# Copy to an operator-controlled 0600 file outside source control.
# Default local engineering build. Enterprise delivery may set an approved
# immutable digest and EDGE_PULL_POLICY=always after artifact verification.
EDGE_IMAGE=dataops-edge:local
EDGE_PULL_POLICY=build
EDGE_CONFIG_DIR=/opt/dataops-edge/config
EDGE_QUEUE_DIR=/opt/dataops-edge/queue
EDGE_ARTIFACT_DIR=/opt/dataops-edge/artifacts
EDGE_RELEASE_DIR=/opt/dataops-edge/releases
EDGE_SECRET_DIR=/opt/dataops-edge/secrets
EDGE_CERTIFICATE_DIR=/opt/dataops-edge/certificates
EDGE_SIGNING_KEY_DIR=/opt/dataops-edge/signing
EDGE_RUNTIME_UID=65532
EDGE_RUNTIME_GID=65532

# Exact origins and host allowlists; wildcard and HTTP values are rejected by runtime policy.
EDGE_CONTROL_ORIGIN=https://control.example.invalid
EDGE_ALLOWED_CONTROL_HOSTS=control.example.invalid
EDGE_PROXY_ORIGIN=
EDGE_ALLOWED_PROXY_HOSTS=

# Paths are inside the container. Credential bytes are mounted, never placed here.
EDGE_CLIENT_PRIVATE_KEY_PATH=/run/edge/secrets/client.key
EDGE_SERVER_CRL_PATH=/run/edge/certificates/control-plane-server.crl.pem
EDGE_HEALTH_PATH=/run/edge/tmp/health.json
EDGE_POLL_INTERVAL_SECONDS=5
EDGE_LOG_LEVEL=INFO
EDGE_LOG_MAX_BYTES=10485760
EDGE_LOG_BACKUP_COUNT=3