.env.example

# Host-run development reference: select variables for each process separately.
# Do not load this entire file into every app: only Core receives the identity
# KEKs. Only Core and OAuth receive the OAuth broker secret; background apps
# receive only their own workload credential.
# The Docker development stack already provides its local defaults in
# compose.dev.yml and does not require copying this file to .env.
# Core and OAuth share a development-only broker secret in compose.dev.yml.
# Mail incoming automations also need a provisioned Mail workload credential.

# Infrastructure
DATABASE_URL=postgresql://ipa:ipa@localhost:5432/ipa
REDIS_URL=redis://localhost:6379
# NATS JetStream cluster for @k2b/sync (bun run dev:infra publishes node 1 on :4222).
# Comma-separated bootstrap servers; the client dials all of them.
NATS_SERVERS=nats://localhost:4222
# Namespace shared by every app of one installation; isolates sync resources
# from other installations on the same NATS cluster.
SYNC_NAMESPACE=dev
# Optional: NATS `.creds` file (JWT + NKey) and TLS CA certificate paths.
NATS_CREDS_FILE=
NATS_TLS_CA_FILE=
# Optional separate system-account connection used only by Gateway Ops.
NATS_ADMIN_SERVERS=
NATS_ADMIN_CREDS_FILE=
NATS_ADMIN_NKEY_SEED_FILE=
NATS_ADMIN_TLS_CA_FILE=
# Default true: ignore cluster-advertised peer addresses. Host-side processes
# cannot resolve the Docker-internal hostnames (ipa_nats_2) the dev cluster
# advertises; set to false only when every advertised address is reachable.
NATS_IGNORE_CLUSTER_UPDATES=true
APP_URL=localhost:3000
PORT=3000

# Encryption key for at-rest settings encryption.
# Any non-empty string is accepted: hex (e.g. `openssl rand -hex 32`) is used
# as-is, anything else is normalized via SHA-256. ⚠️ Do not change once data
# has been written — different APP_SECRET = different HKDF key = unreadable
# settings. Generate ONCE per deployment and store securely.
APP_SECRET=change-me-generate-with-openssl-rand-hex-32

# Core-only KEK for platform identity signing keys stored in Postgres.
# Generate once with `openssl rand -hex 32`. Never distribute it to other apps.
CLOUD_IDENTITY_KEY_ENCRYPTION_KEY=change-me-generate-with-openssl-rand-hex-32
# Core only: pre-distribute a new KEK here before promoting it to current.
CLOUD_IDENTITY_NEXT_KEY=
# Core only: set during an explicit rolling KEK rewrap, then remove it.
CLOUD_IDENTITY_PREVIOUS_KEY=

# Core and OAuth only: generate independently with `openssl rand -hex 32`.
# Required for host-run OAuth; Compose supplies a development-only default.
CLOUD_OAUTH_BROKER_SECRET=

# Host-run broker callers: use the direct Core listener origin, not the gateway.
# Required for OAuth issuance and mandate-backed background work.
CLOUD_CORE_INTERNAL_ORIGIN=
# Provision a separate app-bound credential through Core's admin workload API:
# Background apps such as mail need identity:invoke. OAuth does not use this.
CLOUD_APP_CREDENTIAL=

# Optional private JWKS transport origins: direct Core and OAuth listeners.
# Leave empty to fetch public verification keys from the public issuer origin.
CLOUD_IDENTITY_JWKS_ORIGIN=
CLOUD_OAUTH_JWKS_ORIGIN=

# Docker Compose inputs only (not host-run runtime variable names).
# Compose passes the Mail token only to Mail as CLOUD_APP_CREDENTIAL
# and already supplies the private Core and JWKS origins.
# Required when using Mail incoming automations:
CLOUD_MAIL_APP_CREDENTIAL=

# FreeIPA
FREEIPA_URL=freeipa.example.com
FREEIPA_SVC_USER=svc-cloud
FREEIPA_SVC_PASSWORD=change-me

# Access groups
GROUPS_ADMIN=sysadmins
GROUPS_BASE_SYNC=users,all-accounts
GROUPS_BASE_IPA_REALM=users
GROUPS_EXCLUDED=editors,trust admins,admins,service_accounts,all-accounts

# Filegate
FILEGATE_URL=http://localhost:4000
FILEGATE_TOKEN=change-me