.env-sample

# Bayanat
FLASK_APP=run.py
# must be always set to 0 in production deployments
FLASK_DEBUG=0

# should leave as default
POSTGRES_DB=bayanat

# Uncomment the following lines if you're deploying with Docker
# or need to supply these information, e.g. postgres or redis are
# installed on a separate host or require authentication.
# Otherwise you can leave commented.

# should leave as default
# POSTGRES_USER= 
# generate secure password and setup psql accordinngly 
# POSTGRES_PASSWORD= 
# use postgres for docker, otherwise add ip/domain name
# POSTGRES_HOST= 
# same as above, redis for docker, or ip/domain name
# REDIS_HOST= 
# generate secure password and setup redis accordinngly 
# REDIS_PASSWORD= 
# REDIS_AOF_ENABLED=no 
# MEDIA_PATH= # use to point to 

# Secrets
# generate using 'openssl rand -base64 32'
SECRET_KEY='' 
# generate using 'openssl rand -base64 32'
SECURITY_PASSWORD_SALT='' 

# 2FA
# generate using 'openssl rand -base64 32'
SECURITY_TOTP_SECRETS=''
SECURITY_TWO_FACTOR=True
SECURITY_TWO_FACTOR_RESCUE_MAIL=''
SECURITY_TWO_FACTOR_AUTHENTICATOR_VALIDITY=90

# Secure cookies
# Requires SSL to work properly
# Should be set to true in prod envs
# Can be switched off in dev envs
SECURE_COOKIES=True

# Security Headers
# Enable Content Security Policy (CSP) protection
# Disabled by default, enable in production after testing
CSP_ENABLED=False
# Force HTTPS redirects (enable in production with SSL)
FORCE_HTTPS=False
# Optional: Run CSP in report-only mode for testing (requires CSP_REPORT_URI)
# CSP_REPORT_ONLY=False
# Optional: URI to receive CSP violation reports
# CSP_REPORT_URI=

# Logging
APP_LOG_ENABLED=True
CELERY_LOG_ENABLED=True
LOG_LEVEL=INFO
LOG_DIR=logs
LOG_FILE=bayanat.log
LOG_BACKUP_COUNT=10

# Backups
# Backups of Bayanat's database can be taken on a 
# specific interval set below. Backups can be stored
# locally or uploaded to an S3 bucket
BACKUPS=0
# set interval of backups every x days
BACKUP_INTERVAL=1
# local directory to store backups, default backups/
BACKUPS_LOCAL_PATH=''
# S3 settings, if active backups will be uploaded to S3 bucket
BACKUPS_S3_BUCKET=''
BACKUPS_AWS_ACCESS_KEY_ID=''
BACKUPS_AWS_SECRET_ACCESS_KEY=''
BACKUPS_AWS_REGION=''

# OCR Provider: google_vision or llm
# OCR_PROVIDER=google_vision

# Google Vision: just set the API key
# GOOGLE_VISION_API_KEY=

# LLM: set provider + url + model (+ api key if authenticated)
# Any OpenAI-compatible /v1/chat/completions endpoint works
# LLM_OCR_URL=http://localhost:11434
# LLM_OCR_MODEL=llava
# LLM_OCR_API_KEY=
#
# Examples:
#
# Ollama (local):
#   LLM_OCR_URL=http://localhost:11434
#   LLM_OCR_MODEL=llava
#
# RunPod Serverless:
#   LLM_OCR_URL=https://api.runpod.ai/v2/{endpoint_id}/openai
#   LLM_OCR_MODEL=your-model
#   LLM_OCR_API_KEY=your-runpod-key
#
# RunPod Pod:
#   LLM_OCR_URL=https://{pod_id}-8000.proxy.runpod.net
#   LLM_OCR_MODEL=your-model
#
# OpenAI:
#   LLM_OCR_URL=https://api.openai.com
#   LLM_OCR_MODEL=gpt-4o
#   LLM_OCR_API_KEY=sk-...
#
# OpenRouter (any model including Claude):
#   LLM_OCR_URL=https://openrouter.ai/api
#   LLM_OCR_MODEL=anthropic/claude-sonnet-4-20250514
#   LLM_OCR_API_KEY=sk-or-...