.env.example

# Copy to .env and adjust as needed. Every variable below has a default (see
# README.md for the full description of each); nothing here is required to
# run `docker compose -f docker-compose.yml up --build`. Prose documentation
# — what each variable does and why — lives in README.md; keep this file a
# bare list so the two cannot drift into contradiction.

# --- Storage (see README "Storage") ---
SCHEMA_STORAGE=postgres
DATABASE_URL=postgres://sulo:sulo@localhost:5432/sulo
DATABASE_POOL_MAX=10

# --- Postgres container (docker-compose.yml "db" service) ---
POSTGRES_PASSWORD=sulo

# --- Rate limiting ---
RATE_LIMIT_ENABLED=true

# --- Authentication (see README "Authentication") ---
AUTH_ISSUER=http://localhost:8088/realms/sulo
# In-network address for the server's own JWKS fetch — NOT the same as
# AUTH_ISSUER in a real deployment (that one is the browser-facing URL).
# Defaults to deriving from AUTH_ISSUER, which is wrong outside a single-host
# setup — see README "Authentication" before deploying anywhere containerised.
AUTH_JWKS_URI=http://keycloak:8080/realms/sulo/protocol/openid-connect/certs
AUTH_AUDIENCE=sulo-api
AUTH_CLIENT_ID=sulo-spa
AUTH_USER_CACHE_TTL_MS=60000
# false lets the API boot even if Keycloak is briefly unreachable (per-request
# JWKS resolution then heals itself); true (default) fails the boot instead.
AUTH_REQUIRE_JWKS_AT_BOOT=true
# Unset disables this entirely (admin managed by hand via PATCH /admin/users/:id).
AUTH_ADMIN_GROUP=

# --- Observability (see README "Observability") ---
# Unset disables OpenTelemetry entirely (no SDK started, zero overhead).
# Point it at a collector to get traces; every other OTEL_* variable
# (OTEL_SERVICE_NAME, OTEL_TRACES_SAMPLER, OTEL_EXPORTER_OTLP_HEADERS, ...)
# is read directly from the environment by the SDK itself.
OTEL_EXPORTER_OTLP_ENDPOINT=

# --- Keycloak bootstrap admin (start-dev only, not production-ready) ---
KEYCLOAK_ADMIN=admin
KEYCLOAK_ADMIN_PASSWORD=admin

# --- Identity broker secrets, consumed by docker/keycloak/configure-idps.sh ---
# Unset (or empty) disables the corresponding provider.
GITHUB_CLIENT_ID=
GITHUB_CLIENT_SECRET=
ORCID_CLIENT_ID=
ORCID_CLIENT_SECRET=