# Configuration

LLM Gateway is configured through environment variables and runtime settings.

The public defaults are intentionally local. Real deployment values should be supplied by your
shell, process manager, container platform, or secret manager.

## Core Variables

| Variable | Default | Purpose |
|---|---:|---|
| `PORT` | `3100` | HTTP port |
| `HOST` | `localhost` | HTTP bind host |
| `LOG_LEVEL` | `info` | Logging level |
| `DATABASE_URL` | unset | PostgreSQL connection string |
| `AUTO_SPAWN_BRIDGES` | unset | Start detected bridges on boot when set to `1` |
| `DISCOVERY_INTERVAL_MS` | `300000` | Subscription discovery interval |
| `WATCHDOG_ENABLED` | unset | Enable bridge watchdog when set to `1` |

## Bridge Variables

| Variable | Purpose |
|---|---|
| `CLAUDE_BRIDGE_URL` | Claude Code bridge URL |
| `CODEX_BRIDGE_URL` | Codex bridge URL |
| `CHATGPT_BRIDGE_URL` | ChatGPT bridge URL |
| `COPILOT_BRIDGE_URL` | GitHub Copilot bridge URL |
| `M365_COPILOT_BRIDGE_URL` | Microsoft 365 Copilot bridge URL |
| `GEMINI_BRIDGE_URL` | Gemini bridge URL |
| `AIDER_BRIDGE_URL` | Aider bridge URL |

Bridge URLs usually point to localhost ports.

## Safe Local Example

```bash
export PORT=3100
export HOST=localhost
export LOG_LEVEL=info
export AUTO_SPAWN_BRIDGES=1
```

Use your runtime environment for values that grant access.

## Database

Database-backed features use `DATABASE_URL`. Keep credentials outside git.

Recommended pattern:

```bash
export DATABASE_URL="$(security-tool read gateway database-url)"
```

Use whatever secret manager or platform feature is appropriate for your environment.

## Gateway Access

Clients should send:

```text
Authorization: Bearer <key>
```

The exact access mechanism can be adapted per deployment. Avoid hardcoding access values in
source code, docs, scripts, tests, or screenshots.

## Production Notes

Before production use:

- set explicit CORS origins
- configure TLS at the edge or server
- use a real database if persistence is required
- define backup and retention policy
- decide which providers may receive sensitive data
- disable unused bridges
- run a secret scan before deployment
- verify logs do not expose prompts or account data