# =========================================================
# Maple Railway Production Template
# Copy to your real `.env` / Railway Variables and replace values.
# Never commit real secrets.
# =========================================================
# ---------- REQUIRED (boot-critical in production) ----------
NODE_ENV=production
MCP_URL=https://your-maple-service.up.railway.app
MAPLE_API_KEY=replace_with_long_random_secret
MAPLE_ADMIN_USERNAME=admin
MAPLE_ADMIN_PASSWORD=replace_with_strong_password
MAPLE_ADMIN_EMAIL=admin@example.com
# ---------- OPTIONAL (needed only for source=openclaw live bridge) ----------
OPENCLAW_BRIDGE_URL=https://your-openclaw-bridge.up.railway.app
OPENCLAW_BRIDGE_TOKEN=replace_with_long_random_secret
# ---------- AUTH / SESSION ----------
MAPLE_SESSION_TTL_SECONDS=604800
MAPLE_SESSION_OWNER_SCOPE=auto
MAPLE_AUTH_ALLOW_SELF_SIGNUP=false
MAPLE_ALLOW_NO_AUTH=false
# ---------- STORAGE ----------
MAPLE_DB_PATH=data/maple.db
# ---------- FIREWALL / LOCKDOWN (recommended for prod) ----------
MAPLE_LOCK_BRIDGE_TARGET=true
MAPLE_ALLOW_BRIDGE_OVERRIDE=false
MAPLE_MCP_ROUTE_LOCK=true
MAPLE_MCP_PROXY_ALLOW_DYNAMIC_TARGETS=false
MAPLE_MCP_PROXY_ALLOW_HTTP=false
MAPLE_MCP_PROXY_ALLOW_PRIVATE_TARGETS=false
# ---------- UI / DEMO ----------
MAPLE_ENABLE_JUDGE_UI=true
MAPLE_ENABLE_DEMO_ROUTES=true
MAPLE_ENABLE_LEGACY_SMITHERY_ROUTES=false
# ---------- MARKETPLACE ----------
MAPLE_MCP_MARKETPLACE_ENABLED=false
MAPLE_MCP_MARKETPLACE_AUTO_CONNECT=false
MAPLE_SMITHERY_ENABLED=false
MAPLE_SMITHERY_API_BASE_URL=https://api.smithery.ai
MAPLE_SMITHERY_API_KEY=
MAPLE_SMITHERY_TIMEOUT_MS=12000
MAPLE_MCPSO_ENABLED=false
MAPLE_MCPSO_BASE_URL=https://mcp.so
MAPLE_MCPSO_TIMEOUT_MS=12000
MAPLE_MCPSO_CACHE_TTL_MS=300000
MAPLE_DOWNSTREAM_TOOLS_CACHE_TTL_MS=15000
# ---------- OPTIONAL ROUTING MODE A: Static Downstream Apps ----------
# MAPLE_DOWNSTREAM_APPS=[{"id":"web-research","mcpUrl":"https://downstream-app.up.railway.app/mcp","apiKey":"replace_with_downstream_secret","authHeader":"x-api-key","enabled":true}]
# MAPLE_MCP_FIREWALL_DEFAULT_APP=web-research
# MAPLE_MCP_EXECUTION_ORDER=web-research
# MAPLE_MCP_PROXY_DEFAULT_TARGET_URL=https://downstream-app.up.railway.app/mcp
# MAPLE_MCP_PROXY_ALLOWED_HOSTS=downstream-app.up.railway.app
# ---------- OPTIONAL AUTH ALTERNATIVE ----------
# MAPLE_API_KEYS=key1,key2,key3
# ---------- OPTIONAL FIREWALL TUNING ----------
# MAPLE_FIREWALL_ENABLED=true
# MAPLE_FIREWALL_DEFAULT_ACTION=allow
# MAPLE_FIREWALL_LOG_DIR=/app/data/firewall-logs
# ---------- OPTIONAL FIREWALL CHAT AI (OpenAI/Anthropic with fallback) ----------
# OPENAI_API_KEY=sk-...
# ANTHROPIC_API_KEY=sk-ant-...
# MAPLE_FIREWALL_CHAT_PRIMARY=openai # openai | anthropic
# MAPLE_FIREWALL_CHAT_OPENAI_MODEL=gpt-4o-mini
# MAPLE_FIREWALL_CHAT_ANTHROPIC_MODEL=claude-sonnet-4-6
# MAPLE_FIREWALL_CHAT_TIMEOUT_MS=15000
