# ============================================================ # DevOps AI Agent — Environment Configuration # Copy to .env and fill in your values # ============================================================ # --- REQUIRED --- ANTHROPIC_API_KEY=sk-ant-... SLACK_WEBHOOK_URL=https://hooks.slack.com/services/... SLACK_APPROVAL_CHANNEL=#devops-approvals # Required when SLACK interactive approvals are enabled (validates /slack/action requests) SLACK_SIGNING_SECRET= # --- BEHAVIOR & SAFETY --- # IMPORTANT: Read SECURITY_POLICY.md before changing these settings # Set to "true" only after you trust the agent's decisions # RECOMMENDED: Keep false - agent will send notifications for approval AUTO_APPLY=false # Max AI reasoning steps per incident (prevents runaway loops) MAX_AGENT_STEPS=10 # Emergency stop - set to true to disable all agent operations AGENT_EMERGENCY_STOP=false # Require human Slack approval for these action types REQUIRE_APPROVAL_FOR=rollback,scale_down,delete,exec # DevSecOps Settings ENABLE_SECURITY_SCANNING=true ENABLE_COMPLIANCE_CHECKS=true COMPLIANCE_FRAMEWORKS=CIS,SOC2 # Database collection (OPTIONAL — disabled by default for security / sensitive data) # When false: no RDS, Cloud SQL, Azure SQL, DynamoDB, Cosmos DB, Redis/Memorystore diagnostics # Agent can still fix connection pool timeouts, app restarts, and network issues without DB access ENABLE_DATABASE_COLLECTION=false # --- KUBERNETES --- # Comma-separated namespaces the agent can act on ALLOWED_NAMESPACES=default,staging # SSH target for remote server incidents (centralized agent) # Format: hostname-or-ip — SSH_REMOTE_USER is prepended automatically SSH_REMOTE_USER=ubuntu # Path to known_hosts file (recommended for production) # SSH_KNOWN_HOSTS=/home/agent/.ssh/known_hosts # Set to false only for dev/lab (disables host key verification) SSH_STRICT_HOST_KEY_CHECKING=true # Mount ~/.ssh keys into agent container for passwordless access # Leave empty to use in-cluster config KUBECONFIG= # Helm CLI (for helm release incidents) HELM_BIN=helm # Terraform read-only diagnostics (for terraform/iac incidents) TERRAFORM_BIN=terraform # Default workspace when webhook does not include workspace_path # TERRAFORM_WORKSPACE_DIR=/opt/terraform/live/prod # --- CI/CD PLATFORMS --- # GitHub (existing) GITHUB_TOKEN=ghp_... GITHUB_ORG=your-org # GitLab GITLAB_TOKEN=glpat-... GITLAB_URL=https://gitlab.com # For self-hosted GitLab, set: GITLAB_URL=https://gitlab.yourcompany.com # Jenkins JENKINS_URL=https://jenkins.yourcompany.com JENKINS_USERNAME=admin JENKINS_API_TOKEN=... # Bamboo BAMBOO_URL=https://bamboo.yourcompany.com BAMBOO_USERNAME=admin BAMBOO_PASSWORD=... # Azure DevOps AZURE_DEVOPS_ORG=your-org AZURE_DEVOPS_PAT=... # --- ARGOCD --- ARGOCD_SERVER_URL=https://argocd.yourcompany.com ARGOCD_AUTH_TOKEN=... # Get token with: argocd account generate-token # --- CLOUD PROVIDERS --- # AWS AWS_REGION=us-east-1 # AWS credentials via environment (AWS_ACCESS_KEY_ID, AWS_SECRET_ACCESS_KEY) # or use IAM roles for production # GCP GCP_PROJECT_ID=your-project-id # GCP credentials via GOOGLE_APPLICATION_CREDENTIALS=/path/to/service-account.json # or use service account attached to compute instance # Azure AZURE_SUBSCRIPTION_ID=... AZURE_TENANT_ID=... AZURE_CLIENT_ID=... AZURE_CLIENT_SECRET=... # or use managed identity in production # --- NOTIFICATIONS --- # Email Alerts (CRITICAL for dangerous operation notifications) EMAIL_ENABLED=true EMAIL_SMTP_HOST=smtp.gmail.com EMAIL_SMTP_PORT=587 EMAIL_SMTP_USER=devops-agent@yourcompany.com EMAIL_SMTP_PASSWORD=your-app-password EMAIL_FROM=devops-agent@yourcompany.com EMAIL_TO=sre-team@yourcompany.com,devops-lead@yourcompany.com EMAIL_CC=security-team@yourcompany.com # PagerDuty PAGERDUTY_TOKEN= PAGERDUTY_SERVICE_ID= # --- SERVER (for webhook endpoint) --- PORT=8000 LOG_LEVEL=INFO # Shared secret for GitHub, Alertmanager, and manual webhook HMAC (X-Hub-Signature-256 or X-Webhook-Signature) WEBHOOK_SECRET=change-me-to-random-string # --- ORGANIZATION --- # Default org for incident scoping, storage paths, and documentation ORG_ID=your-org # Comma-separated list of orgs for multi-tenant queue worker ORG_IDS= # --- CLOUD-AGNOSTIC STORAGE --- # Provider: memory (dev), s3, minio, gcs, azure STORAGE_PROVIDER=memory STORAGE_BUCKET=devops-agent-data # AWS S3 # STORAGE_PROVIDER=s3 # STORAGE_BUCKET=your-bucket # AWS_REGION=us-east-1 # MinIO (S3-compatible) # STORAGE_PROVIDER=minio # STORAGE_BUCKET=devops-agent # STORAGE_ENDPOINT_URL=http://minio:9000 # STORAGE_ACCESS_KEY=minioadmin # STORAGE_SECRET_KEY=minioadmin # GCP Cloud Storage # STORAGE_PROVIDER=gcs # STORAGE_BUCKET=your-bucket # GCP_PROJECT_ID=your-project-id # Azure Blob Storage # STORAGE_PROVIDER=azure # STORAGE_BUCKET=devops-agent # AZURE_STORAGE_CONNECTION_STRING=DefaultEndpointsProtocol=https;... # Audit/log retention in cloud storage (days, 0=disable cleanup) AUDIT_RETENTION_DAYS=90 # Incident queue worker poll interval (seconds) QUEUE_POLL_INTERVAL_SEC=5 # Claude API resilience CLAUDE_API_RETRIES=3 CLAUDE_RETRY_DELAY_SEC=2 CLAUDE_MODEL=claude-sonnet-4-20250514 # Org documentation loaded into agent context MAX_DOC_CONTEXT_CHARS=12000 MAX_DOCS_IN_CONTEXT=5 # --- ESCALATION & TICKETING --- # Auto-create tickets / notify team when agent cannot resolve ESCALATION_ENABLED=true ESCALATION_TIMEOUT_MINUTES=10 # Channels: slack, email, jira, zoho (comma-separated) ESCALATION_CHANNELS=slack,email ESCALATION_ON_DB_ISSUES=true ESCALATION_ON_UNRESOLVED=true ESCALATION_ON_AI_FAILURE=true # Jira (optional) JIRA_ENABLED=false JIRA_URL=https://yourorg.atlassian.net JIRA_EMAIL=devops-agent@yourcompany.com JIRA_API_TOKEN= JIRA_PROJECT_KEY=OPS JIRA_ISSUE_TYPE=Task # Zoho Desk (optional) ZOHO_ENABLED=false ZOHO_DESK_ORG_ID= ZOHO_ACCESS_TOKEN= ZOHO_DEPARTMENT_ID= ZOHO_CONTACT_EMAIL=devops@yourcompany.com ZOHO_DESK_URL=https://desk.zoho.com/api/v1