# =============================================================================
# context-hub — Source de verite unique pour tous les agents
# NAS Synology DS920+ | /mnt/docker/context-hub/
# Port : 3093 | Domaine : context.bolbol.tn | 2026-06-24
# AVERTISSEMENT : Ne jamais versionner (.gitignore)
# =============================================================================

# APP
APP_PORT=3093
APP_DOMAIN=context.bolbol.tn
APP_NAME=context-hub
APP_ENV=production

# Docker
WANTED_UID=1026
WANTED_GID=100

# JWT
JWT_SECRET=6bef33890569cb9414d1cffa193bea5880a6cda893e12a6714916fb3a63d00bf
JWT_EXPIRE_HOURS=12

# Admin Nabil
ADMIN_USER=nabil
ADMIN_PASSWORD=2L2u519wcontext
ADMIN_SECRET=38a6371e21f30636535405acb9fab144

# --- CLES API CONSUMERS ---
# Matrice: infra+llm=tous | nyora=sauf-tt | perso=perso+claude+nabil | tt=tt+claude+nabil
API_KEY_CLAUDE=ctx-claude-dacf0771949d90d269ebff25
API_KEY_HERMES_TT=ctx-tt-a23436c6758eb3c84317cd3f
API_KEY_HERMES_NYORA=ctx-nyora-922178490b124e5916c82782
API_KEY_HERMES_PERSO=ctx-perso-229d04dd8ceca44bd7dc35e9
API_KEY_GEMINI=ctx-gemini-2bbc151e225e3c527f9df775

# Scopes par cle (enforce serveur)
# CLAUDE       : infra,llm,nyora,perso,tt
# HERMES_TT    : infra,llm,tt
# HERMES_NYORA : infra,llm,nyora
# HERMES_PERSO : infra,llm,nyora,perso
# GEMINI       : infra,llm,nyora

# --- NAS INFRASTRUCTURE ---
NAS_HOST=192.168.100.33
NAS_SSH_PORT=22222
NAS_SSH_USER=Best0f
NAS_SSH_PASSWORD=2L2u519w@ommi
NAS_UID=1026
NAS_GID=100
NAS_DOCKER_ROOT=/volume1/docker
NAS_PORTS_REGISTRY=/volume1/docker/ports-registry.md
NAS_ENV_FILE=/volume1/docker/hermes-platform/.env

# Reseau Docker
DOCKER_INTERNAL_HOST=172.17.0.1
DOCKER_LAN_HOST=192.168.100.33

# Identites NAS (ne jamais confondre)
# bolbol = Gitea | Best0f = SSH | bestof = Portainer

# --- GITEA ---
GITEA_URL=http://192.168.100.33:3232
GITEA_USER=bolbol
GITEA_PASSWORD=2L2u519wgitea
GITEA_TOKEN=b7c8c44051c362404cd299dcabb36c73172731b0
# Push: http://bolbol:2L2u519wgitea@172.17.0.1:3232/bolbol/<repo>.git

# --- BIFROST Gateway LLM ---
BIFROST_URL_INTERNAL=http://bifrost:8080/v1
BIFROST_URL_LAN=http://192.168.100.33:3085/v1
BIFROST_VK=bfk-e5832bfe
BIFROST_AUTH_HEADER=x-bf-vk
# JAMAIS Authorization Bearer -> 401
# bifrost-proxy cap max_tokens=16384
BIFROST_DEFAULT_MODEL=deepseek/deepseek-chat-v3-0324
BIFROST_PROVIDER=opencode-go
BIFROST_BUDGET_USD_MONTH=10
BIFROST_VISION_MODEL=openrouter/google/gemini-2.5-flash
# DeepSeek = text-only, 404 sur images

# --- BASEROW ---
BASEROW_URL=https://baserow.bolbol.tn
BASEROW_URL_INTERNAL=http://172.27.0.18
BASEROW_HOST_HEADER=baserow.bolbol.tn
BASEROW_TOKEN=deT2PW3ZFZ0h3euxhKDFnlZhKNrcckYV
BASEROW_USER=contact@bolbol.tn
BASEROW_PASSWORD=2L2u519wbaserow

# Tables Baserow CI-CPT 2026 (scope tt)
BASEROW_CI_CPT_GABES=991
BASEROW_CI_CPT_GAFSA=992
BASEROW_CI_CPT_KEBILI=993
BASEROW_CI_CPT_MEDENINE=994
BASEROW_CI_CPT_SFAX=995
BASEROW_CI_CPT_TATAOUINE=996
BASEROW_CI_CPT_TOZEUR=997
BASEROW_CI_CPT_ZONE_SUD=998

# Tables Baserow FB 2026 (scope tt)
BASEROW_FB_GABES=999
BASEROW_FB_GAFSA=1000
BASEROW_FB_KEBILI=1001
BASEROW_FB_MEDENINE=1002
BASEROW_FB_SFAX=1003
BASEROW_FB_TATAOUINE=1004
BASEROW_FB_TOZEUR=1005
BASEROW_FB_ZONE_SUD=1006
BASEROW_TABLE_RLA=856
BASEROW_TABLE_CONSOMMABLES=228
BASEROW_WORKSPACE_HORS_RLA=148
BASEROW_WORKSPACE_RLA=147

# --- NYORA NOTES ---
NYORA_NOTES_URL=http://192.168.100.33:8787
NYORA_NOTES_URL_INTERNAL=http://nyora-notes:8787
# Tokens vault: /mnt/docker/nyora-notes/data/hermes-*.token

# --- HERMES INSTANCES ---
HERMES_TT_URL=http://192.168.100.33:3010
HERMES_NYORA_URL=http://192.168.100.33:3020
HERMES_PERSO_URL=http://192.168.100.33:3030
HERMES_TT_API_KEY=fgs0bdaUkRZSKJMDAdRw80-CzkTfs19B
HERMES_NYORA_API_KEY=xo7vqL5c90ZcwqknKnhJCNXEfSB8DMOG
HERMES_PERSO_API_KEY=Qo03oWTmPaHe7_-NPYHXp6_Y37x8QwnO

# --- SERVICES NAS ---
N8N_URL_LAN=http://192.168.100.33:5678
N8N_USER=contact@bolbol.tn
N8N_PASSWORD=2L2u519wn8n
PORTAINER_URL=http://192.168.100.33:9000
PORTAINER_USER=bestof
PORTAINER_PASSWORD=2L2u519wportainer

# --- DR. NEXUM KILL-SWITCH ---
DR_NEXUM_DEADLINE=2026-11-15
DR_NEXUM_TARGET_SUBS=1000
DR_NEXUM_TARGET_REVENUE_EUR=300

# --- MCP ---
MCP_ENDPOINT=/mcp
MCP_SSE=true
# Verification scope enforced sur chaque requete MCP
# Aucune donnee tt/perso ne transite vers Gemini