# Copy to .env (git-ignored) and fill in real values before `docker compose up`.
# This server is intentionally narrow: read-only vw_* tools, a dedicated bot
# vault identity, and its own bearer token. See CLAUDE.md / kb task #64 for
# the full architecture and the sensitive setup steps (creating the bot user
# and the "Adolf" collection) that are NOT done by this scaffolding.

# Port this server listens on. 3100=agap-mcp, 3101=marketplace-mcp,
# 3103=kanboard-mcp, 3104=kanboard-mcp-adolf — 3105 verified free at write time.
PORT=3105

# Local Vaultwarden instance (NOT bitwarden.com). Unlike agap-mcp/
# marketplace-mcp, this service owns a fresh BITWARDENCLI_APPDATA_DIR volume
# with no pre-existing `bw config server`, so vaultwarden.js sets it on every
# boot from this var.
VW_URL=http://localhost:8041

# Dedicated bot identity — NEVER the master allogn@gmail.com account.
# Create this user in Vaultwarden first (sensitive step, reserved for the
# orchestrator — see report). Password: generate one and store it in
# Vaultwarden as item "ADOLF_VW_PASSWORD" (also a sensitive step).
BW_EMAIL=adolf-vault@auth.local
BW_PASSWORD=

# Bearer token gating /mcp, /sse, /messages (same pattern as
# marketplace-mcp). Generate with e.g. `openssl rand -hex 32`, store it in
# Vaultwarden as its own item (e.g. "VW_MCP_ADOLF_TOKEN"), and put the real
# value here — the line below is a PLACEHOLDER, not a usable secret.
VW_MCP_TOKEN=replace-with-output-of-openssl-rand--hex-32