# Optional external generative model. Leave empty for infrastructure-only tests.
DEEPSEEK_API_KEY=

# Required before using AI rule interpretation or creating rule drafts.
# Generate a dedicated value with: openssl rand -hex 32
RULE_GENERATION_RECEIPT_SECRET=replace-with-dedicated-64-hex-random-value

# Dedicated HMAC key for WP12 governance audit evidence seals.
# Generate independently with: openssl rand -hex 32
AUDIT_EVIDENCE_SECRET=replace-with-dedicated-64-hex-random-value
AUDIT_EVIDENCE_KEY_VERSION=v1
SECURITY_SIEM_HOST_ALLOWLIST=

# Create this key in the local n8n UI after owner setup, then restart backend.
N8N_API_KEY=

# External business data-source pools. This does not configure the platform DB.
DATASOURCE_CREDENTIAL_MASTER_KEY=replace-with-base64-32-byte-key
DATASOURCE_CREDENTIAL_KEY_VERSION=v1
DATASOURCE_POOL_SIZE=2
DATASOURCE_MAX_OVERFLOW=3
DATASOURCE_POOL_TIMEOUT=10
DATASOURCE_POOL_RECYCLE=1800
DATASOURCE_POOL_IDLE_TTL=900
DATASOURCE_MAX_IDLE_POOLS=20
DATASOURCE_QUERY_TIMEOUT=30
DATASOURCE_CERT_DIR=/etc/dataops-platform/datasource-certs

# Runner task tokens are short-lived and contain no data-source credentials.
RUNNER_TASK_TOKEN_SECRET=replace-with-at-least-32-random-bytes
RUNNER_HTTP_ALLOWED_HOSTS=

# Open only after disabled-deploy/canary/rollback/restart acceptance succeeds.
DATA_FACTORY_ACTIVATION_ENABLED=false

# DataOps MCP processes fail closed when any identity scope is empty.
# Generate a fresh UUID correlation ID for each agent session.
DATAOPS_MCP_SUBJECT=
DATAOPS_MCP_ROLES=
DATAOPS_MCP_BUSINESS_DOMAINS=
DATAOPS_MCP_ENVIRONMENTS=
DATAOPS_MCP_CORRELATION_ID=

# Stable local application images used by offline delivery.
DATAOPS_BACKEND_IMAGE=dataops-platform-backend:local
DATAOPS_RUNNER_IMAGE=dataops-platform-runner:local
DATAOPS_FRONTEND_IMAGE=dataops-platform-frontend:local
DATAOPS_LIGHTRAG_PROJECTOR_IMAGE=dataops-platform-lightrag-projector:local

# Published ports and network name can be isolated for a recovery rehearsal.
DATAOPS_POSTGRES_PORT=15432
SOURCE_POSTGRES_PORT=25432
SOURCE_MYSQL_PORT=23306
NEO4J_HTTP_PORT=17474
NEO4J_BOLT_PORT=17687
MINIO_API_PORT=19000
MINIO_CONSOLE_PORT=19001
N8N_PORT=15678
KESTRA_PORT=18080
RUNNER_PORT=15600
BACKEND_PORT=15500
FRONTEND_PORT=18183
DATAOPS_NETWORK_NAME=dataops-test-net