env.example

# RAG Service Configuration
RAG_PORT=8765

# Keep this on localhost. /index/* text lands verbatim in a public chatbot's
# system prompt, so binding elsewhere requires RAG_API_SECRET (startup enforces it).
RAG_HOST=127.0.0.1

# Required by every mutating route (/index/*, /rebuild, /cache/clear) once set.
# The Rust backend sends it as X-RAG-Secret when its own RAG_API_SECRET matches.
RAG_API_SECRET=

# /rebuild is disabled while this is empty. Generate one, never commit it.
RAG_REBUILD_SECRET=

# PostgreSQL for dynamic data (projects, certificates)
DATABASE_URL=postgresql://user:password@host/dbname?sslmode=require

CLOUDFLARE_ACCOUNT_ID=

# Needs the "Workers AI: Read" permission. Never commit it.
CLOUDFLARE_API_TOKEN=

CLOUDFLARE_EMBEDDING_MODEL=@cf/baai/bge-m3

# Retrieval tuning
RAG_DISTANCE_THRESHOLD=0.21
RAG_LOG_LEVEL=INFO