# AgentEvalTool environment configuration
# Copy this file to .env and fill in real values. .env is git-ignored.

# ── API security ──────────────────────────────────────────────
# Leave AGENTEVAL_API_KEY empty to disable auth (dev only).
# In production, set a strong random token; clients must send it as X-API-Key.
AGENTEVAL_API_KEY=

# If set, the web UI requires login with this password (session-level, stored
# in sessionStorage). Leave empty to disable the login gate (dev default).
AGENTEVAL_ADMIN_PASSWORD=

# Fernet key used to encrypt model API keys stored in SQLite.
# Generate once with: python -c "from cryptography.fernet import Fernet; print(Fernet.generate_key().decode())"
# Keep this value backed up with the database. Do not commit a real key.
AGENTEVAL_SECRET_KEY=

# Comma-separated list of allowed CORS origins. Use ["*"] only in dev.
# The first non-localhost URL in this list is also used as the Origin sent
# to OpenClaw during the WebSocket handshake (auto-derives
# AGENTEVAL_OPENCLAW_WS_ORIGIN), so set this to the public URL of the
# deployment in production.
# Example: AGENTEVAL_ALLOWED_ORIGINS=["http://192.168.8.145:8001"]
AGENTEVAL_ALLOWED_ORIGINS=["*"]

# ── OpenClaw proxy ─────────────────────────────────────────────
AGENTEVAL_OPENCLAW_UPSTREAM=http://openclaw-eval:18789
AGENTEVAL_OPENCLAW_WS_UPSTREAM=ws://openclaw-eval:18789
AGENTEVAL_OPENCLAW_PROXY_USER=agenteval
AGENTEVAL_OPENCLAW_AUTH_TOKEN=change-me-in-production
# Optional override. If unset, the proxy derives the Origin from
# AGENTEVAL_ALLOWED_ORIGINS automatically. Only set this if you need to
# send a different Origin than the public URL of this deployment.
# AGENTEVAL_OPENCLAW_WS_ORIGIN=

# ── Frontend ───────────────────────────────────────────────────
# Optional override of the built frontend dist path (default: frontend/web/dist).
# AGENTEVAL_FRONTEND_DIST_PATH=/app/frontend/web/dist

# ── Webhook ────────────────────────────────────────────────────
# If set, AgentEvalTool will POST run completion summaries to this URL.
# Example: AGENTEVAL_WEBHOOK_URL=https://your-service.example.com/webhooks/agenteval
AGENTEVAL_WEBHOOK_URL=
# Optional shared secret included as X-Webhook-Secret header for verification.
AGENTEVAL_WEBHOOK_SECRET=