTO_START=0
# Do not auto-switch gossip root on face detection (manual /gossip/set_root only)
GOSSIP_AUTO_ROOT_SWITCH=0
# HF Spaces: anonymous vision/WS (no JWT refresh interruptions)
ALLOW_PUBLIC_VISION=1
CEPHEUS_PUBLIC_VISION=1
CEPHEUS_WS_OPEN=1
CEPHEUS_EMBEDDINGS_STARTUP_ONLY=1
CEPHEUS_WS_RECEIVE_TIMEOUT=300
CEPHEUS_JWT_SECRET=rotate-me-jwt-signing-secret-min-32-chars
CEPHEUS_AUTH_USERS=[{"username":"admin","password_hash":"$2b$12$...","role":"admin"}]
# Local dev only (set matching VITE_API_KEY in cepheus/.env.local):
# CEPHEUS_AUTH_DEV_MODE=1
# CEPHEUS_DEV_API_KEY=local-dev-only-key
# CEPHEUS_DEV_JWT_SECRET=local-dev-jwt-secret-min-32-chars
# CEPHEUS_DEV_AUTH_USERS=[{"username":"admin","password":"admin","role":"admin"},{"username":"staff","password":"staff","role":"staff"}]



GEMINI_API_KEY=
# Recommended core models (see backend/gemini_config.py)
GEMINI_MODEL=gemini-3.5-flash
GEMINI_MODEL_PRO=gemini-3.1-pro
GEMINI_MODEL_LITE=gemini-3.1-flash-lite
CORS_ORIGINS=https://community-security-and-emergency-ma.vercel.app,https://rapid-eec43.web.app,https://rapid-eec43.firebaseapp.com,http://localhost:5173,http://127.0.0.1:5173,http://localhost:5174,http://127.0.0.1:5174
CEPHEUS_ACCESS_TOKEN_TTL=900
CEPHEUS_WS_TICKET_TTL=900
CEPHEUS_REFRESH_TOKEN_TTL=604800
CEPHEUS_PRODUCTION=0
# Demo simulations (issue auto-progress) — dev only, never in production
# CEPHEUS_DEMO_MODE=1
# Staff portal dev auto-accept (port 5174) — dev only
# VITE_STAFF_AUTO_ACCEPT=1
# Multi-instance Cloud Run: shared refresh token store
# REDIS_URL=redis://:password@host:6379/0