.env.example

# ═══════════════════════════════════════════════════════════
# Crow AI Platform — Environment Variables
# ═══════════════════════════════════════════════════════════
#
# ZERO CONFIG REQUIRED for core features.
# Memory, research, sharing, and blog all work immediately
# after 'npm run setup'. No API keys needed.
#
# Only edit this file to:
#   - Add integrations (GitHub, Slack, Gmail, etc.)
#   - Enable file storage (requires MinIO)
#   - Deploy to the cloud
#
# After editing, run: npm run mcp-config

# ── INTERNAL (auto-configured by setup — usually leave these alone) ──

# Local SQLite database path (default: ~/.crow/data/crow.db)
CROW_DB_PATH=./data/crow.db

# Root directory the filesystem server can access (only needed if using filesystem integration)
CROW_FILES_PATH=/home

# Device identity for per-device crow.md customization (e.g., "grackle", "laptop")
# When set, device-specific context overrides are applied to MCP instructions.
# CROW_DEVICE_ID=

# ── INTEGRATIONS (all optional — add one at a time as needed) ──

# GitHub — https://github.com/settings/tokens
# Scopes: repo, read:org, read:user, issues, pull_requests
# GITHUB_PERSONAL_ACCESS_TOKEN=

# Brave Search — https://brave.com/search/api/
# BRAVE_API_KEY=

# Google Workspace — https://console.cloud.google.com/apis/credentials
# Create OAuth 2.0 Client ID (Desktop App). Enable Gmail, Calendar, Docs, Sheets, Slides APIs.
# GOOGLE_CLIENT_ID=
# GOOGLE_CLIENT_SECRET=

# Notion — https://www.notion.so/my-integrations
# Create integration, copy Internal Integration Secret, share pages with it.
# NOTION_TOKEN=

# Slack — https://api.slack.com/apps
# Scopes: channels:history, channels:read, chat:write, users:read
# SLACK_BOT_TOKEN=

# Trello — https://trello.com/power-ups/admin
# TRELLO_API_KEY=
# TRELLO_TOKEN=

# Canvas LMS — Account > Settings > New Access Token
# CANVAS_API_TOKEN=
# CANVAS_BASE_URL=https://your-institution.instructure.com

# Zotero — https://www.zotero.org/settings/keys
# ZOTERO_API_KEY=
# ZOTERO_USER_ID=

# Discord — https://discord.com/developers/applications
# Enable Message Content Intent under Bot settings
# DISCORD_BOT_TOKEN=

# Microsoft Teams (experimental) — https://portal.azure.com/#view/Microsoft_AAD_RegisteredApps
# Graph permissions: Chat.Read, ChannelMessage.Read.All, ChannelMessage.Send
# TEAMS_CLIENT_ID=
# TEAMS_CLIENT_SECRET=
# TEAMS_TENANT_ID=

# Obsidian — Path to your Obsidian vault directory
# OBSIDIAN_VAULT_PATH=/path/to/your/vault

# Home Assistant — https://www.home-assistant.io/docs/authentication/
# Create a long-lived access token in HA: Profile → Security → Long-lived access tokens
# HA_URL=http://homeassistant.local:8123
# HA_TOKEN=

# Immich — https://immich.app/docs/features/command-line-interface#obtain-the-api-key
# IMMICH_URL=http://localhost:2283
# IMMICH_API_KEY=

# Ollama — https://ollama.com
# OLLAMA_HOST=http://localhost:11434

# Nextcloud — WebDAV file access
# NEXTCLOUD_URL=http://localhost:8080
# NEXTCLOUD_USER=admin
# NEXTCLOUD_PASSWORD=
# NEXTCLOUD_MOUNT_PATH=/mnt/nextcloud

# arXiv — No API key needed, just enable
# CROW_ENABLE_ARXIV=1

# MCP Research — No API key needed, just enable
# CROW_ENABLE_MCP_RESEARCH=1

# Render — https://dashboard.render.com/account/api-keys
# RENDER_API_KEY=

# ── AI PROVIDER (BYOAI — Bring Your Own AI) ──────────────

# Configure an AI provider to enable the built-in AI Chat in the Crow's Nest.
# Supports: openai, anthropic, google, ollama, openrouter, meta
# AI_PROVIDER=openai
# AI_API_KEY=sk-...
# AI_MODEL=gpt-4o
# AI_BASE_URL=                  # Only needed for Ollama, OpenRouter, or custom endpoints

# ── STORAGE (S3-compatible, MinIO) ────────────────────────

# MinIO/S3 endpoint (set to enable storage server)
# MINIO_ENDPOINT=localhost
# MINIO_PORT=9000
# MINIO_ROOT_USER=crowadmin
# MINIO_ROOT_PASSWORD=
# MINIO_USE_SSL=false

# Override for external S3-compatible storage
# S3_ENDPOINT=
# S3_ACCESS_KEY=
# S3_SECRET_KEY=

# Upload limits
# MAX_UPLOAD_SIZE=104857600
# STORAGE_QUOTA_MB=5120

# ── CROW'S NEST ──────────────────────────────────────────

# Set to true to allow Crow's Nest access from non-local IPs
# CROW_DASHBOARD_PUBLIC=false

# ── WEB PUSH (PWA notifications) ─────────────────────────

# Generate keys: npx web-push generate-vapid-keys
# VAPID_PUBLIC_KEY=
# VAPID_PRIVATE_KEY=
# VAPID_EMAIL=mailto:your@email.com

# ── GATEWAY (remote/mobile access) ───────────────────────

# Port the gateway listens on (default: 3001)
# CROW_GATEWAY_PORT=3001

# Your deployed gateway URL (set after deploying to Oracle Cloud, Pi, etc.)
# CROW_GATEWAY_URL=

# CORS allowed origin (e.g. https://your-app.com) — leave unset to block all cross-origin
# CORS_ALLOWED_ORIGINS=

# OAuth credentials (auto-generated if not set)
# CROW_OAUTH_CLIENT_ID=
# CROW_OAUTH_CLIENT_SECRET=

# Cloudflare Tunnel token (for local network deployment only)
# CLOUDFLARE_TUNNEL_TOKEN=

# ── CADDY (reverse proxy bundle, PR 0.5) ─────────────────

# Email address registered with Let's Encrypt for ACME cert issuance and
# renewal notices. Required if caddy bundle is installed.
# CADDY_EMAIL=you@example.com

# Admin API URL — Crow's MCP server uses this to reload/inspect Caddy.
# Defaults to http://127.0.0.1:2019 (matches docker-compose.yml in caddy bundle).
# CADDY_ADMIN_URL=http://127.0.0.1:2019

# Directory holding Caddyfile, data/ (ACME state, mode 0700), and config/.
# Defaults to ~/.crow/caddy. Mounted into the caddy container.
# CADDY_CONFIG_DIR=~/.crow/caddy

# ── ADGUARD HOME (PR 3 — DNS ad blocker) ─────────────────

# Admin URL. Defaults to http://localhost:3020.
# ADGUARD_URL=http://localhost:3020

# Credentials set during the first-run wizard at localhost:3020.
# ADGUARD_USERNAME=
# ADGUARD_PASSWORD=

# Optional: override the bind-mount base path (default ~/.crow/adguard-home).
# ADGUARD_CONFIG_DIR=~/.crow/adguard-home

# ── GITEA (self-hosted git) ──────────────────────────────

# Web UI on port 3040, SSH on port 2223 (built-in Go SSH server).
# Complete the first-run setup wizard at http://localhost:3040, then
# generate a personal access token under Settings > Applications.
# GITEA_URL=http://localhost:3040
# GITEA_TOKEN=

# ── FORGEJO (community-driven git) ───────────────────────

# Web UI on port 3050, SSH on port 2224. API-compatible with Gitea.
# Same setup flow: wizard -> admin user -> personal access token.
# FORGEJO_URL=http://localhost:3050
# FORGEJO_TOKEN=

# ── VAULTWARDEN (password manager) ───────────────────────

# Bitwarden-compatible server on port 8097. Use the official Bitwarden
# browser extension / mobile app as the client.
# Generate ADMIN_TOKEN with: openssl rand -base64 48
# VAULTWARDEN_URL=http://localhost:8097
# VAULTWARDEN_ADMIN_TOKEN=
# VAULTWARDEN_DOMAIN=http://localhost:8097
# VAULTWARDEN_SIGNUPS_ALLOWED=true

# ── SEARXNG (metasearch) ─────────────────────────────────

# Privacy-respecting metasearch on port 8098. Config in ~/.crow/searxng/.
# Leave SECRET_KEY empty to let the entrypoint generate one on first boot.
# SEARXNG_BASE_URL=http://localhost:8098/
# SEARXNG_SECRET_KEY=

# ── NETDATA (observability bundle, PR 2) ─────────────────

# Netdata agent URL (host-local). Defaults to http://localhost:19999.
# NETDATA_URL=http://localhost:19999

# ── DOZZLE (container log viewer, PR 2) ──────────────────

# Dozzle URL (host-local). Defaults to http://localhost:8095.
# DOZZLE_URL=http://localhost:8095

# ── CROWDSEC (intrusion detection, PR 4) ─────────────────

# Local API URL. Bound to 127.0.0.1:8091 by the compose file so only host
# processes (or a bouncer via reverse proxy) can reach it.
# CROWDSEC_LAPI_URL=http://127.0.0.1:8091

# Bouncer API key. Generate on first boot with:
#   docker exec crow-crowdsec cscli bouncers add crow-mcp
# Tools will error with a clear message until this is set.
# CROWDSEC_API_KEY=

# Config & data bind-mount base (defaults to ~/.crow/crowdsec).
# CROWDSEC_CONFIG_DIR=~/.crow/crowdsec

# ── UPTIME KUMA (monitoring bundle, PR 1) ────────────────

# Uptime Kuma base URL (published on 127.0.0.1:3007 by the bundle).
# UPTIMEKUMA_URL=http://localhost:3007

# Admin credentials — used ONLY for the Prometheus /metrics basic auth.
# Create the admin account via the web UI first-run wizard, then set these.
# UPTIMEKUMA_USERNAME=admin
# UPTIMEKUMA_PASSWORD=change-me

# ── STIRLING PDF (productivity bundle, PR 1) ─────────────

# Stirling PDF base URL (published on 127.0.0.1:8092 by the bundle).
# Stirling 2.x includes a login form; create the admin user on first visit.
# STIRLING_URL=http://localhost:8092

# ── CHANGE DETECTION (automation bundle, PR 1) ───────────

# changedetection.io base URL (published on 127.0.0.1:5010 by the bundle).
# CHANGEDETECTION_URL=http://localhost:5010

# API key — create in the web UI under Settings > API, then paste here.
# CHANGEDETECTION_API_KEY=

# ── HOMEPAGE (productivity bundle, PR 1) ─────────────────

# Homepage base URL (published on 127.0.0.1:3030 by the bundle).
# HOMEPAGE_URL=http://localhost:3030

# Comma-separated host:port list Homepage will accept as Host header.
# Add your Tailscale/LAN hostnames if reaching Homepage from another device.
# HOMEPAGE_ALLOWED_HOSTS=localhost:3030

# Directory holding services.yaml / widgets.yaml / bookmarks.yaml / settings.yaml.
# HOMEPAGE_CONFIG_DIR=~/.crow/homepage