.env.example

# CCR Platform environment. Everything has a safe local-dev default; the
# variables under "Deployment" should be set explicitly on a real instance.

# ---- Deployment (set these in production) ----
# REQUIRED in production: sessions survive restarts only with a fixed secret.
# Generate one: python -c "import secrets; print(secrets.token_hex(32))"
# CCR_SESSION_SECRET=

# Set to 1 when serving over HTTPS (marks cookies Secure).
# CCR_COOKIE_SECURE=1

# Anonymous-data TTL purge in hours. 0 disables (local-dev default);
# deployments should set 24 (PI retention decision, 2026-07-10).
# CCR_ANON_TTL_HOURS=24

# Preload the default embedding model at startup so the first run is fast.
# CCR_WARM_MODEL=1

# ---- Tiers and limits (defaults shown) ----
# CCR_ANON_MAX_BYTES=5242880        # 5 MB anonymous upload cap (pre-parse shield;
#                                   # the 200-row cap below is what actually binds)
# CCR_ANON_MAX_ROWS=200             # anonymous row cap per file (PI decision)
# CCR_ANON_MAX_RUNS_PER_DAY=3       # anonymous runs/day, then sign-in
# CCR_USER_MAX_SAVED_RUNS=15        # saved-run cap for signed-in users

# ---- Storage and processing ----
# File storage backend: "local" (default; files under CCR_DATA_DIR) or "s3"
# (any S3-compatible store; Cloudflare R2 recommended - zero egress fees).
# The s3 path is production-ready; enabling it is config, not development.
# CCR_STORAGE=s3
# CCR_S3_ENDPOINT=https://<accountid>.r2.cloudflarestorage.com
# CCR_S3_BUCKET=ccr-platform
# CCR_S3_ACCESS_KEY_ID=
# CCR_S3_SECRET_ACCESS_KEY=

# Where the DB, uploaded corpora, results, and embedding cache live (default: backend/data)
# CCR_DATA_DIR=/absolute/path
# Row ceiling for uploads (default 100000; hosted demo uses 20000). This is
# the limit that actually bounds job cost - embedding scales with rows and
# tokens, not file bytes - so tune THIS per deployment, not the byte ceiling.
# CCR_MAX_ROWS=20000
# Byte ceiling for uploads (default 50 MB). An OOM/abuse backstop only; the
# upload is streamed and rejected mid-transfer once it passes this.
# CCR_MAX_UPLOAD_BYTES=52428800
# Corpus-embedding cache (default on; set 0 to disable)
# CCR_EMB_CACHE=1

# ---- Development / CI only ----
# Force the deterministic fake embedder (never production)
# CCR_FAKE_EMBEDDINGS=1

# ---- Google sign-in via Supabase (optional; button hidden when unset) ----
# Supabase dashboard > Project Settings > API. The anon key is public-facing
# by design; the service_role key is never used and never leaves the dashboard.
# SUPABASE_URL=https://YOUR_PROJECT_REF.supabase.co
# SUPABASE_ANON_KEY=
# Public base URL of this app (Google redirect target).
# CCR_APP_URL=http://127.0.0.1:8000

# ---- LLM item generation (optional; feature hidden when no key set) ----
# Drafts questionnaire items for a construct from its name + explanation
# (ITEM_GENERATION.md). Signed-in users only, with a daily cap. Two providers;
# set ONE key (Anthropic preferred - the PI-decided target; Groq free tier is
# the interim/testing provider). ANTHROPIC_API_KEY wins if both are set;
# force with CCR_GENERATION_PROVIDER=anthropic|groq.
# ANTHROPIC_API_KEY=            # console.anthropic.com -> claude-haiku-4-5
# GROQ_API_KEY=                 # console.groq.com -> llama-3.3-70b-versatile
# CCR_GENERATION_PROVIDER=
# CCR_GENERATION_MODEL=         # override the provider's default model id
# CCR_USER_MAX_GENERATIONS_PER_DAY=20

# ---- Admin access ----
# Comma-separated allowlist; these signed-in accounts see /admin (user roles,
# password resets, failed-run requeue, verification queue, usage stats).
# ADMIN_EMAILS=devaanand@umass.edu,matari@umass.edu

# ---- Database (persistent storage) ----
# Unset = SQLite under CCR_DATA_DIR (local dev; wiped on ephemeral hosts like HF Spaces).
# Set to a Postgres URL for durable storage. Supabase (free tier) recommended -
# use the "Session pooler" connection string from Project Settings > Database,
# and put your DB password in it. Accounts and all data then survive restarts.
# DATABASE_URL=postgresql://postgres.PROJECTREF:PASSWORD@aws-0-REGION.pooler.supabase.com:5432/postgres