# Copy to .env and fill in real values. Never commit .env.
# Workflow JSON files reference these names (never values).

# --- Core (DAGNATS_NATS_URL is the current name; NATS_URL still works) ---
# Must match DAGNATS_NATS_PORT below (and the published host port).
DAGNATS_NATS_URL=nats://127.0.0.1:4222
DAGNATS_API_URL=http://127.0.0.1:8080

# --- Ops approval webhook (optional) ---
# Shared token validated by internal/opshttp on POST /ops/approvals/{runID}.
OPS_HTTP_ADDR=
OPS_APPROVAL_TOKEN=

# --- Optional age-encrypted secrets file ---
# When set, internal/secret decrypts this file at worker startup and
# merges KEY=VALUE lines into the process environment, in memory
# (no plaintext file written; env wins on conflict).
# Per-client layout: secrets/<client-id>/env.age — see docs/secrets.md.
SECRETS_AGE_FILE=
AGE_IDENTITY_FILE=

# --- Per-client env (preferred over stuffing everything here) ---
# One file per client: env/<client-id>.env (gitignored), template at
# env/<client-id>.env.example. Select it with CLIENT_ID (worker loads
# env/$CLIENT_ID.env at startup) or DOTENV_FILE=/path/to.env.
CLIENT_ID=

# --- Ops notifications (platform-level; recipes reference names only) ---
# notify.webhook/slack/telegram/discord POST to these URLs via secret name.
# Client workflows use per-client secrets (ACME_SLACK_WEBHOOK_URL…);
# ops/ recipes and on_failure pages use these.
OPS_SLACK_WEBHOOK_URL=
OPS_TELEGRAM_WEBHOOK_URL=
OPS_DISCORD_WEBHOOK_URL=

# --- Optional LLM (OpenAI-compatible, shared platform secret) ---
LLM_API_KEY=
LLM_BASE_URL=https://api.openai.com/v1

# --- Compose host ports (change if 8080/4222 are already taken) ---
# A collision does not fail loudly: the CLI reads another NATS and runs stay queued.
DAGNATS_HTTP_PORT=8080
DAGNATS_NATS_PORT=4222

# --- dagnats console (required when bound to 0.0.0.0 in a container) ---
# Empty disables the console with console_disabled; set a password for basic auth.
DAGNATS_CONSOLE_PASSWORD=