.env.example

# Server
AVP_DATABASE_URL=postgresql://avp:avp@postgres:5432/avp
AVP_HOST=0.0.0.0
AVP_PORT=8000
AVP_DEV_MODE=true

# Crypto
# 32 bytes base64 urlsafe without padding is fine, example shown
AVP_DEK_B64=AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AVP_KEY_VERSION=local-1

# Key rotation (optional): JSON map of key_version -> base64 DEK.
# New secrets encrypt under AVP_KEY_VERSION; old versions stay decryptable.
# AVP_DEK_KEYRING_B64={"local-1": "<b64>", "local-2": "<b64>"}

# AWS KMS provider (optional): store only KMS-wrapped DEKs in env.
# Generate with: python server/scripts/wrap_dek.py --kms-key-id alias/avp
# AVP_KEY_PROVIDER=aws_kms
# AVP_KMS_KEY_ID=alias/avp
# AVP_KMS_WRAPPED_DEK_B64=<wrapped>
# AVP_KMS_WRAPPED_KEYRING_B64={"kms-1": "<wrapped>", "kms-2": "<wrapped>"}

# Proxy
AVP_OPENAI_BASE_URL=https://api.openai.com/v1