# Synapse standalone stack. Copy to `.env` beside compose.yml and edit two lines.
#
#   docker compose up -d
#
# ─────────────────────────────────────────────────────────────────────────────
# REQUIRED
# ─────────────────────────────────────────────────────────────────────────────

# Where YOUR vaults live on this host. Each direct child that contains
# _meta/tools/context.manifest.json is a vault. Nothing is copied — this is a bind mount.
SYNAPSE_VAULTS_DIR=./vaults

# ─────────────────────────────────────────────────────────────────────────────
# BOOTSTRAP — three modes, from two switches. Pick one.
# ─────────────────────────────────────────────────────────────────────────────
#
#  MODE 1 · manual         leave BOTH blank. Register vaults and mint credentials
#                          yourself with `docker exec`. This is the pre-existing behaviour.
#
#  MODE 2 · auto-register  SYNAPSE_AUTO_REGISTER=1, no bootstrap token. Vaults on the
#                          mounted path register themselves; you still mint the credential.
#
#  MODE 3 · full auto      both set. Vaults register themselves AND the token below
#                          becomes a credential granting all of them. Nothing to exec.
#
# Most people want MODE 3.

SYNAPSE_AUTO_REGISTER=1

# Generate one and paste it here. At least 24 characters or core refuses it:
#
#   openssl rand -base64 32
#
# Both containers read this single value — core registers it (hashed, never stored in the clear)
# and the UI presents it. It is an ordinary credential granting exactly your registered vaults;
# it is never admin. Leave blank for MODE 1 or 2.
SYNAPSE_BOOTSTRAP_TOKEN=

# ─────────────────────────────────────────────────────────────────────────────
# OPTIONAL
# ─────────────────────────────────────────────────────────────────────────────

# The one laptop-vs-server switch. 127.0.0.1 on a laptop; your VPN interface address on a
# server. NEVER 0.0.0.0 or :: — that publishes the UI on every interface, which this project
# treats as a core intention, not a setting. Defaults to loopback if you delete this line.
BIND_ADDR=127.0.0.1

# Host port for the UI. Change it if 8080 is taken.
HOST_PORT=8080

# Pin the images instead of tracking :latest.
# CORE_IMAGE=ghcr.io/eborjaa/synapse-core:2.1.0
# DSH_IMAGE=ghcr.io/eborjaa/synapse-dsh:2.1.0

# To reach this from a phone, run a VPN on the HOST (Tailscale, WireGuard) and set BIND_ADDR above
# to its interface address. There is no VPN container: it was an idle placeholder, and a tunnel on
# the host is fewer moving parts for the same result.

# Where the UI's Synapse plugin reaches core. This is a BASE, not an endpoint — the plugin appends
# /<vault-id> for whichever folder the session opened. Pinning a vault id here makes every session
# answer from that one vault while still looking correct. Change it only if you moved the port.
# SYNAPSE_MCP_HTTP_URL=http://127.0.0.1:3000/mcp

# Semantic recall. Point this at any Ollama — one on this host is the default. There is no ollama
# container either; the deterministic core never needed one, and semantic recall only needs a URL
# that answers.
# SYNAPSE_OLLAMA_URL=http://host.docker.internal:11434

# Reaching the UI through a proxy on a real domain (Cloudflare Tunnel, nginx…)? Name the domain here.
# DSH checks the Host header of every /api request against a trusted list and answers 403 otherwise,
# so without this the page loads and then fails with "Loading the provider directory failed … HTTP 403".
# Comma-separated; loopback is always trusted.
# DSH_TRUSTED_HOSTS=cerebro.example.com

# Passed through to the UI if you use that provider.
# OPENCODE_GO_API_KEY=