# Copy to deploy/secrets/thothii.secrets and chmod 600.
# Values are read as literal strings (no shell expansion or command substitution).
# Leave unused keys out of the file.

# Hosted catalog provider (single-key providers only). The selected name must match
# modelCatalog.providers.<provider>.authentication.apiKeyEnv.
# Allowed names include THT_MODEL_API_KEY, THT_METADATA_API_KEY, ANTHROPIC_API_KEY,
# AZURE_API_KEY, GEMINI_API_KEY,
# DEEPSEEK_API_KEY, OPENAI_API_KEY, OPENROUTER_API_KEY, or ZAI_API_KEY.
# OPENAI_API_KEY=replace-me
# A provider with an explicit keyless endpoint uses authentication.mode: none.

# External DWH adapter.
# THT_DWH_API_KEY=replace-me

# Optional CA material/path understood by the configured adapter.
# THT_CA=/run/secrets/ca-chain.pem

# OIDC/Authentik references. Uncomment only with non-empty values when configured.
# THT_OIDC_CLIENT_SECRET=replace-me
# THT_AUTHENTIK_API_TOKEN=replace-me