# Minimal .env for EC2 deployment.
# Copy to .env in repo root (or export vars) before running:
#   make deploy
#   make destroy
#
# Provisions one EC2 instance with opensre-web and opensre-gateway containers.
# NEVER commit a file with real credentials.
# See also: .env.example for the full application env reference.

# ─── AWS SDK (EC2 / ECR / SSM provisioning) ──────────────────────────────────
# Use static keys or a cross-account role (not both).

# Option A: static credentials
AWS_REGION=us-east-1
AWS_ACCESS_KEY_ID=your_access_key_id
AWS_SECRET_ACCESS_KEY=your_secret_access_key
# AWS_SESSION_TOKEN=optional_session_token

# Option B: cross-account role
# AWS_REGION=us-east-1
# AWS_ROLE_ARN=arn:aws:iam::123456789012:role/YourDeployRole
# AWS_EXTERNAL_ID=optional_external_id

# ─── Gateway deploy (make bake-gateway / make deploy-gateway) ───────────────
# Optional: git ref (commit SHA, tag, or branch) to bake into the gateway AMI.
# Defaults to the local git HEAD commit SHA at bake time.
# The ref must exist on GitHub — push your branch/commit before baking.
# OPENSRE_GATEWAY_GIT_REF=main

# Optional: skip baking by providing an existing AMI id directly.
# OPENSRE_GATEWAY_AMI_ID=ami-0abc123456789def0

# Optional: set to 1 to also deregister the AMI when running make destroy-gateway.
# OPENSRE_GATEWAY_DESTROY_PURGE_AMI=1

# Optional: personal suffix to isolate your resources from teammates in a shared AWS account.
# Set to your username or initials (e.g. joe, alice). All AWS resources (EC2 instance,
# IAM role/profile, ECR repo, container names) will be named with this suffix.
# Without this, all developers share the same resource names and will conflict.
# OPENSRE_STACK_SUFFIX=joe

# Optional: fail instead of auto-destroying when a prior deploy is still recorded.
# OPENSRE_DEPLOY_ABORT_IF_EXISTS=1

# Optional: override which key pair is attached to the instance for SSH debug access.
# Leave unset — SSM Run Command is used for gateway checks (no key pair required).
# EC2_KEY_NAME=your-key-pair-name

# ─── Telegram (gateway container) ─────────────────────────────────────────────
TELEGRAM_BOT_TOKEN=your_bot_token_here

# Comma-separated Telegram user IDs permitted to DM the bot.
# Get your ID from @userinfobot.
TELEGRAM_ALLOWED_USERS=123456789

# ─── LLM provider ─────────────────────────────────────────────────────────────
# Set one of: openai | anthropic | bedrock
LLM_PROVIDER=openai

# OpenAI
OPENAI_API_KEY=sk-...

# Anthropic (alternative)
# LLM_PROVIDER=anthropic
# ANTHROPIC_API_KEY=sk-ant-...
# ANTHROPIC_MODEL=claude-sonnet-4-5