Release God's Eye View as open source

.env.example

@@ -0,0 +1,121 @@
+# God's Eye View — environment variables
+# Copy to .env and fill in your keys. On macOS the launcher can also read keys
+# from the Keychain (see README); on Linux/Windows use this file or env vars.
+#
+# NOTE ON CLIENT-EXPOSED KEYS: GOOGLE_MAPS_API_KEY and CESIUM_ION_TOKEN are
+# injected into the browser bundle by design (they're used client-side) and
+# WILL be visible in devtools. Restrict/scope them rather than trying to hide
+# them (see SECURITY.md). All other keys below stay server-side.
+
+# Required: Google Maps API key (Map Tiles API must be enabled).
+# CLIENT-EXPOSED — restrict it (HTTP referrer + API restriction) in Google Cloud.
+GOOGLE_MAPS_API_KEY=your_google_maps_api_key_here
+# Optional: opt-in per-IP rate limit for the Google Places cost endpoint
+# (/api/google/nearby-places), in requests per minute.
+# DEFAULT IS UNLIMITED — unset (or 0) means no throttling, unchanged behavior.
+# Set a positive integer to cap per-IP Places quota spend when self-hosting.
+# Recommended whenever HOST is not localhost. NOTE: this is a per-IP,
+# process-local guard (in-memory, resets on restart; over-limit requests get a
+# sanitized 429) — it is NOT a billing cap. For hard spend protection set
+# provider-side budget alerts: Google Cloud Console -> Billing -> Budgets & alerts
+# (plus per-API quotas under APIs & Services -> Quotas).
+# GEV_RATELIMIT_GOOGLE_PER_MIN=60
+
+# Optional: Cesium ion token for Bing world imagery stacks and Cesium World Terrain.
+# CLIENT-EXPOSED — use a public assets:read token with URL restrictions.
+CESIUM_ION_TOKEN=
+
+# Optional: OpenAI Realtime voice control. Do not prefix with VITE_.
+OPENAI_API_KEY=
+OPENAI_REALTIME_MODEL=gpt-realtime-2
+# Cheaper voice tier, used when the GEV MIC panel's MINI toggle is on.
+# Model ids and prices are external facts that drift — if OpenAI moves this id,
+# override it here rather than editing src/voice/voiceCost.js.
+OPENAI_REALTIME_MODEL_MINI=gpt-realtime-2.1-mini
+OPENAI_REALTIME_VOICE=marin
+OPENAI_REALTIME_REASONING_EFFORT=low
+# Keep only a short conversational window. Current map state is fetched live.
+OPENAI_REALTIME_CONTEXT_TOKENS=3000
+OPENAI_REALTIME_CONTEXT_RETENTION=0.5
+OPENAI_HUD_SUMMARY_MODEL=gpt-5-nano
+# Optional: opt-in per-IP rate limit for the OpenAI cost endpoints
+# (/api/realtime/token + /api/openai/hud-summary), in requests per minute.
+# DEFAULT IS UNLIMITED — unset (or 0) means no throttling, unchanged behavior.
+# Set a positive integer to cap per-IP spend when self-hosting on a network.
+# Recommended whenever HOST is not localhost. NOTE: this is a per-IP,
+# process-local guard (in-memory, resets on restart; over-limit requests get a
+# sanitized 429) — it is NOT a billing cap. For hard spend protection set a
+# provider-side budget: OpenAI platform -> Settings -> Limits (usage limits).
+# GEV_RATELIMIT_OPENAI_PER_MIN=30
+
+# Optional: OpenSky auth mode (oauth | basic | auto | anon)
+# Default: oauth — requires client credentials below
+# Set to "anon" to skip aircraft auth (rate-limited but works)
+OPENSKY_AUTH_MODE=oauth
+
+# Optional: OpenSky OAuth credentials (from opensky-network.org account dashboard)
+OPENSKY_CLIENT_ID=
+OPENSKY_CLIENT_SECRET=
+
+# Optional: OpenSky credentials JSON file path (alternative to above)
+# OPENSKY_CREDENTIALS_FILE=/path/to/credentials.json
+
+# Optional: dev server config
+PORT=4173
+# Network binding. Default is localhost — the server is reachable ONLY from
+# this machine. This is the safe default: the dev server brokers your
+# configured API keys, so anyone who can reach it can spend your quota.
+# LAN opt-in: set HOST=0.0.0.0 to share on your local network. WARNING: that
+# exposes every key-brokering proxy to everyone on the network — use only on
+# networks you trust, and consider the GEV_RATELIMIT_* throttles above.
+# HOST=localhost
+# HOST=0.0.0.0
+
+# Optional: NASA FIRMS live active fires. SERVER-SIDE ONLY (never reaches the
+# browser — the client polls the /api/firms proxy). Free key:
+# https://firms.modaps.eosdis.nasa.gov/api/map_key/
+# Without a key the FIRMS Active Fires layer is empty ("KEY REQUIRED").
+# FIRMS_MAP_KEY=
+
+# Optional: Live AIS vessels layer
+# Browser fetch path. Keep same-origin so the private stream key stays server-side.
+VITE_AIS_LIVE_API_URL=/api/ais-live
+# Client render cap. The server can keep a larger AISStream cache, but drawing
+# every global vessel at once can overwhelm WebGL on laptops.
+VITE_AIS_LIVE_MAX_ROWS=12000
+# Active label cap after screen-space clustering. Labels exist for all rendered
+# ships, but only clustered winners are shown to keep text readable.
+VITE_AIS_LIVE_LABEL_MAX_ROWS=900
+# Private AISStream key for the server-side websocket. Do not prefix with VITE_.
+AISSTREAM_API_KEY=
+# Optional AISStream subscription filters.
+# AISSTREAM_BOUNDING_BOXES=[[[-90,-180],[90,180]]]
+# AISSTREAM_MESSAGE_TYPES=PositionReport,StandardClassBPositionReport,ExtendedClassBPositionReport,ShipStaticData,StaticDataReport
+# Feed watchdog: silence (ms) after which the feed is REPORTED stale; the socket
+# is recycled at 2.5x that. Default 120000. The watchdog self-arms only for the
+# default worldwide subscription — a narrow filter above can be legitimately
+# quiet, so set this explicitly (sized for your filter) to opt back in.
+# 0 disables the silence watch entirely.
+# AISSTREAM_SILENCE_TIMEOUT_MS=120000
+
+# Optional: TomTom live traffic flow (BYOK freemium — free tier is ~50,000 tile
+# requests/day, get a key at https://developer.tomtom.com). SERVER-SIDE ONLY:
+# the browser fetches same-origin /api/tomtom/* and never sees the key.
+# Keyless fallback: the traffic layer runs its built-in simulation (white dots,
+# hardcoded per-road-class speeds) — no key required for the layer to work.
+# TOMTOM_API_KEY=
+# Optional soft cap on upstream tile fetches per UTC day (default 40000).
+# Over the cap the proxy serves cached/stale tiles instead of hitting upstream.
+# TOMTOM_DAILY_TILE_BUDGET=40000
+
+# Optional: CCTV layer tuning (advanced). Defaults are sensible — leave unset
+# unless you're customizing the camera source pack.
+# CCTV_SOURCES_FILE=config/cctv_sources.austin.json   # path to a source-pack JSON
+# CCTV_SOURCES_JSON=                                   # inline source-pack JSON (overrides file)
+# CCTV_AUSTIN_ROWS_URL=                                # override the Austin Open Data catalog URL
+# CCTV_AUSTIN_MAX_SOURCES=36                           # cap cameras loaded from the Austin catalog
+# CCTV_MAX_SOURCES=48                                  # overall cap on registered cameras
+# CCTV_PREFER_AUSTIN=1                                 # prioritize Austin cameras in the registry
+# CCTV_FORCE_AUSTIN=                                   # force Austin-only sources
+# CCTV_AUTO_CALIBRATE=1                                # auto-calibrate camera projection (client flag)
+# CCTV_DRAPE_MESH=1                                    # drape frames onto 3D geometry (client flag)