.env.example

# Copy to .env and adjust for your environment.
APP_ENVIRONMENT=development
APP_NAME="BRIDGE Modul - X"
APP_VERSION="2.1.0"
DEBUG=true
SECRET_KEY=replace-with-a-random-secret
HOST=0.0.0.0
PORT=8000
WORKERS=4

# Supabase (server-side service-role key; never expose it to the browser)
SUPABASE_URL=https://YOUR_PROJECT_REF.supabase.co
SUPABASE_ANON_KEY=your-public-anon-key
SUPABASE_SERVICE_ROLE_KEY=your-server-only-service-role-key
ENABLE_DB_PERSISTENCE=true
LICENSE_ENFORCEMENT=false

# Local development defaults
DATABASE_URL=sqlite+aiosqlite:///./emailval.db
REDIS_URL=redis://localhost:6379/0
REDIS_CACHE_TTL=86400
CELERY_BROKER_URL=redis://localhost:6379/1
CELERY_RESULT_BACKEND=redis://localhost:6379/2

# For Upstash, use TLS and database index /0:
# REDIS_URL=rediss://default:YOUR_REDIS_TOKEN@YOUR_ENDPOINT:6379/0
# CELERY_BROKER_URL=rediss://default:YOUR_REDIS_TOKEN@YOUR_ENDPOINT:6379/0
# CELERY_RESULT_BACKEND=rediss://default:YOUR_REDIS_TOKEN@YOUR_ENDPOINT:6379/0
# Never disable TLS certificate verification. Upstash Free has one database;
# prove Celery key-prefix isolation and compatibility before sharing it, or
# use separate provisioned databases/a suitable paid plan for production jobs.
# The app does not need the Upstash Developer API key. Keep it out of runtime
# environment variables; use it only from a restricted operator workflow.

CORS_ORIGINS=["http://localhost:5173","http://localhost:3000","http://127.0.0.1:5173"]
SMTP_TIMEOUT=10
DNS_TIMEOUT=5
MAX_BULK_EMAILS=10000
RATE_LIMIT_PER_MINUTE=60
USE_PROXIES=false

# --- Mailbox verification engine (Layers 5 + 6) — FULLY AUTONOMOUS ---
# The validator probes recipient MX servers with its own connection-reusing
# SMTP engine. NO third-party verification API, NO vendor key, NO per-check
# fee — the former MillionVerifier delegation was removed in v3.0.0.
#
# IMPORTANT: port 25 must be open outbound. Most cloud PaaS (Hugging Face
# Spaces, AWS Lambda, Cloudflare Workers) BLOCK it. If outbound 25 is blocked,
# the engine still runs but reports every mailbox as smtp_unreachable (honest
# "risky", refunded) — it will never fake a verdict. Two fixes:
#   1) run the orchestrator on a VPS with port-25 egress, or
#   2) keep the orchestrator where it is and point SMTP_WORKER_URL at a
#      port-25-capable host running this same image (spec §3.3 worker role).
MAILBOX_PROVIDER=auto          # auto | local(=autonomous) | remote
# Remote SMTP probe worker (spec §3.3). Empty = built-in engine on this host.
# Example: https://smtp-worker.example.com (a deployment of this image)
SMTP_WORKER_URL=
# Shared secret required on POST /api/v1/smtp/probe* (X-Worker-Token header).
# Set the SAME value on the worker and on the orchestrator.
SMTP_WORKER_TOKEN=
SMTP_WORKER_TIMEOUT=15

# --- DNS-over-HTTPS worker (spec §3.2) ---
# MX resolution on free public resolvers (Google + Cloudflare) with a
# dual-resolver consistency check (dns_inconsistent risk signal). Free,
# unlimited, no auth; legacy dnspython path stays as automatic fallback.
DOH_ENABLED=true
DOH_TIMEOUT=5

# --- AI Risk Scorer (spec §3.4 — LOCAL inference, zero external credits) ---
# Part B architecture migration: the Hugging Face Inference API path was
# REMOVED. The model id names a public HF Hub checkpoint whose weights are
# pulled once (free, unmetered — Hub downloads are not Inference API calls)
# and then run in-process via a transformers pipeline. No token exists in
# this deployment surface; the Dockerfile pre-seeds HF_HOME so a running
# container makes zero network calls for scoring.
# Empty disables inference: the built-in rule-based heuristic then scores
# every ambiguous address (catch-all / unknown) at zero marginal cost, and
# every verdict it decides is marked fallback_used=true. The circuit breaker
# opens on model-load failure or repeated inference errors and the engine
# degrades gracefully — never blocks.
AI_SCORER_MODEL=typeform/distilbert-base-uncased-mnli
AI_SCORER_ZERO_SHOT=true
AI_SCORER_TIMEOUT=12
# Master switch: false forces heuristic-only scoring (no model load at all).
AI_SCORER_LOCAL=true
# Repeated PII-free feature strings never re-invoke the model inside this
# TTL window (spec §2.2). 0 disables the score cache.
AI_SCORE_CACHE_TTL_SECONDS=3600
AI_CIRCUIT_FAIL_THRESHOLD=3
AI_CIRCUIT_COOLDOWN_SECONDS=300

# SMTP identity used in the probe dialogue. Use a real, resolvable hostname with
# a matching PTR record on a production host — strict receivers reject generic
# HELO names and that degrades accuracy.
SMTP_HELO_DOMAIN=validator.local
SMTP_MAIL_FROM=probe@validator.local

# Catch-all is a domain property: cache the verdict for 72h.
CATCH_ALL_TTL_SECONDS=259200
# Per-MX-host session cap and overall bulk concurrency.
MAX_CONNECTIONS_PER_HOST=2
BULK_CONCURRENCY=20