# Example ~/.trustee/.env file for Trustee
# This file configures local behavior and remote encrypted config/secrets storage
# =============================================
# LLM Provider Configuration
# =============================================
# Choose your LLM provider and set the appropriate API key(s)
# OpenAI
OPENAI_API_KEY=sk-your-key-here
# OPENAI_DEFAULT_MODEL=gpt-4o
# OPENAI_BASE_URL=https://api.openai.com/v1
# GitHub Copilot
# GITHUB_TOKEN=ghu-your-token-here
# GITHUB_MODEL=openai/gpt-4o-mini
# GITHUB_BASE_URL=https://api.githubcopilot.com
# Anthropic
# ANTHROPIC_AUTH_TOKEN=sk-ant-your-key-here
# ANTHROPIC_MODEL=claude-3-5-sonnet-20241022
# ANTHROPIC_BASE_URL=https://api.anthropic.com
# LLM Provider Selection
# LLM_PROVIDER=tanbal
# =============================================
# Local Configuration Files (Optional)
# =============================================
# Override default local config and env file names
# Default config file is ~/.trustee/config/trustee.toml
# TRUSTEE_CONFIG_FILE=my-custom-config.toml
# Default env file is ~/.trustee/.env
# TRUSTEE_ENV_FILE=my-custom-env
# =============================================
# Remote Encrypted Config/Secrets Configuration (Optional)
# =============================================
# If these are set, Trustee will attempt to load config and secrets from
# remote encrypted storage using the getmyconfig library
# Required: S3-compatible storage endpoint
GETMYCONFIG_ENDPOINT=your-storage.example.com
# Required: Storage access credentials
GETMYCONFIG_ACCESS_KEY=your-access-key
GETMYCONFIG_SECRET_KEY=your-secret-key
# Required: Storage bucket name
GETMYCONFIG_BUCKET=your-bucket-name
# Required: Encryption key for decrypting remote files
# Must be 32 bytes hex-encoded (64 hex characters)
GETMYCONFIG_ENCRYPTION_KEY=your-32-byte-encryption-key-hex
# Optional: Storage region (if required by your provider)
# GETMYCONFIG_REGION=us-east-1
# Remote File Names (Optional)
# Override default remote config and env file names
# Default config file is trustee.toml.enc
GETMYCONFIG_CONFIG_FILE=trustee.toml.enc
# Default env file is .env.enc
GETMYCONFIG_ENV_FILE=.env.enc
# =============================================
# Notes
# =============================================
# 1. If remote config is configured, Trustee will try to load from remote first,
# then fall back to local files if remote is unavailable.
# 2. Remote secrets are merged with local secrets (remote takes priority).
# 3. GETMYCONFIG_* variables are always read from the local ~/.trustee/.env file.
# 4. The local ~/.trustee/.env file MUST exist to configure remote storage,
# even if you plan to use primarily remote config/secrets.
# 5. Remote files are decrypted using AES-256-GCM with the provided encryption key.