# AWS Configuration
AWS_REGION=us-east-1
BEDROCK_MODEL_ID=us.anthropic.claude-sonnet-4-5-20250929-v1:0

BEDROCK_STREAMING=false

# AWS SES Configuration
SES_SENDER_EMAIL=your-verified-email@gmail.com
SES_REGION=us-east-1

# Keycloak Configuration
KEYCLOAK_URL=https://your-keycloak-server:8443
KEYCLOAK_REALM=mcp-realm
KEYCLOAK_CLIENT_ID=mcp-app-client
KEYCLOAK_CLIENT_SECRET=your-keycloak-client-secret
KEYCLOAK_ADMIN_USER=admin
KEYCLOAK_ADMIN_PASSWORD=your-keycloak-admin-password
# RFC 8693 token exchange: the login token is downscoped to this audience so the
# MCP server can reject a leaked full-session token and no other agent can access
# the MCP Server. Required standard token exchange enabled on the IDP, client,
# and the audience client + optional scope provisioned (scripts/setup does this 
#automatically).
KEYCLOAK_TOKEN_AUDIENCE=mcp-server
KEYCLOAK_TOKEN_EXCHANGE_SCOPE=mcp-audience

# EJBCA Configuration
EJBCA_URL=https://your-ejbca-server
EJBCA_CA_NAME=UserCA
EJBCA_CERT_PROFILE=ShortLivedUserCert
EJBCA_END_ENTITY_PROFILE=UserCertProfile
EJBCA_API_ADMIN_CERT_PATH=./certs/api-admin.p12
EJBCA_API_ADMIN_CERT_PASSWORD=your-p12-password
CERT_VALIDITY_DAYS=7
# Issuing CA cert (PEM). Defaults to certs/UserCA.pem.
# EJBCA_ISSUING_CA_CERT=./certs/UserCA.pem

# MySQL Database Configuration
RDS_HOST=your-rds-endpoint.rds.amazonaws.com
RDS_PORT=3306
RDS_USER=admin
RDS_PASS=your-database-password
RDS_DB=mysqldb

# Application Configuration
APP_SECRET_KEY=generate-a-random-secret-key-here

# TLS Certificate Verification
# By default, TLS verification is ENABLED using the system CA bundle.
# 
# For private/self-signed CAs: Set TLS_CA_CERT_PATH to your CA certificate path
# TLS_CA_CERT_PATH=/path/to/your/ca-bundle.pem
#
# For development ONLY (INSECURE): Explicitly disable TLS verification
# WARNING: Never set TLS_VERIFY_DISABLED=true in production!
# TLS_VERIFY_DISABLED=true
TLS_CA_CERT_PATH=