.env.example

# LeadForge configuration — EVERYTHING below is optional.
#
# Zero-config: skip this file entirely and LeadForge runs on SQLite
# (leadforge.db, created on first boot). That is the default path and
# the recommended one for local development.
#
# Where to put the file:
#   * backend/.env  -> read by the FastAPI backend / MCP server / CLI
#   * ./.env        -> read by `docker compose` for variable substitution only
#
# NOTE: values are taken literally from your shell environment — there is no
# ${VAR} interpolation inside this file. Write literal values.

# --- Database ---------------------------------------------------------------
# SQLite (default) — leave DATABASE_URL unset to use ./leadforge.db.
#
# Postgres (docker compose sets this for you; for bare metal use a literal URL):
# DATABASE_URL=postgresql+asyncpg://leadforge:your_password@localhost:5432/leadforge
POSTGRES_USER=leadforge
POSTGRES_PASSWORD=your_password
POSTGRES_DB=leadforge
POSTGRES_HOST=localhost
POSTGRES_PORT=5432

# --- Redis / Celery (optional; USE_CELERY=false runs jobs in-process) -------
REDIS_URL=redis://localhost:6379/0
USE_CELERY=false

# --- App settings -----------------------------------------------------------
# Generate a real secret before exposing the API: openssl rand -hex 32
# The app refuses to boot (ENV=production) with the placeholder below.
SECRET_KEY=leadforge-secret-key-production-change-me
ENV=dev
# Browser origins allowed to call the API. "*" is fine locally; production
# must name the dashboard, e.g. CORS_ORIGINS=https://app.example.com
CORS_ORIGINS=*
# Public base URL used in open/click tracking and unsubscribe links.
TRACKING_DOMAIN=http://localhost:8000

# --- API authentication (OPTIONAL but strongly recommended) -----------------
# Unset => the REST API is OPEN. That is fine for a local clone-and-run, and
# unsafe the moment the port is reachable from a LAN: with CORS_ORIGINS="*"
# any website could delete your lead database or send cold email from your
# mailbox.
#
# When set, every endpoint requires it:
#   curl -H "X-API-Key: <key>" http://localhost:8000/api/v1/leads
# The campaign tracker (/api/v1/campaigns/tracker/*) is exempt - it serves
# the one-click unsubscribe and the click tracker, which are fetched by the
# recipient's mail client.
#
# Generate with: openssl rand -hex 32
API_KEY=

# --- Scraper ----------------------------------------------------------------
# Optional rotating egress proxies for directory scraping, comma-separated.
# Recommended for sustained Google Maps volume (residential/Datacenter IPs
# rate-limit quickly). Empty = direct egress.
PROXY_LIST=
API_V1_STR=/api/v1