.env.example

# Trading mode — paper (port 4002) or live (port 4001). Default: paper.
# Drives IB Gateway port selection AND the startup account-prefix guard.
# IB_GATEWAY_PORT is no longer consulted; this var is the only switch.
XENON_TRADING_MODE=paper

# Per-mode broker account placeholder. dev.sh exports the right one as
# XENON_BROKER_ACCOUNT before child processes start. ib_sync overrides this
# from managedAccounts()[0] after the IB Gateway connection is established —
# these values exist only to unblock startup imports of AccountScope.
# Paper requires a DU* prefix; live requires a U* (and not DU*) prefix.
XENON_PAPER_ACCOUNT=DU0000000
# XENON_LIVE_ACCOUNT=U1234567

# IB Gateway connection
# IB_GATEWAY_HOST=127.0.0.1            # Default; override for a gateway on another host
# IB_GATEWAY_MODE=launchd              # Code default is "docker" (src/xenon/api/ib_gateway.py). Set "launchd" for a
#                                      # host-native IBC gateway; "cloud" = remote gateway, no restart.

# F3 quote-token signing. Rotate breaks in-flight tokens (~1s outage window).
# Generate with: uv run python -c "import secrets; print(secrets.token_hex(32))"
XENON_QUOTE_TOKEN_SECRET=

# FastAPI auth — credential-only, fail-closed (no localhost pass).
# X-Internal-Token shared secret for Next→FastAPI server-side calls.
# dev.sh refuses to start without it. Production must set a real secret.
# Generate with: uv run python -c "import secrets; print(secrets.token_hex(32))"
XENON_INTERNAL_API_TOKEN=

# Optional path-scoped API keys for read-only machine clients (X-API-Key).
# XENON_QUERY_API_KEY=         # read-only GET paths (+ a few read POSTs)
# MDW_API_KEY=                 # historical/contract data paths

# Dev-only escape hatch — opens the API entirely. NEVER set in production.
# XENON_AUTH_ALLOW_DEV_OPEN=1

# Next middleware browser-origin guard: comma list of Hosts allowed to call
# /api/** (all methods — DNS-rebinding protection). Defaults to
# localhost:3000/3200 + 127.0.0.1 variants. Prod: set the tailnet host values
# in web.env — prod web loads only web.env, so a value here never reaches it.
# XENON_ALLOWED_HOSTS=

# Origin allowlist for browser WebSocket upgrades on the realtime relay.
# Defaults to localhost:3000/3200 http origins. Prod: tailnet https origins.
# XENON_WS_ALLOWED_ORIGINS=

# Shared secret for the realtime relay's GET /status (token-only — no loopback
# trust). The api service sends it as X-Status-Token; both sides read it from
# this file. Unset -> /status answers 403 to everyone.
# IB_REALTIME_STATUS_TOKEN=

# IB Flex Query (optional). When unset the Historical Trades panel shows an
# empty state and xenon-blotter-history exits with configured=false.
# IB_FLEX_TOKEN=
# IB_FLEX_QUERY_ID=
# IB_FLEX_NAV_QUERY_ID=        # nav-flex-refresh job (deploy/README.md)

# Postgres connection — DEV vs PROD split policy
# ----------------------------------------------
# core_dev (PROD) is written by the macmini Docker stack as `xenon_app`.
# core_test (DEV mirror) is written from MacBooks. `xenon_dev` is read-only on
# core_dev and becomes the owner of core_test after runbook step 3 (pending);
# until then laptops connect to core_test as `xenon_app`. After step 3, use
# `xenon_dev` in the laptop URLs below.
# The nightly refresh core_dev -> core_test (scripts/infra/refresh-core-test.sh,
# 04:00 ET = 08:00 UTC in EDT / 09:00 UTC in EST) runs only once its LaunchAgent
# is installed on the macmini. It is not installed yet.
#
# `dev.sh` refuses to start when DATABASE_URL points at core_dev — so even a
# misconfigured MacBook can't accidentally write to prod.
#
# Full policy: docs/architecture/production-database-strategy.md
# Role split steps and status: docs/runbooks/dev-prod-db-cutover.md
#
# --- macmini (Docker host, prod) — uncomment ONE ---
# Containers reach the host Postgres through host.docker.internal
# (deploy/compose.prod.yml extra_hosts).
# DATABASE_URL=postgresql+asyncpg://xenon_app:<app-pw>@host.docker.internal:5432/core_dev
#
# --- MacBook / dev machines ---
# Runtime DB (dev.sh): the remote core_test.
# pytest DB: a LOCAL Postgres database whose name contains "test", owned by your
# local OS user. Keep it local because pytest -n clones one DB per worker
# (<name>_gwN) and needs CREATEDB, which the remote role `xenon_dev` lacks. It
# must also be a different database from DATABASE_URL (src/xenon/_test_db.py
# refuses to run otherwise).
DATABASE_URL=postgresql+asyncpg://xenon_app:<app-pw>@100.66.147.98:5432/core_test
DATABASE_URL_TEST=postgresql+asyncpg://<local-user>:<local-pw>@127.0.0.1:5432/xenon_test
#
# Paper-mode local override (consumed by `dev.sh paper` only). Lets off-LAN
# dev work against a localhost Postgres when the macmini is unreachable.
# DATABASE_URL_PAPER=postgresql+asyncpg://xenon_app:<app-pw>@127.0.0.1:5432/core_test
# DATABASE_URL_TEST_PAPER=postgresql+asyncpg://<local-user>:<local-pw>@127.0.0.1:5432/xenon_test