.env.example

DATABASE_URL=postgresql://sentinel:sentinel@localhost:5432/sentinellm
REDIS_URL=redis://localhost:6379/0
SENTINEL_CONFIG_PATH=config.yaml
SENTINEL_ENV=development

# Security — set in production
# SENTINEL_API_KEY=your-secret-api-key  # enforces X-API-Key on all requests when set
# SENTINEL_CORS_ORIGINS=https://your-dashboard.example.com  # comma-separated allowed origins

# Multi-tenancy — SENTINEL_API_KEY above always keeps working unchanged (it's
# attached to a "default" tenant automatically). To add more tenants with
# their own isolated data, use the CLI instead of an env var:
#   sentinel tenant create-tenant --name "Acme Corp" --slug acme
#   sentinel tenant create-key --tenant acme --label "prod key"

# Observability — tracing is opt-in via a standard OTLP endpoint (works with
# any backend: Honeycomb, Grafana Cloud, self-hosted Jaeger, ...). Unset = a
# no-op tracer, zero cost.
# OTEL_EXPORTER_OTLP_ENDPOINT=http://localhost:4318/v1/traces
# OTEL_EXPORTER_OTLP_HEADERS=api-key=your-otlp-backend-key
# OTEL_SERVICE_NAME=sentinellm-api

# Alerting — a Slack incoming webhook URL (or any endpoint accepting
# {"text": "..."}) for threshold-breach notifications. Alerting still runs
# with this unset; it just logs instead of posting. See config.yaml's
# observability.alerting section for thresholds.
# SENTINEL_ALERT_WEBHOOK_URL=https://hooks.slack.com/services/...

# Cloud LLM providers — set only the one matching llm_backend.provider in config.yaml
# OPENAI_API_KEY=sk-...
# ANTHROPIC_API_KEY=sk-ant-...
# GEMINI_API_KEY=AIza...

# Dashboard — used only with docker-compose.prod.yml. Must be the dashboard's
# public-facing URL (what a browser can reach), NOT the Docker-internal
# `http://api:8000` — that hostname only resolves inside the compose network.
# Baked into the Next.js client bundle at build time (see docker/Dockerfile.dashboard),
# so these must be set BEFORE `docker compose -f docker-compose.prod.yml up --build`.
# NEXT_PUBLIC_API_URL=https://api.your-domain.example.com
# NEXT_PUBLIC_WS_URL=wss://api.your-domain.example.com