# PostgreSQL
DATABASE_URL=postgresql://user:password@host:5432/database
DATABASE_URL=postgresql://user:password@host:5432/database?sslmode=require

# Redis
REDIS_URL=redis://host:6379/0
REDIS_URL=redis://:password@host:6379/0
REDIS_URL=rediss://:password@host:6379/0  # TLS

# Allow specific domains for all packs (comma-separated)
HUITZO_HTTP_GLOBAL_ALLOWED_DOMAINS=api.internal.corp,*.partner.com

# Platform-level API keys
OPENAI_API_KEY=sk-...
ANTHROPIC_API_KEY=sk-ant-...
SENDGRID_API_KEY=SG...

from huitzo_sdk import command

@command(
    name="my-command",
    namespace="mypack",
    version="1.0.0",
    timeout=60,           # Seconds
    retries=3,            # Retry attempts
    queue="medium",       # fast | medium | long
    output_format="json", # json | text | markdown
)
async def my_command(args, ctx):
    pass

[sdk]
api_url = "http://localhost:8000"
log_level = "DEBUG"
timeout = 60

[sdk.storage]
default_ttl_days = 90

[sdk.llm]
default_model = "gpt-4o-mini"
max_tokens = 4096
temperature = 0.7

# .huitzo.yaml - project-level configuration

# API endpoint (required for self-hosted)
api_url: https://huitzo.acme-internal.com

# Authentication settings
auth:
  type: oidc                      # oidc, api_key, or saml
  issuer: https://auth.acme.com   # Required for OIDC
  client_id: huitzo-cli           # Optional, defaults to huitzo-cli

# Development session settings
dev:
  port: 8080                      # Local proxy port
  persist: false                  # Keep sandbox after Ctrl+C
  watch: true                     # Auto-upload on file changes
  log_level: debug                # Logging level
  docs_server: true               # Enable local docs server
  docs_port: 8124                 # Docs server port
  docs_update: true               # Auto-update docs on startup

# ~/.huitzo/config.yaml

# Default API endpoint
api_url: https://huitzo.ai

# Default organization scope for publishing
default_scope: "@myorg"

# Development preferences
dev:
  port: 9000
  log_level: info
  docs_server: true               # Enable local docs server
  docs_port: 8124                 # Docs server port

# Profiles for multiple environments
profiles:
  production:
    api_url: https://huitzo.ai
  staging:
    api_url: https://staging.huitzo.com
  enterprise:
    api_url: https://huitzo.acme.com

# Use default profile
huitzo pack list

# Use specific profile
huitzo --profile production pack list

# Set via environment
export HUITZO_PROFILE=production
huitzo pack list

# .huitzo.yaml for self-hosted
api_url: https://huitzo.acme-internal.com

auth:
  type: api_key
  # Key is read from environment or keychain

# CLI reads .huitzo.yaml automatically
huitzo login

# Or explicitly specify config
huitzo login --config .huitzo.yaml

# .huitzo.yaml
api_url: https://huitzo.acme-internal.com

auth:
  type: oidc
  issuer: https://auth.acme.com
  client_id: huitzo-cli
  # Optional: scope, audience

# .huitzo.yaml
api_url: https://huitzo.acme-internal.com

auth:
  type: saml
  idp_url: https://idp.acme.com/saml

# ~/.huitzo/config.yaml (user)
api_url: https://huitzo.ai
dev:
  port: 9000

# .huitzo.yaml (project)
api_url: https://huitzo.acme.com
dev:
  persist: true

export HUITZO_LOG_LEVEL=debug

postgresql://user:password@host:port/database

DATABASE_URL=postgresql://huitzo:password@localhost:5432/huitzo

-- Automatic policy on all tables with tenant_id
CREATE POLICY tenant_isolation ON tablename
    USING (tenant_id = current_setting('app.current_tenant')::uuid);

redis://[:password@]host:port/db

# Local, no password
REDIS_URL=redis://localhost:6379/0

# With password
REDIS_URL=redis://:mypassword@localhost:6379/0

# TLS
REDIS_URL=rediss://user:pass@host:6379/0

# Apply all pending migrations
huitzo db migrate

# Show current migration status
huitzo db status

# Create a new migration (development)
huitzo db revision --message "Add user preferences table"

# Rollback last migration
huitzo db downgrade -1

# Rollback to specific revision
huitzo db downgrade abc123

# Show migration history
huitzo db history

backend/
├── migrations/
│   ├── env.py              # Alembic environment config
│   ├── script.py.mako      # Migration template
│   └── versions/
│       ├── 001_initial_schema.py
│       ├── 002_add_pack_registry.py
│       └── 003_add_user_preferences.py

# migrations/versions/003_add_user_preferences.py
"""Add user preferences table

Revision ID: 003_preferences
Revises: 002_pack_registry
Create Date: 2026-01-22 10:00:00.000000
"""
from alembic import op
import sqlalchemy as sa
from sqlalchemy.dialects.postgresql import JSONB

revision = '003_preferences'
down_revision = '002_pack_registry'

def upgrade():
    op.create_table(
        'user_preferences',
        sa.Column('id', sa.UUID(), primary_key=True),
        sa.Column('user_id', sa.UUID(), sa.ForeignKey('users.id'), nullable=False),
        sa.Column('tenant_id', sa.UUID(), sa.ForeignKey('tenants.id'), nullable=False),
        sa.Column('preferences', JSONB, nullable=False, server_default='{}'),
        sa.Column('created_at', sa.DateTime(timezone=True), server_default=sa.func.now()),
        sa.Column('updated_at', sa.DateTime(timezone=True), onupdate=sa.func.now()),
    )
    op.create_index('ix_user_preferences_user_id', 'user_preferences', ['user_id'])

    # Enable RLS
    op.execute('ALTER TABLE user_preferences ENABLE ROW LEVEL SECURITY')
    op.execute('''
        CREATE POLICY tenant_isolation ON user_preferences
        USING (tenant_id = current_setting('app.tenant_id')::uuid)
    ''')

def downgrade():
    op.drop_table('user_preferences')

-- Check current version
SELECT * FROM alembic_version;

-- Output:
-- version_num
-- 003_preferences

# docker-compose.yml
services:
  app:
    image: huitzo/huitzo:latest
    command: ["sh", "-c", "huitzo db migrate && uvicorn huitzo.main:app --host 0.0.0.0"]

docker compose exec app huitzo db migrate

{
  "timestamp": "2026-01-22T12:00:00Z",
  "level": "INFO",
  "logger": "webcli.api",
  "message": "Request completed",
  "correlation_id": "abc-123",
  "duration_ms": 45
}

LOG_LEVEL=INFO
LOG_FORMAT=json     # json | text
LOG_OUTPUT=stdout   # stdout | file
LOG_FILE_PATH=/var/log/huitzo/app.log

# Python
python -c "import secrets; print(secrets.token_urlsafe(32))"

# OpenSSL
openssl rand -base64 32

server {
    listen 443 ssl;
    server_name huitzo.ai;

    ssl_certificate /path/to/cert.pem;
    ssl_certificate_key /path/to/key.pem;

    location / {
        proxy_pass http://localhost:8000;
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
    }
}

# Core
DATABASE_URL=postgresql://huitzo:password@localhost:5432/huitzo
REDIS_URL=redis://localhost:6379/0
SECRET_KEY=dev-secret-key-change-in-production

# Environment
ENVIRONMENT=development
DEBUG=true
LOG_LEVEL=DEBUG

# Services (optional in dev)
OPENAI_API_KEY=sk-...

# Celery
CELERY_TASK_ALWAYS_EAGER=true

# Core
DATABASE_URL=postgresql://huitzo:[email protected]:5432/huitzo
REDIS_URL=redis://:[email protected]:6379/0
SECRET_KEY=production-secret-key-64-chars-minimum-random

# Environment
ENVIRONMENT=production
DEBUG=false
LOG_LEVEL=INFO

# Security
CORS_ORIGINS=https://cli.huitzo.com,https://hub.huitzo.com

# Services
OPENAI_API_KEY=sk-...
ANTHROPIC_API_KEY=sk-ant-...
SENDGRID_API_KEY=SG....

# Rate limiting
RATE_LIMIT_ENABLED=true
RATE_LIMIT_REQUESTS=100
RATE_LIMIT_WINDOW=60

# Self-hosted license
LICENSE_KEY=your-license-key