# KiCI orchestrator env file — bare-metal install.
#
# After filling in the three placeholder values below, install + start the
# orchestrator via:
#
#   kici-admin orchestrator install --env-file ./kici-orchestrator.env
#   kici-admin orchestrator start
#
# Full walkthrough: docs/user/quickstart/bare-metal.md.

# Operating mode. Leave as `platform` to route webhooks through api.kici.dev's
# relay (the supported setup for this quickstart).
KICI_MODE=platform

# Platform relay URL + auth token. Mint the token at
# app.kici.dev → Settings → Orchestrators → New orchestrator.
KICI_PLATFORM_URL=wss://api.kici.dev/ws
KICI_PLATFORM_TOKEN=kici_ok_REPLACE_ME_WITH_TOKEN_FROM_DASHBOARD

# Database connection string. Points at a local PostgreSQL 18 reachable on
# 127.0.0.1:5432 — whether that's the recommended single-container Postgres
# (docker compose) or a native apt install. See step 3 of the quickstart.
# Prefilled with the loopback-only stub password `kici-local`; change it only
# if you set a custom DB password in step 3.
KICI_DATABASE_URL=postgres://kici:kici-local@127.0.0.1:5432/kici

# Encryption key for secrets at rest. Must be 64 hex chars.
#   openssl rand -hex 32
KICI_SECRET_KEY=REPLACE_ME_WITH_64_HEX_CHARS

# Bootstrap admin token — first-time auth for the `kici-admin` CLI.
#   openssl rand -hex 32
# Rotate / disable once you've added regular API keys via `kici-admin auth`.
KICI_BOOTSTRAP_ADMIN_TOKEN=REPLACE_ME_WITH_RANDOM_TOKEN

# HTTP port the orchestrator listens on. Default 4000.
KICI_PORT=4000

# Log level. `info` is a good default; bump to `debug` when investigating.
KICI_LOG_LEVEL=info

# Cache storage — the SeaweedFS container from step 3. Required for
# `kici run remote`. Three endpoints for three vantage points (mirrors the
# compose quickstart):
#   ENDPOINT          — the native orchestrator on this host → loopback.
#   UPLOAD_ENDPOINT   — your local `kici` CLI uploading the overlay → loopback.
#   EXTERNAL_ENDPOINT — the address baked into the presigned URL handed to
#                       spawned AGENTS. A `container`-scaler agent runs in its
#                       own network namespace, so `localhost` there is the
#                       container's empty loopback (→ ECONNREFUSED). It must be
#                       an address the agent can reach: the container scaler
#                       injects `host.docker.internal:host-gateway`, so
#                       `http://host.docker.internal:8333` works. NOTE: a
#                       `bare-metal`-scaler agent is a host PROCESS where
#                       `host.docker.internal` does NOT resolve — if you run the
#                       bare-metal scaler, set this to the host's LAN address
#                       instead (e.g. http://<host-ip>:8333), reachable from
#                       both contexts. Either way SeaweedFS must be published
#                       beyond loopback (see docker-compose.postgres.yaml).
KICI_STORAGE_TYPE=s3
KICI_STORAGE_BUCKET=kici-cache
KICI_STORAGE_ENDPOINT=http://localhost:8333
KICI_STORAGE_UPLOAD_ENDPOINT=http://localhost:8333
KICI_STORAGE_EXTERNAL_ENDPOINT=http://host.docker.internal:8333
KICI_STORAGE_REGION=us-east-1
KICI_STORAGE_FORCE_PATH_STYLE=true
AWS_ACCESS_KEY_ID=kici-local
AWS_SECRET_ACCESS_KEY=kici-local-secret