.env.example

# =============================================================================
# .env.example — Secrets, URLs, and runtime variables for synapse
#
# Copy to .env and fill in real values:
#   cp .env.example .env
# .env is in .gitignore — never commit it.
#
# SPLIT PHILOSOPHY:
#   .env         → secrets, URLs, and deploy/runtime variables (THIS FILE)
#   config.toml  → everything else: bind host/port, feature flags, auth tuning,
#                  timeouts, rate limits, log retention. See config.example.toml.
#
# Loaded from the service appdata dir (~/.synapse/ on bare-metal, /data in
# Docker) and the current directory. Appdata wins over current directory; existing
# process env vars always take final priority.
#
# Host topology (the SSH/Docker fleet) is NOT configured here — it is
# auto-discovered from ~/.ssh/config. See config.example.toml for details.
# =============================================================================

# ── MCP auth secret ───────────────────────────────────────────────────────────
# Static bearer token MCP clients must present: Authorization: Bearer <token>
# Generate with: openssl rand -hex 32   or   just gen-token
# Omit only for loopback dev (SYNAPSE_MCP_NO_AUTH=true in config.toml).
SYNAPSE_MCP_TOKEN=replace-with-openssl-rand-hex-32
# Trusted gateway deployments may intentionally let an upstream proxy enforce
# auth/authz instead of the server. Do not enable this with a directly published
# port unless that proxy is the only reachable path.
# SYNAPSE_NOAUTH=false

# ── OAuth (Google) — only when [mcp.auth] mode = "oauth" in config.toml ────────
# Public URL of this server (OAuth issuer / resource metadata). Must be reachable
# from clients and use HTTPS except for loopback development. Userinfo and
# wildcard hosts are rejected.
# SYNAPSE_MCP_PUBLIC_URL=https://synapse.example.com
# Google OAuth 2.0 credentials (secret — never commit real values).
# SYNAPSE_MCP_GOOGLE_CLIENT_ID=123456789-abcdefg.apps.googleusercontent.com
# SYNAPSE_MCP_GOOGLE_CLIENT_SECRET=GOCSPX-your-secret-here
# Bootstrap admin email — first Google account allowed to authenticate.
# SYNAPSE_MCP_AUTH_ADMIN_EMAIL=admin@example.com
# Optional auth storage and tuning overrides. Match [mcp.auth] in config.toml.
# SYNAPSE_MCP_AUTH_SQLITE_PATH=/data/auth.db
# SYNAPSE_MCP_AUTH_KEY_PATH=/data/auth-jwt.pem
# SYNAPSE_MCP_AUTH_ACCESS_TOKEN_TTL_SECS=3600
# SYNAPSE_MCP_AUTH_REFRESH_TOKEN_TTL_SECS=2592000
# SYNAPSE_MCP_AUTH_CODE_TTL_SECS=300
# SYNAPSE_MCP_AUTH_REGISTER_REQUESTS_PER_MINUTE=10
# SYNAPSE_MCP_AUTH_AUTHORIZE_REQUESTS_PER_MINUTE=60
# SYNAPSE_MCP_AUTH_DISABLE_STATIC_TOKEN_WITH_OAUTH=true
# SYNAPSE_MCP_AUTH_ALLOWED_REDIRECT_URIS=

# ── Deploy / runtime (read by docker-compose, not the binary) ─────────────────
# Published image tag and host port.
# Pin a release or sha-<commit> tag for deterministic rollout and rollback.
# SYNAPSE_VERSION=0.5.4
# SYNAPSE_MCP_HOST_PORT=40080
# External Docker network name (must already exist: docker network create mcp).
# DOCKER_NETWORK=mcp
# Host UID/GID used by the container after entrypoint permission repair.
# PUID=1000
# PGID=1000
# Host's docker group id, granting the container access to the mounted socket.
# Find it with:  getent group docker | cut -d: -f3
DOCKER_GID=replace-with-host-docker-gid

# ── Logging ───────────────────────────────────────────────────────────────────
# RUST_LOG=info
# RUST_LOG=info,rmcp=warn,synapse=debug
# Emit JSON on stderr. HTTP server mode always writes rotating JSON file logs.
# LOG_FORMAT=json
# Disable ANSI color in console output.
# NO_COLOR=1
# Force ANSI color even when stderr is not a TTY.
# FORCE_COLOR=1