# ============================================
# GOOGLE OAUTH CONFIGURATION
# ============================================
# Path to Google OAuth client secrets JSON file (recommended)
GOOGLE_CLIENT_SECRETS_FILE=credentials.json
# OR use individual credentials (if not using JSON file)
# GOOGLE_CLIENT_ID=your-client-id.apps.googleusercontent.com
# GOOGLE_CLIENT_SECRET=your-client-secret
# OAuth redirect URI (must match Google Console configuration)
OAUTH_REDIRECT_URI=http://localhost:8002/oauth2callback
# ============================================
# SERVER CONFIGURATION
# ============================================
# Server host and port
SERVER_HOST=localhost
SERVER_PORT=8002
SERVER_NAME=Google Workspace MCP Server
# Base URL for OAuth endpoints
# For Tailscale Funnel: https://your-machine.your-tailnet.ts.net
# For local: http://localhost:8002
BASE_URL=http://localhost:8002
# ============================================
# ACCESS CONTROL SECURITY (Tailscale Funnel)
# ============================================
# IMPORTANT: These settings control who can authenticate to your MCP server
# when exposed via Tailscale Funnel or other public URLs
# Require users to have pre-existing credentials (DEFAULT: true - RECOMMENDED)
# When true, only users who've previously authenticated locally can access remotely
# This ties remote OAuth to your local credential store for security
MCP_REQUIRE_EXISTING_CREDENTIALS=true
# Optional: Email allowlist file for additional restriction
# When set, users must be in this file (and meet credential requirement if enabled)
# MCP_EMAIL_ALLOWLIST_FILE=.email_allowlist
# ============================================
# CREDENTIAL STORAGE
# ============================================
# Storage mode: FILE_PLAINTEXT, FILE_ENCRYPTED, MEMORY_ONLY, MEMORY_WITH_BACKUP
# Recommended: FILE_ENCRYPTED for production
CREDENTIAL_STORAGE_MODE=FILE_ENCRYPTED
# Directory for storing credentials
CREDENTIALS_DIR=./credentials
# ============================================
# HTTPS/SSL CONFIGURATION (Optional)
# ============================================
# Enable HTTPS (default: false)
ENABLE_HTTPS=false
# SSL certificate paths (required if ENABLE_HTTPS=true)
# SSL_CERT_FILE=./certs/server.crt
# SSL_KEY_FILE=./certs/server.key
# ============================================
# SESSION CONFIGURATION
# ============================================
# Session timeout in minutes
SESSION_TIMEOUT_MINUTES=60
# ============================================
# PHASE 1 OAUTH MIGRATION
# ============================================
# Enable unified authentication (GoogleProvider + legacy tools)
ENABLE_UNIFIED_AUTH=true
# Enable legacy compatibility mode
LEGACY_COMPAT_MODE=true
# Enable credential migration between storage modes
CREDENTIAL_MIGRATION=true
# Enable service caching for performance
SERVICE_CACHING=true
# Enable enhanced logging for debugging
ENHANCED_LOGGING=true
# ============================================
# QDRANT CONFIGURATION (Optional)
# ============================================
# Qdrant database URL
QDRANT_URL=http://localhost:6333
# Qdrant API key (use NONE for no authentication)
QDRANT_KEY=NONE
# Collection name for tool responses
QDRANT_COLLECTION_NAME=mcp_tool_responses
# Data retention in days (older data is automatically cleaned up)
MCP_TOOL_RESPONSES_COLLECTION_CACHE_DAYS=14
# ============================================
# EMBEDDING MODEL CONFIGURATION (FastEmbed)
# ============================================
# Embedding model for semantic search (uses FastEmbed library)
# Default: sentence-transformers/all-MiniLM-L6-v2 (384 dimensions, fast)
# Alternative models:
# - sentence-transformers/all-mpnet-base-v2 (768 dimensions, higher quality)
# - BAAI/bge-small-en-v1.5 (384 dimensions, good quality)
# - BAAI/bge-base-en-v1.5 (768 dimensions, best quality)
# - nomic-ai/nomic-embed-text-v1 (768 dimensions, good for long texts)
QDRANT_EMBEDDING_MODEL=sentence-transformers/all-MiniLM-L6-v2
# Note: FastEmbed downloads models on first use (~50-300MB depending on model)
# Models are cached in ~/.cache/fastembed/ for subsequent use
# ============================================
# TAILSCALE FUNNEL DEPLOYMENT
# ============================================
# Example configuration for Tailscale Funnel:
# 1. Set BASE_URL to your Tailscale URL
# 2. Keep OAUTH_REDIRECT_URI as localhost (OAuth happens on user's machine)
# 3. Ensure MCP_REQUIRE_EXISTING_CREDENTIALS=true (default)
# 4. Pre-authorize users by running start_google_auth locally first
#
# Example:
# BASE_URL=https://your-machine.your-tailnet.ts.net
# OAUTH_REDIRECT_URI=http://localhost:8002/oauth2callback
# MCP_REQUIRE_EXISTING_CREDENTIALS=true
