# Secrets for mavend's away-channel reaches. The file is still called
# telegram.env because compose names it that; it holds both reaches now.
# Copy this file to deploy/telegram.env and fill in real values.
# deploy/telegram.env is gitignored — never commit the real secrets.
TELEGRAM_BOT_TOKEN=
TELEGRAM_CHAT_ID=

# ntfy access token for the `maven` topic, the second reach (V-649). Mint it on
# the ntfy server with write access to that topic and nothing else:
#   ntfy token add --expires=never maven
# Read access is not needed — mavend publishes and never subscribes.
NTFY_TOKEN=

# Bearer token for mavgpud, the workstation's GPU supervisor (V-673). It fronts
# the big model on a LAN port, so the token is the whole boundary in front of
# the card. Any long random string; mint one with:
#   openssl rand -hex 32
# The same value goes in a file on workpc, named by token_file in
# deploy/mavgpud.json. Empty is valid only while workstation.model_disabled is
# true; enabling the LAN model arm without it fails Maven's config validation.
MAVEN_GPU_TOKEN=

# Bearer token used by Maven when it sends audio to the workstation's
# CrisperWhisper service. The matching CW2_TOKEN is installed on workpc; these
# two values must be identical. Leaving both unset is only safe while that
# remote STT service is bound to loopback or its STT block is disabled.
MAVEN_STT_TOKEN=

# Home Assistant is currently explicitly disabled in deploy/mavend.json. Keep
# this name in the canonical inventory so enabling that block cannot turn into
# a valid-looking configuration with an expanded-empty token.
HA_TOKEN=

# docker compose reads these from the repository-root `.env`, before it starts
# containers; they are listed here even though their destination differs so
# this remains the complete deployment inventory. Copy both lines to `.env`.
# Enabling with an empty token fails startup; false is the explicit dark state.
# MAVEN_AMBIENT_ENABLED=false
# MAVEN_AMBIENT_TOKEN=

# Workstation-side counterpart to MAVEN_STT_TOKEN. Install this line in the
# EnvironmentFile named by deploy/mavgpud.service (currently
# %h/Programs/cw2-service/cw2.env), not in homesrv's telegram.env.
# CW2_TOKEN=

# The encrypted database key has its own narrowly mounted file,
# deploy/db_key.env, and its own generator in deploy/README.md. It is named
# here so an operator auditing this one inventory sees every deployed secret.
# MAVEN_DB_KEY=