# Copy to .claude/env.local (gitignored) and fill in. The launch wrapper in launch.json sources it.
# Holds secrets + machine-specific paths, so it must never be committed.

# --- Hosted Whisper (whisper.cajk.org/app, mTLS with a vmin client cert) ---
# Leave WHISPER_URL unset to fall back to local WhisperX.
export WHISPER_URL="https://whisper.cajk.org/app"
export WHISPER_MTLS_P12="/path/to/vmin-client.p12"   # if the p12 is legacy-encrypted, re-encode for OpenSSL 3:
                                                     #   openssl pkcs12 -in old.p12 -legacy -passin pass:PW -nodes -out /dev/shm/x.pem
                                                     #   openssl pkcs12 -export -in /dev/shm/x.pem -out new.p12 -passout pass:PW
export WHISPER_MTLS_PASS="<p12 passphrase>"
# Do NOT set WHISPER_CA: whisper.cajk.org's server cert is public (ZeroSSL), verified by the system CA
# store. The vmin CA only verifies the *client* cert (server-side) — the client never needs it.

# --- Summariser (OpenRouter) ---
export OPENROUTER_API_KEY="<openrouter key, or read from a file>"