.env.example

OPENROUTER_API_KEY=sk-or-your-key

# Named plug (recommended). Swap without touching code.
# Available: gemma-31b, gemma-26b, gpt-oss-20b, nemotron-nano,
#            nemotron-super, nemotron-ultra, laguna-m, north-code
# Avoid free-router for /query — it can pick guardrail models (non-JSON).
OPENROUTER_MODEL_PLUG=gemma-31b

# Optional: override the plug's primary OpenRouter model id
# OPENROUTER_MODEL=google/gemma-4-31b-it:free

# Optional: comma-separated fallbacks (OpenRouter model-layer failover)
# OPENROUTER_MODEL_FALLBACKS=openai/gpt-oss-20b:free,openrouter/free

# Neon / Postgres — sslmode is rewritten for asyncpg automatically
DATABASE_URL=postgresql://user:password@host/dbname?sslmode=require

QDRANT_URL=https://your-cluster.qdrant.io:6333
QDRANT_API_KEY=
QDRANT_COLLECTION=documents

STORAGE_BACKEND=supabase

# JWT secret from Supabase (Legacy JWT secret). Used only for HS256 tokens.
# Projects on JWT Signing Keys (ES256/RS256) verify via JWKS using SUPABASE_URL.
SUPABASE_JWT_SECRET=
# Project URL — required for asymmetric JWT verification (JWKS).
# Example: https://YOUR_PROJECT.supabase.co
SUPABASE_URL=
# Local/test-only opt-out when no JWT secret is configured. Never enable in production.
SENTINELAI_AUTH_DISABLED=0
# Comma-separated origins for the Dashboard web app (CORS).
# Required for browser preflight (OPTIONS) from the Dashboard.
# Leave unset in production until the Dashboard origin is known.
SENTINELAI_DASHBOARD_ORIGINS=http://localhost:3000