template-.env

YSWEET_CONNECTION_STRING=...
GEMINI_API_KEY=...
ELEVENLABS_API_KEY=...

# Y-Sweet auth, for compose.yaml only (it builds YSWEET_CONNECTION_STRING from the token, and
# its value there overrides the one above). Without it, anyone who can reach the published
# Y-Sweet port can read and write every doc. Generate the pair with
# `npx y-sweet@0.9.1 gen-auth --json`: private_key goes to the Y-Sweet container,
# server_token is what the app presents. They must come from the same run.
# Y_SWEET_AUTH=...
# Y_SWEET_SERVER_TOKEN=...

# Write authorization: shared per-device keys, not user logins (docs/WRITE_KEYS.md).
# Reading stays open to anyone; these gate editing, the microphone, and the endpoints that
# spend money. Comma-separated, each entry `label:key` or a bare `key`; the label only ever
# shows up in logs. Generate with `openssl rand -hex 24`.
# WRITE_KEYS=proclaim:...,booth:...,tablet:...,feeder:...

# off | observe | enforce (default: observe; forced to off when WRITE_KEYS is empty).
# `observe` checks and logs every privileged request but allows it anyway — ship keys to the
# devices, watch the logs for `key=none`, and only then switch to `enforce`.
# WRITE_AUTH_MODE=observe

# Per-caller request caps for the two endpoints a write key can't protect, because
# listeners legitimately call them (docs/WRITE_KEYS.md). Set far above a real service: a
# congregation shares one public address, so these are sized to stop a script, not a busy
# Sunday. 0 disables.
# TTS_RATE_LIMIT_PER_MIN=600
# TRANSLATE_RATE_LIMIT_PER_MIN=1200

# The congregation's timezone (IANA), used to decide which day a session belongs to and
# when a pin lapses (issue #111). The server now owns "the current doc" for everyone, so it
# has to reckon dates on the church's clock rather than the container's, which is UTC —
# otherwise an evening service in the Americas is filed under tomorrow. Defaults to the
# host's zone. See docs/CURRENT_SESSION.md.
# SESSION_TIMEZONE=America/Detroit

# Where the pin/proposal state is kept (optional). Defaults inside the audio-cache dir so
# it rides the existing Docker volume and a pin survives a restart mid-service.
# SESSION_REGISTRY_PATH=audio-cache/current-session.json

# TTS Rate Limiting (optional, default: 2 concurrent requests)
# TTS_MAX_CONCURRENT=2

# Stronger Gemini model for whole-item slide drafting (optional). Used by /api/translateItem;
# the incremental notes path stays on the cheaper default model. The default is set in
# server.ts (STRONG_MODEL) — set this only to override it.
# GEMINI_STRONG_MODEL=

# General context injected into every slide-translation prompt: the setting and the intent
# of the translations, to steer register. The default (server.ts, SLIDE_TRANSLATION_CONTEXT)
# describes a PCA worship service — set this if yours is something else.
# SLIDE_TRANSLATION_CONTEXT=

# Languages the Proclaim feed's slides are translated into ahead of time, comma-separated
# display names (optional). Defaults to the frontend's language picker (src/translationLanguages.ts),
# since those are the only languages a viewer can choose.
# SLIDE_TRANSLATION_LANGUAGES=

# Where the reviewed slide-translation library is kept (optional). Defaults inside the
# audio-cache dir so it rides the existing Docker volume.
# SLIDE_LIBRARY_PATH=audio-cache/slide-library.json

# The landing page (issue #133, docs/LANDING_PAGE.md). SITE_NAME is its heading (blank: no
# heading). SITE_LANGUAGES is the ordered list of BCP-47 codes it offers as cards; where each
# card goes is derived in src/siteLanguages.ts from what the language can do (live audio,
# slide translation). A code that can do neither stops the server at boot, deliberately: a
# typo that quietly vanished from the page would be found by an attendee on a Sunday.
# Unset gives the default in src/siteLanguages.ts.
# SITE_NAME=New City Fellowship
# SITE_LANGUAGES=en,fr,es,ht

# Port the Express server listens on (optional; the default is in server.ts).
# PORT=8000

# The chaos endpoint (/api/livekit/translate/simulate) is refused in production unless this
# is set; leave it unset on a real deployment.
# ALLOW_CHAOS_ENDPOINT=1

# Live speech-to-speech translation via Gemini Live + LiveKit (optional).
# When unset, the listen-{language} / broadcast panes are disabled but the app still runs.
# LIVEKIT_URL=wss://your-project.livekit.cloud
# LIVEKIT_API_KEY=...
# LIVEKIT_API_SECRET=...

# Live-audio cost path (optional, default off). Set a dBFS level to make bridges suspend their
# Gemini session after ~30s below it and reopen on speech; -30 is a guess, not a measured value.
# Unset means no suspending at all. Note the sign — dBFS is negative below full scale, so a
# higher number gates harder and 0 would treat all speech as silence. The goaway/reconnect
# fixes and the always-on default translator are independent of this and always on.
# LIVE_AUDIO_SILENCE_THRESHOLD_DBFS=-30

# What a session is assumed to be spoken in when nobody says otherwise (BCP-47, default `en`).
# The broadcast pane asks the speaker directly and publishes their answer per session, so this
# only decides the fallback: older clients, and the macOS audio feeder, which publishes as
# organizer with no UI to ask. Set it when a whole deployment's services are in one language.
# LIVE_AUDIO_SOURCE_LANGUAGE=en

# PostHog Analytics (genuinely optional — with no key the server boots, logs that telemetry
# is disabled, and drops every event). The key turns it on; the host defaults in server.ts.
# VITE_PUBLIC_POSTHOG_KEY=...
# VITE_PUBLIC_POSTHOG_HOST=https://us.i.posthog.com

# PostHog CLI for sourcemap uploads (optional, used during Docker build)
# POSTHOG_CLI_TOKEN=...
# POSTHOG_CLI_ENV_ID=...
# POSTHOG_CLI_HOST=https://us.i.posthog.com