.env.example

# Google Drive MCP Server Environment Variables

# Required: Encryption key for secure token storage (32-byte base64-encoded)
# Generate with: openssl rand -base64 32
GDRIVE_TOKEN_ENCRYPTION_KEY=

# Optional: Additional encryption keys for key rotation (32-byte base64-encoded)
# Uncomment and set these when rotating keys
# GDRIVE_TOKEN_ENCRYPTION_KEY_V2=
# GDRIVE_TOKEN_ENCRYPTION_KEY_V3=
# GDRIVE_TOKEN_ENCRYPTION_KEY_V4=

# Optional: Current key version to use for encryption (default: v1)
# GDRIVE_TOKEN_CURRENT_KEY_VERSION=v1

# Optional: Token refresh configuration
GDRIVE_TOKEN_REFRESH_INTERVAL=1800000  # 30 minutes (in milliseconds)
GDRIVE_TOKEN_PREEMPTIVE_REFRESH=600000  # 10 minutes before expiry (in milliseconds)
GDRIVE_TOKEN_MAX_RETRIES=3             # Maximum retry attempts for token refresh
GDRIVE_TOKEN_RETRY_DELAY=1000          # Initial retry delay (in milliseconds)

# Optional: File paths (defaults shown)
# GDRIVE_TOKEN_STORAGE_PATH=~/.gdrive-mcp-tokens.json
# GDRIVE_TOKEN_AUDIT_LOG_PATH=~/.gdrive-mcp-audit.log
# GDRIVE_CREDENTIALS_PATH=~/.gdrive-server-credentials.json
# GDRIVE_OAUTH_PATH=./gcp-oauth.keys.json

# Optional: PAI contact resolution for Calendar module
# Set this to enable resolving contact names (e.g., "Mary") to email addresses
# Without this, all attendee inputs are treated as raw email addresses
# PAI_CONTACTS_PATH=/path/to/your/CONTACTS.md

# Optional: Logging configuration
LOG_LEVEL=info  # Options: error, warn, info, debug, verbose

# Optional: Redis configuration
REDIS_URL=redis://localhost:6379

# Optional: Health check
GDRIVE_TOKEN_HEALTH_CHECK=true

# MCP Transport Configuration
# Transport mode: 'stdio' (default) or 'http' for Streamable HTTP
MCP_TRANSPORT=stdio

# HTTP Server Configuration (used when MCP_TRANSPORT=http)
MCP_HTTP_HOST=127.0.0.1        # Bind address for HTTP server
MCP_HTTP_PORT=8788             # Port for HTTP server
MCP_HTTP_PATH=/mcp             # Endpoint path for MCP requests

# Security Configuration (recommended for remote deployments)
# Comma-separated list of allowed origins (e.g., "https://example.com,https://app.example.com")
# Leave empty to allow all origins (not recommended for production)
MCP_ALLOWED_ORIGINS=

# Optional: Bearer token for authentication (recommended for remote deployments)
# If set, requests must include: Authorization: Bearer <token>
# Leave empty to disable bearer authentication
MCP_BEARER_TOKEN=

# Cloudflare Workers Configuration (for Cloudflare deployment)
# Cloudflare API credentials for wrangler CLI and deployments
# Get Account ID from Cloudflare dashboard: https://dash.cloudflare.com/
CLOUDFLARE_ACCOUNT_ID=

# API Token (preferred) - Create at: https://dash.cloudflare.com/profile/api-tokens
# Requires: Account.Cloudflare Workers:Edit permissions
CLOUDFLARE_API_TOKEN=

# Legacy API credentials (use API_TOKEN instead if possible)
# CLOUDFLARE_API_KEY=
# CLOUDFLARE_EMAIL=

# Cloudflare KV Namespace ID (for token/cache storage in Workers)
# Create namespace: wrangler kv:namespace create "GDRIVE_KV"
# Then set the ID here (or configure in wrangler.toml)
CLOUDFLARE_KV_NAMESPACE_ID=

# Google OAuth credentials (for Workers deployment)
# These are used when deploying to Cloudflare Workers instead of local credential files
# Set via 'wrangler secret put' for production, or use .env for local dev
GOOGLE_CLIENT_ID=
GOOGLE_CLIENT_SECRET=
GOOGLE_REFRESH_TOKEN=

# Docker-specific paths (automatically set in docker-compose.yml)
# These are for reference - do not set these manually when using Docker
# GDRIVE_CREDENTIALS_PATH=/credentials/.gdrive-server-credentials.json
# GDRIVE_OAUTH_PATH=/credentials/gcp-oauth.keys.json
# GDRIVE_TOKEN_STORAGE_PATH=/credentials/.gdrive-mcp-tokens.json
# GDRIVE_TOKEN_AUDIT_LOG_PATH=/app/logs/gdrive-mcp-audit.log