# Quickstart environment variables for `docker compose`.
# Copy to `.env` and adjust for your environment.
#
# IMPORTANT:
# - Never commit real secrets.
# - Executor tokens are passwords; rotate if leaked.

# -----------------------------------------------------------------------------
# Core URLs (Console runtime config)
# -----------------------------------------------------------------------------
# Use same-origin paths behind the bundled Nginx reverse proxy (avoids browser CORS).
# Requests will go to `http(s)://<host>:<CONSOLE_PORT>/api/*` and `/auth/*`.
SECRUX_API_BASE_URL=/api
SECRUX_AUTH_MODE_UI=keycloak
SECRUX_OIDC_BASE_URL=/auth
SECRUX_OIDC_REALM=secrux
SECRUX_OIDC_CLIENT_ID=secrux-console
SECRUX_OIDC_SCOPE=openid
SECRUX_APP_VERSION=dev

# -----------------------------------------------------------------------------
# Web (Vite dev only) - uncomment for `npm run dev`
# -----------------------------------------------------------------------------
# VITE_API_BASE_URL=http://localhost:8080
# VITE_AUTH_MODE=keycloak
# VITE_OIDC_BASE_URL=http://localhost:8081
# VITE_OIDC_REALM=secrux
# VITE_OIDC_CLIENT_ID=secrux-console
# VITE_OIDC_SCOPE=
# VITE_APP_VERSION=dev
# VITE_DEV_PORT=5173

# -----------------------------------------------------------------------------
# Images (optional)
# -----------------------------------------------------------------------------
# Override these if you publish images under a different registry/namespace.
SECRUX_SERVER_IMAGE=ghcr.io/securitycrux/secrux-server:latest
SECRUX_WEB_IMAGE=ghcr.io/securitycrux/secrux-web:latest
SECRUX_AI_IMAGE=ghcr.io/securitycrux/secrux-ai:latest

# -----------------------------------------------------------------------------
# Postgres (control plane)
# -----------------------------------------------------------------------------
POSTGRES_DB=secrux
POSTGRES_USER=secrux
POSTGRES_PASSWORD=secrux

# -----------------------------------------------------------------------------
# Keycloak (dev admin for container)
# -----------------------------------------------------------------------------
KEYCLOAK_ADMIN=admin
KEYCLOAK_ADMIN_PASSWORD=admin

# -----------------------------------------------------------------------------
# Secrux Server
# -----------------------------------------------------------------------------
SECRUX_SERVER_PORT=8080
SECRUX_KAFKA_BOOTSTRAP_SERVERS=kafka:29092

# Auth (Keycloak)
SECRUX_AUTH_MODE=KEYCLOAK
SECRUX_AUTH_ISSUER_URI=http://keycloak:8081/realms/secrux
# Accept additional issuer values (comma-separated). Useful when Keycloak is accessed via localhost in the browser.
SECRUX_AUTH_ISSUER_ALIASES=http://localhost:8081/realms/secrux
SECRUX_AUTH_AUDIENCE=secrux-api

# Tenant mode
# - multi-tenant (default): require tenant_id claim or user directory mapping.
# - single-tenant: allow missing tenant_id claim; all requests use DEFAULT_TENANT_ID.
# SECRUX_TENANT_MODE=multi-tenant
# SECRUX_TENANT_DEFAULT_TENANT_ID=11111111-1111-1111-1111-111111111111

# URL that executors should use to reach the API for download/upload endpoints.
# Must be reachable from executor hosts (use an absolute URL; do NOT set to `/api`).
# Examples:
#   SECRUX_EXECUTOR_API_BASE_URL=http://10.0.0.100:8080
#   SECRUX_EXECUTOR_API_BASE_URL=http://10.0.0.100/api   # if you only expose the Nginx proxy port
SECRUX_EXECUTOR_API_BASE_URL=http://localhost:8080

# Encryption key for stored credentials (REQUIRED for production; quickstart can use a dev value)
SECRUX_CRYPTO_SECRET=change-me-in-production

# -----------------------------------------------------------------------------
# Upload storage (optional)
# -----------------------------------------------------------------------------
# SECRUX_UPLOAD_BACKEND=LOCAL
# SECRUX_UPLOAD_ROOT=build/uploads
# SECRUX_UPLOAD_CACHE_DIR=build/uploads/cache
# SECRUX_UPLOAD_MAX_FILE_SIZE_MB=50
# SECRUX_UPLOAD_TASK_DAYS=7
# SECRUX_UPLOAD_REPO_SNAPSHOT_DAYS=0
# SECRUX_UPLOAD_EXECUTOR_RESULT_DAYS=7
# SECRUX_UPLOAD_PRESIGN_DOWNLOAD_ENABLED=true
# SECRUX_UPLOAD_PRESIGN_TTL_SECONDS=300
# SECRUX_UPLOAD_SCAN_ENABLED=false
# SECRUX_UPLOAD_SCAN_COMMAND=
# SECRUX_UPLOAD_SCAN_TIMEOUT_SECONDS=60

# S3/MinIO config (when SECRUX_UPLOAD_BACKEND=S3)
# MINIO_ROOT_USER=minioadmin
# MINIO_ROOT_PASSWORD=minioadmin
# MINIO_BUCKET=secrux-uploads
# MINIO_PORT=9000
# MINIO_CONSOLE_PORT=9001
# SECRUX_UPLOAD_S3_BUCKET=secrux-uploads
# SECRUX_UPLOAD_S3_ENDPOINT=http://minio:9000
# SECRUX_UPLOAD_S3_REGION=us-east-1
# SECRUX_UPLOAD_S3_ACCESS_KEY=minioadmin
# SECRUX_UPLOAD_S3_SECRET_KEY=minioadmin
# SECRUX_UPLOAD_S3_PREFIX=secrux/uploads
# SECRUX_UPLOAD_S3_PATH_STYLE_ACCESS=true

# Secrux Server AI config DB (jOOQ aiDslContext + spring.flyway.ai)
# Defaults to the bundled ai-postgres container in quickstart.
SECRUX_AI_DB_URL=jdbc:postgresql://ai-postgres:5432/secrux_ai
SECRUX_AI_DB_USERNAME=secrux_ai
SECRUX_AI_DB_PASSWORD=secrux_ai

# Secrux Server Asset DB (jOOQ assetDslContext + spring.flyway.asset)
# Defaults to the bundled asset-postgres container in quickstart.
SECRUX_ASSET_DB_URL=jdbc:postgresql://asset-postgres:5432/secrux_asset
SECRUX_ASSET_DB_USERNAME=secrux_asset
SECRUX_ASSET_DB_PASSWORD=secrux_asset

# AI service integration (server -> AI)
SECRUX_AI_SERVICE_BASE_URL=http://ai-service:5156
SECRUX_AI_SERVICE_TOKEN=local-dev-token

# -----------------------------------------------------------------------------
# Workflow Toolkit (optional)
# -----------------------------------------------------------------------------
# Standalone service for on-demand Code Audit tools (LSP/Joern gateway).
# If you run it in the same docker network, use the service name as host:
#   SECRUX_WORKFLOW_TOOLKIT_CODE_AUDIT_GATEWAY_URL=http://workflow-toolkit:5157/api/v1/code-audit/gateway
# Token must match the toolkit service config:
#   SECRUX_WORKFLOW_TOOLKIT_TOKEN=local-dev-token

# Executor Gateway (enabled by default in quickstart)
EXECUTOR_GATEWAY_ENABLED=true
EXECUTOR_GATEWAY_PORT=5155
# Optional: provide PEM cert/key for the gateway (recommended for remote executors).
# Quickstart helper:
#   ./gen-executor-gateway-certs.sh
# The compose mounts `./certs/executor-gateway` to `/certs/executor-gateway` by default.
EXECUTOR_GATEWAY_CERTIFICATE_PATH=/certs/executor-gateway/gateway.crt
EXECUTOR_GATEWAY_PRIVATE_KEY_PATH=/certs/executor-gateway/gateway.key

# -----------------------------------------------------------------------------
# AI service database (secrux-ai)
# -----------------------------------------------------------------------------
AI_POSTGRES_DB=secrux_ai
AI_POSTGRES_USER=secrux_ai
AI_POSTGRES_PASSWORD=secrux_ai
AI_DATABASE_URL=postgresql+psycopg://secrux_ai:secrux_ai@ai-postgres:5432/secrux_ai

# -----------------------------------------------------------------------------
# Asset module database (secrux-asset)
# -----------------------------------------------------------------------------
ASSET_POSTGRES_DB=secrux_asset
ASSET_POSTGRES_USER=secrux_asset
ASSET_POSTGRES_PASSWORD=secrux_asset

# Optional: LLM settings (leave empty to disable live LLM calls)
SECRUX_AI_LLM_BASE_URL=
SECRUX_AI_LLM_API_KEY=
SECRUX_AI_LLM_MODEL=

# Optional: prompt dump (debug)
# off | file | stdout
SECRUX_AI_PROMPT_DUMP=off
SECRUX_AI_PROMPT_DUMP_DIR=/app/storage/prompt-dumps

# AI runtime storage (container defaults; override for local dev if needed)
AI_MCP_STORAGE=/app/storage/mcps
AI_AGENT_STORAGE=/app/storage/agents

# Local dev hints (uncomment when running `uvicorn` on host)
# AI_DATABASE_URL=postgresql+psycopg://secrux_ai:secrux_ai@localhost:5433/secrux_ai
# AI_MCP_STORAGE=./apps/ai/storage/mcps
# AI_AGENT_STORAGE=./apps/ai/storage/agents
# SECRUX_AI_PROMPT_DUMP_DIR=./apps/ai/storage/prompt-dumps