.env.example

# RustyRed GraphDB — environment variables
#
# Copy to .env for local development; never commit .env itself. The
# Railway template prompts for these at deploy time; the values below
# are the production defaults the Dockerfile ships with.
#
# Source of truth: crates/rustyred-server/src/config.rs
# Full reference: README.md (Environment variable reference) + SECURITY.md
#
# Format note: variables grouped by purpose; the comment immediately
# above each variable describes its role and whether it is required.

# ============================================================
# Required for any reachable deployment
# ============================================================

# Comma-separated list of <secret>=<scope>|<scope>|... entries.
# Generate the secret with: openssl rand -hex 32
# Scopes: graph:read, graph:write, context:read, admin:read,
# federation:write, *
# REQUIRED when RUSTY_RED_REQUIRE_AUTH=true (the default).
RUSTY_RED_API_TOKENS=

# Refuse unauthenticated requests on search, crawl, federation, /v1/*,
# /mcp, and metrics. Keep true on any endpoint reachable from outside a
# trusted network.
RUSTY_RED_REQUIRE_AUTH=true

# Path to the persistent volume mount. Must match the volume's mount
# path on your platform. The service refuses to start without it when
# RUSTY_RED_REQUIRE_VOLUME=true.
RUSTY_RED_DATA_DIR=/app/data/rusty-red

# Refuse to start without a persistent volume. Keep true in production.
# On Railway, RAILWAY_VOLUME_MOUNT_PATH satisfies this automatically.
RUSTY_RED_REQUIRE_VOLUME=true

# ============================================================
# Networking
# ============================================================

# Bind address. [::] = all interfaces, IPv6 + IPv4.
RUSTY_RED_HOST=[::]

# Port. On Railway, the platform-provided PORT env var takes precedence
# over RUSTY_RED_PORT; leaving this unset is fine for Railway deploys.
# RUSTY_RED_PORT=8380

# Comma-separated CORS origin allowlist; empty disables CORS.
# RUSTY_RED_ALLOWED_ORIGINS=

# Public base URL; appears in the OpenAPI servers block.
# RUSTY_RED_PUBLIC_URL=

# ============================================================
# RustyWeb Web Commons federation
# ============================================================

# Enabled by default. Default crawls are federable unless request scope
# opts out; outbound submission happens only when hub URL + private key
# are set.
RUSTY_RED_FEDERATE=true

# Hub base URL or full /federate/submit URL.
# RUSTY_RED_FEDERATE_HUB_URL=

# Bearer token for the hub. Token needs federation:write on the hub.
# RUSTY_RED_FEDERATE_TOKEN=

# 32-byte Ed25519 private key as hex. Required to submit signed fragments.
# RUSTY_RED_FEDERATE_PRIVATE_KEY=

# Optional Ed25519 public key hex. If set, it must match the private key.
# RUSTY_RED_FEDERATE_PEER_ID=

# Include seeds, budget, and actor id in submitted fragments. Off by
# default so content+links can federate without seed-selection provenance.
RUSTY_RED_FEDERATE_PROVENANCE=false

# Bounded text prefix per federated content snapshot.
RUSTY_RED_FEDERATE_SNAPSHOT_TEXT_BYTES=4096

# ============================================================
# Storage mode and durability
# ============================================================

# embedded is the standalone product mode. redis is legacy compatibility
# only — not for new deployments and not used by the Railway template.
RUSTY_RED_MODE=embedded

# aof_always = synchronous AOF every write; aof_everysec = batch every 1s;
# none = no durability (memory only — only for ephemeral test deploys).
RUSTY_RED_DURABILITY=aof_everysec

# Writes between full snapshots. Lower = smaller AOF replay, more I/O.
RUSTY_RED_SNAPSHOT_INTERVAL_WRITES=1000

# Strict ACID mode. When true, requires:
#   RUSTY_RED_MODE=embedded
#   RUSTY_RED_DURABILITY=aof_always
#   RUSTY_RED_CONCURRENCY=single_writer
#   RUSTY_RED_TXN_ISOLATION=serializable
# RUSTY_RED_STRICT_ACID=false

# RUSTY_RED_CONCURRENCY=
# RUSTY_RED_TXN_ISOLATION=

# ============================================================
# Tenancy and branding
# ============================================================

# Per-tenant keyspace prefix. Stored data is segregated under
# <prefix>:<tenant_id>:...
RUSTY_RED_KEY_PREFIX=rusty-red:tenant

# Identifies the deployment in OpenAPI and .well-known/* metadata.
RUSTY_RED_SERVICE_NAME=rusty-red-graph-database
RUSTY_RED_API_TITLE="Rusty Red Graph Database API"

# Per-tenant byte ceiling for memory usage. Enforced for embedded and
# memory modes; not yet enforced for the redis legacy mode.
# RUSTY_RED_TENANT_MEMORY_QUOTA_BYTES=

# Startup-only per-tenant overrides; choose one form.
# RUSTY_RED_TENANT_CONFIG_PATH=
# RUSTY_RED_TENANT_CONFIG_JSON=

# ============================================================
# MCP agent port
# ============================================================

# Master switch for /mcp.
RUSTY_RED_MCP_ENABLED=true

# Read-only by default. Flip false to expose write tools (designate,
# bulk ingest). Token still needs graph:write scope.
RUSTY_RED_MCP_READ_ONLY=true

# Expose the admin tool surface. Token still needs admin:read scope.
RUSTY_RED_MCP_ALLOW_ADMIN=false

# Tenant assumed for MCP calls that do not specify one. If unset, the
# runtime falls back to the literal tenant ID "default" — set this
# explicitly in multi-tenant deployments to avoid routing surprises.
# RUSTY_RED_MCP_DEFAULT_TENANT=default

# ============================================================
# Observability
# ============================================================

# Slow-query threshold in nanoseconds. Engine default if unset.
# RUSTY_RED_SLOW_QUERY_NANOS=

# Ring buffer size for /v1/diagnostics/slow_queries. Must be > 0.
# RUSTY_RED_SLOW_QUERY_CAPACITY=

# Whether to log slow queries in addition to the ring buffer.
# RUSTY_RED_SLOW_QUERY_LOG=

# ============================================================
# Index backends (advanced)
# ============================================================

# Defaults to the bundled BM25; do not change unless you know the
# build feature is enabled.
# RUSTY_RED_FULLTEXT_BACKEND=

# h3 is the default. s2 is available behind the s2 build feature.
# RUSTY_RED_SPATIAL_BACKEND=h3

# ============================================================
# Legacy redis-mode compatibility (not used by the Railway template)
# ============================================================

# Only consulted when RUSTY_RED_MODE=redis. Has no effect on the
# standalone embedded template path.
# RUSTY_RED_REDIS_URL=

# Manual override for non-Railway deployments that mount the volume
# themselves. RAILWAY_VOLUME_MOUNT_PATH satisfies REQUIRE_VOLUME
# automatically on Railway.
# RUSTY_RED_VOLUME_MOUNTED=