APP_NAME=MediaRouter
APP_VERSION=1.0.0
# Docker sets this to production. Local development keeps development so the
# established SQLite workflow remains available.
APP_ENVIRONMENT=development
HOST=0.0.0.0
PORT=7860
# Comma-separated exact origins. Production requires at least one HTTPS origin
# such as the separately hosted Vercel frontend; wildcard origins are rejected.
CORS_ALLOWED_ORIGINS=http://localhost:3000
TEMP_DIR=./temp
OUTPUT_DIR=./outputs
TEMPLATE_DIR=./app/templates/categories
MAX_UPLOAD_SIZE=1073741824
WHISPER_MODEL=small
CLEANUP_MINUTES=60
CLEANUP_INTERVAL_SECONDS=60
MAX_WORKERS=2
LOG_LEVEL=INFO
MAX_DURATION_SECONDS=21600
MAX_RESOLUTION_PIXELS=33177600
DOWNLOAD_TIMEOUT_SECONDS=300
ALLOW_PRIVATE_URLS=false
BASE_URL=
FFMPEG_BINARY=ffmpeg
FFPROBE_BINARY=ffprobe
AUTH_ENABLED=true
DATABASE_URL=sqlite+aiosqlite:///./data/mediarouter.db
# SQLite initializes this schema locally. PostgreSQL must receive the SQL files
# under app/security/migrations/ through your deployment migration process.
SECURITY_AUTO_MIGRATE=false
# PostgreSQL only: backend-only BYPASSRLS role used for authoritative users,
# memberships, API-key principals, and canonical asset records.
SECURITY_DATABASE_ROLE=mediarouter_security_service
SECURITY_ENFORCE_RLS=true
AUTH_ROLE_SCOPES={}
AUTH_BOOTSTRAP_KEY_HASH=
AUTH_BOOTSTRAP_KEY_PREFIX=
AUTH_BOOTSTRAP_KEY_NAME=Bootstrap Administrator
AUTH_BOOTSTRAP_ENVIRONMENT=live
AUTH_LAST_USED_UPDATE_SECONDS=60
AUTH_DEFAULT_REQUESTS_PER_MINUTE=100
AUTH_DEFAULT_CONCURRENT_JOBS=10
AUTH_DEFAULT_UPLOADS_PER_HOUR=20
AUTH_DEFAULT_PROCESSING_BYTES_PER_DAY=107374182400
AUTH_TRUST_PROXY_HEADERS=true
# Required only when running the standalone stdio MCP transport with auth enabled.
MCP_STDIO_API_KEY=

# Social Automation Foundation. Apply all SQL files under app/social/migrations/
# to Supabase/Postgres before enabling social writes in production. The existing
# DATABASE_URL remains a local-development fallback only.
SOCIAL_ENABLED=true
# Example: postgresql+asyncpg://postgres:password@db.example:5432/postgres
SOCIAL_DATABASE_URL=
# Required for PostgreSQL production. This URL must authenticate as a normal
# non-owner/non-BYPASSRLS API role. Do not use a Supabase service-role URL here.
SOCIAL_TENANT_DATABASE_ROLE=mediarouter_tenant
# Trusted backend-only worker connection. It must use the explicitly named
# BYPASSRLS role and must never be exposed through REST, MCP, n8n, SDKs, or UI.
SOCIAL_WORKER_DATABASE_URL=
SOCIAL_WORKER_DATABASE_ROLE=mediarouter_social_worker
SOCIAL_ENFORCE_RLS=true
SOCIAL_AUTO_MIGRATE=false
SOCIAL_WORKER_ENABLED=true
SOCIAL_SCHEDULER_INTERVAL_SECONDS=30
SOCIAL_JOB_STALE_AFTER_SECONDS=900
SOCIAL_PUBLISH_RETRY_LIMIT=5
SOCIAL_OAUTH_REQUESTS_PER_HOUR=30
SOCIAL_PUBLISH_REQUESTS_PER_MINUTE=30
SOCIAL_SCHEDULE_REQUESTS_PER_MINUTE=60
SOCIAL_ANALYTICS_REQUESTS_PER_MINUTE=120
# Required for OAuth state/PKCE and encrypted local token fallback. Generate at
# least 32 random bytes, for example: openssl rand -base64 32
SOCIAL_OAUTH_ENCRYPTION_KEY=
SUPABASE_URL=
SUPABASE_SERVICE_ROLE_KEY=
SUPABASE_VAULT_ENABLED=false
SOCIAL_OAUTH_REDIRECT_BASE_URL=

# Provider-neutral generation runtime. WAN and FLUX are optional; neither is
# enabled merely by the shared timeout/retry settings below.
GENERATION_ENABLED=true
GENERATION_JOB_RETRY_LIMIT=3
# Shared remote AI worker client defaults. No worker is configured by these
# values alone; do not add browser-visible worker URLs or credentials here.
AI_WORKER_CONNECT_TIMEOUT_SECONDS=10
AI_WORKER_REQUEST_TIMEOUT_SECONDS=60
AI_WORKER_READ_TIMEOUT_SECONDS=300
AI_WORKER_MAX_RETRIES=3
AI_WORKER_RETRY_BACKOFF_SECONDS=0.5
# Optional authenticated WAN 2.2 image-to-video worker. Set both values only
# in backend/Hugging Face deployment secrets; never expose them to a browser,
# MCP client, n8n node, SDK output, or logs. WAN stays unavailable if either
# value is omitted or malformed, without blocking application startup.
WAN_SPACE_URL=
WAN_SPACE_TOKEN=
# Optional authenticated FLUX.2 Klein image-generation worker. Set both
# backend-only values in deployment secrets; never expose either value in a
# browser, MCP/n8n request, SDK result, audit record, or log.
FLUX_SPACE_URL=
FLUX_SPACE_TOKEN=
GENERATION_WORKER_ENABLED=true
GENERATION_WORKER_INTERVAL_SECONDS=5
GENERATION_WORKER_POLL_BACKOFF_SECONDS=2
GENERATION_WORKER_BATCH_SIZE=8
GENERATION_JOB_STALE_AFTER_SECONDS=900
# Content Studio persistence/render limits. Editor state and render jobs are
# durable PostgreSQL records; render workers use bounded temporary files only.
EDITOR_STATE_MAX_BYTES=1048576
RENDER_WORKER_ENABLED=true
RENDER_WORKER_INTERVAL_SECONDS=2
RENDER_JOB_STALE_AFTER_SECONDS=900
RENDER_JOB_TIMEOUT_SECONDS=7200
RENDER_JOB_RETRY_LIMIT=2
RENDER_MAX_ACTIVE_JOBS_PER_PROJECT=1
RENDER_MAX_TRACKS=32
RENDER_MAX_CLIPS=500
RENDER_MAX_DURATION_SECONDS=3600
RENDER_MAX_INPUT_BYTES=4294967296
GOOGLE_CLIENT_ID=
GOOGLE_CLIENT_SECRET=
# YouTube Data API v3 worker controls. Keep the client secret backend-only.
# Upload chunks must be a multiple of 262144 bytes (256 KiB).
YOUTUBE_UPLOAD_CHUNK_BYTES=8388608
YOUTUBE_MAX_CONCURRENT_UPLOADS=2
YOUTUBE_REQUEST_TIMEOUT_SECONDS=60
YOUTUBE_PROCESSING_POLL_SECONDS=30
META_CLIENT_ID=
META_CLIENT_SECRET=
# Preferred Meta application names. META_CLIENT_* remains a compatibility
# alias for deployments created before this configuration contract.
META_APP_ID=
META_APP_SECRET=
META_GRAPH_API_VERSION=v25.0
TIKTOK_CLIENT_KEY=
TIKTOK_CLIENT_SECRET=
# Exact backend callback registered under TikTok Login Kit. It must be:
# https://<api-host>/v1/social/accounts/tiktok/callback
TIKTOK_REDIRECT_URI=
# Fail closed. Set true only after Content Posting API Direct Post approval and
# video.publish authorization are confirmed for this TikTok application.
TIKTOK_DIRECT_POST_ENABLED=false
# TikTok FILE_UPLOAD chunks: 5,000,000 through 64,000,000 bytes.
TIKTOK_UPLOAD_CHUNK_BYTES=10000000
TIKTOK_REQUEST_TIMEOUT_SECONDS=60
TIKTOK_PROCESSING_POLL_SECONDS=30
# Test-only opt-in. Normal CI must keep this false; dedicated credentials and
# explicit publish consent are documented in social-tiktok-production-readiness.md.
RUN_TIKTOK_INTEGRATION_TESTS=false
LINKEDIN_CLIENT_ID=
LINKEDIN_CLIENT_SECRET=
# Exact backend callback registered in the LinkedIn Developer Portal:
# https://<api-host>/v1/social/accounts/linkedin/callback
LINKEDIN_REDIRECT_URI=
# Enable only after LinkedIn has approved the required Community Management
# products/scopes for member and/or organization publishing.
LINKEDIN_PUBLISHING_ENABLED=false
LINKEDIN_REQUEST_TIMEOUT_SECONDS=60
LINKEDIN_MEDIA_PROCESSING_POLL_SECONDS=5
LINKEDIN_MEDIA_PROCESSING_TIMEOUT_SECONDS=600
# Test-only opt-in. Normal CI must keep this false; dedicated credentials and
# explicit publish/delete consent are documented in social-linkedin-production-readiness.md.
RUN_LINKEDIN_INTEGRATION_TESTS=false
X_CLIENT_ID=
X_CLIENT_SECRET=
# Exact backend callback registered in the X Developer Console:
# https://<api-host>/v1/social/accounts/x/callback
X_REDIRECT_URI=
# Enable only after confirming current X write/media endpoint entitlement.
X_PUBLISHING_ENABLED=false
X_UPLOAD_CHUNK_BYTES=5242880
X_REQUEST_TIMEOUT_SECONDS=60
X_MEDIA_PROCESSING_POLL_SECONDS=5
X_MEDIA_PROCESSING_TIMEOUT_SECONDS=300
# Test-only opt-in. Normal CI must keep this false; dedicated credentials and
# explicit publish/delete consent are documented in social-x-production-readiness.md.
RUN_X_INTEGRATION_TESTS=false
TELEGRAM_BOT_TOKEN=
WHATSAPP_CLIENT_ID=
WHATSAPP_CLIENT_SECRET=