# ============================================================
# DevOps AI Agent — Environment Configuration
# Copy to .env and fill in your values
# ============================================================

# --- REQUIRED ---
ANTHROPIC_API_KEY=sk-ant-...
SLACK_WEBHOOK_URL=https://hooks.slack.com/services/...
SLACK_APPROVAL_CHANNEL=#devops-approvals
# Required when SLACK interactive approvals are enabled (validates /slack/action requests)
SLACK_SIGNING_SECRET=

# --- BEHAVIOR & SAFETY ---
# IMPORTANT: Read SECURITY_POLICY.md before changing these settings

# Set to "true" only after you trust the agent's decisions
# RECOMMENDED: Keep false - agent will send notifications for approval
AUTO_APPLY=false

# Max AI reasoning steps per incident (prevents runaway loops)
MAX_AGENT_STEPS=10

# Emergency stop - set to true to disable all agent operations
AGENT_EMERGENCY_STOP=false

# Require human Slack approval for these action types
REQUIRE_APPROVAL_FOR=rollback,scale_down,delete,exec

# DevSecOps Settings
ENABLE_SECURITY_SCANNING=true
ENABLE_COMPLIANCE_CHECKS=true
COMPLIANCE_FRAMEWORKS=CIS,SOC2

# Database collection (OPTIONAL — disabled by default for security / sensitive data)
# When false: no RDS, Cloud SQL, Azure SQL, DynamoDB, Cosmos DB, Redis/Memorystore diagnostics
# Agent can still fix connection pool timeouts, app restarts, and network issues without DB access
ENABLE_DATABASE_COLLECTION=false

# --- KUBERNETES ---
# Comma-separated namespaces the agent can act on
ALLOWED_NAMESPACES=default,staging
# SSH target for remote server incidents (centralized agent)
# Format: hostname-or-ip — SSH_REMOTE_USER is prepended automatically
SSH_REMOTE_USER=ubuntu
# Path to known_hosts file (recommended for production)
# SSH_KNOWN_HOSTS=/home/agent/.ssh/known_hosts
# Set to false only for dev/lab (disables host key verification)
SSH_STRICT_HOST_KEY_CHECKING=true
# Seconds to wait for the SSH TCP connect before giving up
SSH_CONNECT_TIMEOUT=10
# Mount ~/.ssh keys into agent container for passwordless access
# Leave empty to use in-cluster config
KUBECONFIG=

# Helm CLI (for helm release incidents)
HELM_BIN=helm

# Terraform read-only diagnostics (for terraform/iac incidents)
TERRAFORM_BIN=terraform
# Default workspace when webhook does not include workspace_path
# TERRAFORM_WORKSPACE_DIR=/opt/terraform/live/prod

# --- CI/CD PLATFORMS ---

# GitHub (existing)
GITHUB_TOKEN=ghp_...
GITHUB_ORG=your-org
# Override for GitHub Enterprise Server, e.g. https://github.example.com/api/v3
GITHUB_API_URL=https://api.github.com

# GitLab
GITLAB_TOKEN=glpat-...
GITLAB_URL=https://gitlab.com
# For self-hosted GitLab, set: GITLAB_URL=https://gitlab.yourcompany.com

# Jenkins
JENKINS_URL=https://jenkins.yourcompany.com
JENKINS_USERNAME=admin
JENKINS_API_TOKEN=...
JENKINS_SCM_PROVIDER=github
JENKINS_SCM_REPO=your-org/app

# Bamboo
BAMBOO_URL=https://bamboo.yourcompany.com
BAMBOO_USERNAME=admin
BAMBOO_PASSWORD=...
# Plan variable used by bamboo_increment_version / patch_bamboo_plan (default: version)
BAMBOO_VERSION_VARIABLE=version
# Git repo that holds bamboo-specs (PRs go here; Bamboo has no PR API)
# For AWS+Bitbucket stacks use bitbucket + workspace/repo_slug
BAMBOO_SCM_PROVIDER=bitbucket
BAMBOO_SPECS_REPO=your-workspace/bamboo-specs

# Azure DevOps
AZURE_DEVOPS_ORG=your-org
AZURE_DEVOPS_PAT=...
AZURE_DEVOPS_PROJECT=your-project

# Bitbucket Cloud (code review + SCM)
BITBUCKET_USERNAME=
BITBUCKET_APP_PASSWORD=
# Or workspace access token:
BITBUCKET_TOKEN=
BITBUCKET_API_URL=https://api.bitbucket.org/2.0

# Code review (GitHub / GitLab / Bitbucket / Azure DevOps / local git)
# Post reviews only when true (or AUTO_APPLY=true) and post_code_review dry_run=false
CODE_REVIEW_AUTO_POST=false
# Allow GitHub APPROVE event (default: force COMMENT)
CODE_REVIEW_ALLOW_APPROVE=false
CODE_REVIEW_MAX_DIFF_CHARS=80000
CODE_REVIEW_MAX_FILES=40
# Default workspace for platform=git reviews
CODE_REVIEW_WORKSPACE=

# Wildcard / DNS-01 certbot (used by renew_certificates)
CERTBOT_DNS_PLUGIN=
CERTBOT_DNS_CREDENTIALS=
CERTBOT_WILDCARD_DOMAINS=

# --- SAFE DISK / LOG CLEANUP ---
# Only journal shrink + aged rotated logs under /var/log. Production/app data is never deleted.
CLEANUP_LOG_MIN_AGE_DAYS=14
CLEANUP_JOURNAL_MAX_AGE_DAYS=7
CLEANUP_JOURNAL_MAX_SIZE=500M
# Extra protected path prefixes (comma-separated). These are never deleted.
CLEANUP_PROTECTED_PATHS=/var/www,/srv/prod,/data
# Cron schedule for install_log_cleanup_cron (default 03:00 daily)
LOG_CLEANUP_CRON=0 3 * * *

# --- ARGOCD ---
ARGOCD_SERVER_URL=https://argocd.yourcompany.com
ARGOCD_AUTH_TOKEN=...
# Get token with: argocd account generate-token
# Set to true ONLY for self-signed ArgoCD certs — disables TLS verification
ARGOCD_INSECURE_SKIP_VERIFY=false

# --- CLOUD PROVIDERS ---

# AWS
AWS_REGION=us-east-1
# AWS credentials via environment (AWS_ACCESS_KEY_ID, AWS_SECRET_ACCESS_KEY)
# or use IAM roles for production

# GCP
GCP_PROJECT_ID=your-project-id
# GCP credentials via GOOGLE_APPLICATION_CREDENTIALS=/path/to/service-account.json
# or use service account attached to compute instance

# Azure
AZURE_SUBSCRIPTION_ID=...
AZURE_TENANT_ID=...
AZURE_CLIENT_ID=...
AZURE_CLIENT_SECRET=...
# or use managed identity in production

# --- NOTIFICATIONS ---

# Optional: bot token for Slack API calls (channel lookups etc.). Nothing requires it
# today — notifications post via SLACK_WEBHOOK_URL only. OrgConfig persists it as an
# org credential when set, so leave empty unless a feature needs Slack API access.
SLACK_BOT_TOKEN=

# Email Alerts (CRITICAL for dangerous operation notifications)
EMAIL_ENABLED=true
EMAIL_SMTP_HOST=smtp.gmail.com
EMAIL_SMTP_PORT=587
EMAIL_SMTP_USER=devops-agent@yourcompany.com
EMAIL_SMTP_PASSWORD=your-app-password
EMAIL_FROM=devops-agent@yourcompany.com
EMAIL_TO=sre-team@yourcompany.com,devops-lead@yourcompany.com
EMAIL_CC=security-team@yourcompany.com

# --- SERVER (for webhook endpoint) ---
# Read by the `devops-agent serve` CLI. A variable already set in the shell
# environment wins over this file, and each is overridden by the
# --host / --port / --workers flags.
# Bind address — loopback by default; use 0.0.0.0 for Docker/K8s ingress
HOST=127.0.0.1
PORT=8000
# Uvicorn worker processes (forced to 1 when --reload is used)
UVICORN_WORKERS=2
LOG_LEVEL=INFO
# Shared secret for webhooks:
# - GitHub / Alertmanager / manual: HMAC X-Hub-Signature-256 or X-Webhook-Signature
# - GitLab: same value as Project → Webhooks → Secret token (sent as X-Gitlab-Token)
WEBHOOK_SECRET=change-me-to-random-string

# --- ORGANIZATION ---
# Default org for incident scoping, storage paths, and documentation
ORG_ID=your-org
# Comma-separated list of orgs for multi-tenant queue worker
ORG_IDS=

# --- CLOUD-AGNOSTIC STORAGE ---
# Provider: memory (dev), s3, minio, gcs, azure
STORAGE_PROVIDER=memory
STORAGE_BUCKET=devops-agent-data
# Legacy alias for STORAGE_BUCKET, kept for Azure-flavoured configs. Only used
# when STORAGE_BUCKET is unset; if neither is set the bucket is "devops-agent"
# STORAGE_CONTAINER=devops-agent

# AWS S3
# STORAGE_PROVIDER=s3
# STORAGE_BUCKET=your-bucket
# AWS_REGION=us-east-1

# MinIO (S3-compatible)
# STORAGE_PROVIDER=minio
# STORAGE_BUCKET=devops-agent
# STORAGE_ENDPOINT_URL=http://minio:9000
# STORAGE_ACCESS_KEY=minioadmin
# STORAGE_SECRET_KEY=minioadmin
#
# Legacy MINIO_* aliases — each is the fallback for the STORAGE_* name directly
# above it, used only when that one is unset. Prefer the STORAGE_* names.
# MINIO_ENDPOINT=http://minio:9000
# SECRET — MinIO access key
# MINIO_ACCESS_KEY=minioadmin
# SECRET — MinIO secret key
# MINIO_SECRET_KEY=minioadmin

# GCP Cloud Storage
# STORAGE_PROVIDER=gcs
# STORAGE_BUCKET=your-bucket
# GCP_PROJECT_ID=your-project-id

# Azure Blob Storage
# STORAGE_PROVIDER=azure
# STORAGE_BUCKET=devops-agent
# SECRET — full connection string; takes precedence over the two names below
# AZURE_STORAGE_CONNECTION_STRING=DefaultEndpointsProtocol=https;...
#
# Without a connection string the backend authenticates with
# DefaultAzureCredential (managed identity / az login) against one of:
# AZURE_STORAGE_ACCOUNT_URL=https://youraccount.blob.core.windows.net
# ...or just the account name, expanded to the URL above
# AZURE_STORAGE_ACCOUNT=youraccount

# Audit/log retention in cloud storage (days, 0=disable cleanup)
AUDIT_RETENTION_DAYS=90

# Incident queue worker poll interval (seconds)
QUEUE_POLL_INTERVAL_SEC=5

# Claude API resilience
CLAUDE_API_RETRIES=3
CLAUDE_RETRY_DELAY_SEC=2
CLAUDE_MODEL=claude-sonnet-4-20250514

# Org documentation loaded into agent context
MAX_DOC_CONTEXT_CHARS=12000
MAX_DOCS_IN_CONTEXT=5

# --- ESCALATION & TICKETING ---
# Auto-create tickets / notify team when agent cannot resolve
ESCALATION_ENABLED=true
ESCALATION_TIMEOUT_MINUTES=10
# Channels: slack, email, jira, zoho, pagerduty (comma-separated)
ESCALATION_CHANNELS=slack,email
ESCALATION_ON_DB_ISSUES=true
ESCALATION_ON_UNRESOLVED=true
ESCALATION_ON_AI_FAILURE=true

# Jira (optional)
JIRA_ENABLED=false
JIRA_URL=https://yourorg.atlassian.net
JIRA_EMAIL=devops-agent@yourcompany.com
JIRA_API_TOKEN=
JIRA_PROJECT_KEY=OPS
JIRA_ISSUE_TYPE=Task
# Map agent severity onto your Jira priority scheme (must match its names)
JIRA_PRIORITY_CRITICAL=Highest
JIRA_PRIORITY_HIGH=High
JIRA_PRIORITY_MEDIUM=Medium
JIRA_PRIORITY_LOW=Low

# Zoho Desk (optional)
ZOHO_ENABLED=false
ZOHO_DESK_ORG_ID=
ZOHO_ACCESS_TOKEN=
ZOHO_DEPARTMENT_ID=
ZOHO_CONTACT_EMAIL=devops@yourcompany.com
ZOHO_DESK_URL=https://desk.zoho.com/api/v1

# PagerDuty (optional)
PAGERDUTY_ENABLED=false
# REST API key (Integrations -> API Access Keys)
PAGERDUTY_TOKEN=
# Service the incidents are opened against, e.g. PSERVICE1
PAGERDUTY_SERVICE_ID=
# Email of a valid PagerDuty user — required by the REST API "From" header
PAGERDUTY_FROM_EMAIL=devops-agent@yourcompany.com
# Override for EU service regions, e.g. https://api.eu.pagerduty.com
PAGERDUTY_URL=https://api.pagerduty.com
# PagerDuty urgency used when our priority is "critical" (high or low)
PAGERDUTY_URGENCY_CRITICAL=high
# PagerDuty urgency used when our priority is "high" (high or low)
PAGERDUTY_URGENCY_HIGH=high
# PagerDuty urgency used when our priority is "medium" (high or low)
PAGERDUTY_URGENCY_MEDIUM=low
# PagerDuty urgency used when our priority is "low" (high or low)
PAGERDUTY_URGENCY_LOW=low
PAGERDUTY_SCHEDULE_ID=

# --- OBSERVABILITY ---
PROMETHEUS_URL=http://prometheus.monitoring.svc:9090
PROMETHEUS_TOKEN=
GRAFANA_URL=https://grafana.yourcompany.com
GRAFANA_TOKEN=
GRAFANA_DATASOURCE_UID=prometheus
DATADOG_API_KEY=
DATADOG_APP_KEY=
DATADOG_SITE=datadoghq.com
NEW_RELIC_API_KEY=
NEW_RELIC_ACCOUNT_ID=
TEMPO_URL=
JAEGER_URL=
STATUSPAGE_PAGE_ID=
STATUSPAGE_API_KEY=

# --- DATA STORES (optional; off unless collection flags are true) ---
ENABLE_DATA_STORE_COLLECTION=false
DATABASE_URL=
REDIS_HOST=
REDIS_PORT=6379
KAFKA_BOOTSTRAP=
KAFKA_REST_URL=
ELASTICSEARCH_URL=
ELASTICSEARCH_API_KEY=

# --- MCP SERVER ---
# Bind address and port for `devops-agent mcp --transport sse|streamable-http`
# (the default stdio transport ignores both). Values below are the CLI defaults.
# Leave these commented unless you need them: the server only seeds them when
# unset, so setting either here silently overrides `--host` / `--port`.
# FASTMCP_HOST=127.0.0.1
# FASTMCP_PORT=8090