.env.example

# ============================================================================
# Dev Health Ops - Environment Configuration
# ============================================================================
# Copy this file to .env and fill in your values.
# See docs/configuration.md for detailed documentation.

# ----------------------------------------------------------------------------
# Database (Dual-Database Architecture)
# ----------------------------------------------------------------------------
# See docs/architecture/database-architecture.md for details

# PostgreSQL - Semantic layer (users, orgs, settings, credentials)
# Required for: admin commands, user management, settings API, Alembic migrations
POSTGRES_URI="postgresql+asyncpg://postgres:postgres@localhost:5555/postgres"

# ClickHouse - Analytics layer (commits, PRs, work items, metrics)
# Required for: sync commands, metrics commands, GraphQL API
CLICKHOUSE_URI="clickhouse://ch:ch@localhost:8123/default"

# Legacy fallback (deprecated - use POSTGRES_URI and CLICKHOUSE_URI above)
# DATABASE_URI will auto-route based on connection string type
# DATABASE_URI="clickhouse://ch:ch@localhost:8123/default"
# DATABASE_URL="clickhouse://ch:ch@localhost:8123/default"

# Redis (for Celery workers and caching)
REDIS_URL="redis://localhost:6379/1"

# ----------------------------------------------------------------------------
# Sync dispatcher / worker routing
# ----------------------------------------------------------------------------
# Provider/cost-class queues are safe only when workers consume the matching
# queues. The bundled compose/Helm/Kubernetes deploy files already declare them.
PROVIDER_SYNC_QUEUES_ENABLED="true"
SYNC_COST_CLASS_QUEUES="true"
HIDE_MIGRATED_CHILD_CONFIGS="true"

# Unit dispatch safety caps and stale-lease windows.
SYNC_RUN_MAX_UNITS="1000"
SYNC_UNIT_CONCURRENCY_PER_BUCKET="8"
SYNC_UNIT_DISPATCH_STALE_SECONDS="900"
SYNC_UNIT_RUNNING_STALE_SECONDS="3600"
# Linear work-item backfill chunk cap (planner). Non-Linear backfills use the 7-day default.
LINEAR_BACKFILL_MAX_WINDOW_DAYS="14"
# Bounded expired-lease retry for eligible Linear work-item backfill units (CHAOS-2710).
SYNC_UNIT_EXPIRED_LEASE_MAX_RETRIES="1"
SYNC_UNIT_EXPIRED_LEASE_RETRY_BACKOFF_SECONDS="60"
SYNC_DISPATCH_REDISPATCH_COUNTDOWN="60"
SYNC_OUTBOX_CLAIM_TIMEOUT_SECONDS="300"
# CHAOS-3092 deleted the Celery provider-unit compute, so "no Celery consumer
# serves provider units" -- the assertion `active` encodes -- is unconditionally
# true. Shipped active in every deploy shape; shadow selects the strand and
# writes nothing, which is how run 115e6246 stayed open for thirteen hours.
SYNC_UNRECLAIMABLE_SWEEP="active"
SYNC_WATERMARK_OVERLAP="0"

# Provider sync budget guard. Values are abstract reservation units, not raw
# provider API work. Setting SYNC_BUDGET_BUCKET_LIMITS enables enforcement.
SYNC_BUDGET_BUCKET_LIMITS='{"github:rest_core":250,"github:graphql_cost":500,"github:contents_blob":100,"github:secondary_abuse_risk":25,"jira:search:jira_jql":250,"jira:rest_core:jira_issue_enrichment":250,"jira:rest_core:jira_worklogs":100,"jira:graphql_cost:jira_gql_enrichment":250,"linear:graphql_cost":500}'
SYNC_BUDGET_DEFAULT_LIMIT="1000000"
SYNC_BUDGET_DEFERRAL_SECONDS="60"
SYNC_BUDGET_DEFERRAL_JITTER_SECONDS="5"

# Optional dry-run/observation-only budget logging knobs.
# SYNC_BUDGET_DRY_RUN_BUCKET_LIMITS='{"github:rest_core":250,"github:graphql_cost":500,"github:contents_blob":100,"github:secondary_abuse_risk":25,"jira:search:jira_jql":250,"jira:rest_core:jira_issue_enrichment":250,"jira:rest_core:jira_worklogs":100,"jira:graphql_cost:jira_gql_enrichment":250,"linear:graphql_cost":500}'
SYNC_BUDGET_DRY_RUN_DEFAULT_LIMIT="1000000"
SYNC_BUDGET_DRY_RUN_DEFERRAL_SECONDS="60"

# ----------------------------------------------------------------------------
# GitHub
# ----------------------------------------------------------------------------
# Personal access token with repo read permissions
# GITHUB_TOKEN="ghp_xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx"
# GitHub App install/connect flow. The App's Client ID/secret can also be reused
# for Sign in with GitHub; copy them into SOCIAL_GITHUB_* below and
# AUTH_GITHUB_* in web/.env.
# GITHUB_APP_SLUG="dev-health"
# GITHUB_APP_ID="123456"
# GITHUB_APP_CLIENT_ID="Iv1.xxxxxxxxxxxxxxxx"
# GITHUB_APP_CLIENT_SECRET="github_app_client_secret"
# GITHUB_APP_CALLBACK_URL="http://localhost:3000/org/admin/integrations/github-app/callback"
# GitHub App auth fallback for CLI/worker contexts uses the key-path form.
# Inline private keys are used by the API GitHub App integration config path.
# Prefer stored credentials for multi-tenant deployments.
# GITHUB_APP_PRIVATE_KEY_PATH="/secure/path/dev-health-github-app.pem"
# GITHUB_APP_PRIVATE_KEY="-----BEGIN PRIVATE KEY-----..."
# GITHUB_APP_INSTALLATION_ID="987654"
# GITHUB_BASE_URL="https://api.github.com"
# Linear linkback bot allowlist used when extracting PR↔Linear links.
GITHUB_LINEAR_LINKBACK_BOTS="linear[bot]"

# ----------------------------------------------------------------------------
# GitLab
# ----------------------------------------------------------------------------
# Personal access token with api scope
# GITLAB_TOKEN="glpat-xxxxxxxxxxxxxxxxxxxx"

# ----------------------------------------------------------------------------
# Jira / Atlassian
# ----------------------------------------------------------------------------
# Legacy vars (used by current JiraClient - will be deprecated)
JIRA_BASE_URL="your-org.atlassian.net"
JIRA_EMAIL="you@example.com"
JIRA_API_TOKEN="your-api-token"

# New atlassian-client vars (Phase 1+ will use these)
# Basic auth (Jira Cloud) - email + API token
ATLASSIAN_EMAIL="you@example.com"
ATLASSIAN_API_TOKEN="your-api-token"
ATLASSIAN_JIRA_BASE_URL="https://your-org.atlassian.net"
ATLASSIAN_CLOUD_ID="your-cloud-id"

# Optional: Custom field IDs for story points and sprints
# ATLASSIAN_JIRA_STORY_POINTS_FIELD="customfield_10016"
# ATLASSIAN_JIRA_SPRINT_IDS_FIELD="customfield_10020"

# OAuth (for AGG GraphQL - Phase 5)
# ATLASSIAN_OAUTH_ACCESS_TOKEN="your-oauth-token"
# ATLASSIAN_OAUTH_REFRESH_TOKEN="your-refresh-token"
# ATLASSIAN_CLIENT_ID="your-client-id"
# ATLASSIAN_CLIENT_SECRET="your-client-secret"
# ATLASSIAN_OAUTH_GQL_ENDPOINT="https://api.atlassian.com/graphql"

# GraphQL gateway (tenant) endpoint for AGG
# ATLASSIAN_GQL_BASE_URL="https://your-org.atlassian.net/gateway/api/graphql"

# Optional: GraphQL experimental APIs (comma-separated)
# ATLASSIAN_GQL_EXPERIMENTAL_APIS="jira-software"

# Optional: Cookie auth for AGG (JSON object)
# ATLASSIAN_COOKIES_JSON='{"cloud.session.token":"..."}'

# Jira sync options
# JIRA_FETCH_COMMENTS="true"        # Fetch issue comments
# JIRA_COMMENTS_LIMIT="0"           # Max comments per issue (0 = no limit)
# JIRA_FETCH_WORKLOGS="false"       # Fetch issue worklogs (time tracking)
# JIRA_FETCH_BOARD_SPRINTS="false"  # Fetch all sprints via board iteration
# JIRA_OPS_PROJECT_TYPES="SERVICE_DESK"  # Jira project types for ops team sync

# ----------------------------------------------------------------------------
# Linear
# ----------------------------------------------------------------------------
# Required for Linear work-item sync provider
# LINEAR_API_KEY="lin_api_xxxxxxxxxxxxxxxxxx"
# Optional: max comments fetched per Linear issue (0 means no limit)
# LINEAR_COMMENTS_LIMIT="0"
# Additional trusted SCM hosts for Linear issue attachment link parsing.
# Public GitHub/GitLab hosts are trusted by default.
# LINEAR_TRUSTED_SCM_HOSTS="git.example.com,gitlab.example.com"

# ----------------------------------------------------------------------------
# PagerDuty (incident-response provider — read-only V1)
# ----------------------------------------------------------------------------
# Registered PagerDuty OAuth app credentials. OAuth is the preferred connection;
# API-token entry remains a compatibility fallback. Only read scopes are used.
# Set the same app credentials on the API and every PagerDuty sync worker.
# See docs/user-guide/pagerduty-oauth-app-setup.md for registration and scopes.
# PAGER_DUTY_CLIENT_ID="your-pagerduty-app-client-id"
# PAGER_DUTY_SECRET="your-pagerduty-app-client-secret"
# Browser-facing authorization-code callback. Required for the interactive OAuth
# flow, unused by client credentials, and must exactly match PagerDuty App Registration.
# PAGER_DUTY_REDIRECT_URI="https://your-host/org/admin/integrations/pagerduty/callback"
# Optional API-token fallback + account qualifiers (region: us or eu)
# PAGERDUTY_API_TOKEN=""
# PAGERDUTY_SUBDOMAIN="your-account"
# PAGERDUTY_REGION="us"

# ----------------------------------------------------------------------------
# Stripe Billing (SaaS mode)
# ----------------------------------------------------------------------------
# Required for checkout, subscriptions, and billing portal.
# Get test keys from https://dashboard.stripe.com/test/apikeys
# STRIPE_SECRET_KEY="sk_test_..."
# STRIPE_WEBHOOK_SECRET="whsec_..."           # From `stripe listen` output
# STRIPE_PRICE_ID_TEAM="price_..."            # Team monthly price ID
# STRIPE_PRICE_ID_ENTERPRISE="price_..."      # Enterprise monthly price ID

# Free trial duration (days) for Team self-serve subscriptions.
# Enterprise and Community checkouts do not use trials.
TRIAL_DAYS=14

# ----------------------------------------------------------------------------
# API/Auth Runtime
# ----------------------------------------------------------------------------
# APP_BASE_URL="http://localhost:3000"         # Frontend URL (used in emails, OAuth callbacks)
# JWT_SECRET_KEY="change-me-in-production"    # JWT signing secret
# SETTINGS_ENCRYPTION_KEY="change-me-in-production"  # Settings encryption key
# Upper bound an organization admin may assign to the shared BYO LLM monthly
# budget, in integer micro-USD ($100 = 100000000 micro-USD).
# BYO_LLM_MAX_BUDGET_MICRO_USD="100000000"
EMAIL_PROVIDER="smtp"                        # smtp|resend|console
EMAIL_FROM_ADDRESS="no-reply@example.com"
EMAIL_API_KEY=""                              # Required when EMAIL_PROVIDER=resend
# SMTP settings (used when EMAIL_PROVIDER=smtp — defaults target Mailpit)
SMTP_HOST="localhost"
SMTP_PORT="1025"
# SMTP_USERNAME=""                            # Optional: for authenticated SMTP relays
# SMTP_PASSWORD=""                            # Optional: for authenticated SMTP relays
# SMTP_USE_TLS="false"                        # Optional: enable STARTTLS

# Allowed origins for CORS and CSRF origin validation (comma-separated)
# Required when frontend is hosted on a different domain than the backend.
# The signup endpoint (/api/v1/auth/register) is protected by origin validation
# and will return 403 "Request origin validation failed" if the frontend origin
# is not listed here. Default: http://localhost:3000
CORS_ALLOWED_ORIGINS="http://localhost:3000"

# ----------------------------------------------------------------------------
# Social Login (app-owned OAuth credentials)
# ----------------------------------------------------------------------------
# Used by POST /api/v1/auth/social-login to verify provider tokens server-side.
# NextAuth handles the OAuth redirect; this backend verifies and issues JWTs.
# NOTE: The same OAuth app credentials must also be set in the web repo
# (.env: AUTH_GITHUB_ID/SECRET, AUTH_GOOGLE_ID/SECRET, AUTH_GITLAB_ID/SECRET).
SOCIAL_GITHUB_CLIENT_ID=
SOCIAL_GITHUB_CLIENT_SECRET=
SOCIAL_GOOGLE_CLIENT_ID=
SOCIAL_GOOGLE_CLIENT_SECRET=
SOCIAL_GITLAB_CLIENT_ID=
SOCIAL_GITLAB_CLIENT_SECRET=

# ----------------------------------------------------------------------------
# Ask Dev platform allowance (API)
# ----------------------------------------------------------------------------
# Operator-provisioned monthly maxima. Organization administrators may lower
# their limits but cannot raise them above these values. The runtime clamps
# these to the hard ranges: 100..5,000 runs and $10..$500 in microUSD.
# ASK_DEV_PLATFORM_MONTHLY_REQUEST_MAX="1000"
# ASK_DEV_PLATFORM_MONTHLY_COST_MAX_MICROUSD="100000000"
#
# CHAOS-3523(B): dev/local escape hatch. Raises the hard ceiling above so a
# local/dev account can exceed it without SQL surgery on dev_runs. ONLY takes
# effect when ENVIRONMENT/APP_ENV/ENV resolves to a development posture
# ("development"/"dev"/"local" -- dev_health_ops.api.graphql.security.
# is_development_environment()); this default-production-posture app NEVER
# reads these two in a real deployment. Never set these in production.
# ASK_DEV_PLATFORM_MONTHLY_REQUEST_DEV_MAX="50000"
# ASK_DEV_PLATFORM_MONTHLY_COST_DEV_MAX_MICROUSD="5000000000"

# ----------------------------------------------------------------------------
# Feature Flags
# ----------------------------------------------------------------------------
# ATLASSIAN_CLIENT_ENABLED="false"  # Enable new atlassian-client (Phase 1+)
# ATLASSIAN_GQL_ENABLED="false"     # Enable AGG GraphQL enrichment
# JIRA_USE_PROVIDER="false"         # Use JiraProvider in work_items pipeline

# ----------------------------------------------------------------------------
# Observability — SigNoz (distributed tracing + metrics)
# ----------------------------------------------------------------------------
# SigNoz is a self-hosted OpenTelemetry backend (traces, metrics, logs).
# Point every API and worker process at the same OTLP gRPC collector.
# OTEL_EXPORTER_OTLP_ENDPOINT="http://localhost:4317"
# OTEL_METRIC_EXPORT_INTERVAL="60000"
#
# To disable tracing entirely:
# OTEL_ENABLED="false"

# ----------------------------------------------------------------------------
# Observability — BugSink (error tracking, Sentry-compatible)
# ----------------------------------------------------------------------------
# BugSink is a lightweight self-hosted error tracker (Sentry SDK compatible).
# Compose brings it up at http://localhost:8800.
# After starting, create a project in the BugSink UI and copy its DSN into
# SENTRY_DSN below — the Sentry SDK sends events to BugSink transparently.
#
# Required by compose — generate a unique key (e.g. `openssl rand -base64 50`):
BUGSINK_SECRET_KEY=""
BUGSINK_BASE_URL="http://localhost:8800"
# Initial superuser — set on first run only (format: email:password):
# BUGSINK_CREATE_SUPERUSER="admin@example.com:changeme"

# ----------------------------------------------------------------------------
# Error Reporting — Sentry / BugSink DSN
# ----------------------------------------------------------------------------
# Set to a Sentry project DSN or a BugSink project DSN (Sentry-compatible).
# Leave blank to disable error reporting.
# SENTRY_DSN=""
# SENTRY_ENVIRONMENT="production"
#
# Traces — BugSink ignores traces (SigNoz handles them via OTEL).
# Set to 0.1 only if using Sentry SaaS.
SENTRY_TRACES_RATE="0"
#
# PII — safe to enable for self-hosted (BugSink/self-hosted Sentry).
# Includes user IPs, request bodies, etc. in error events.
SENTRY_SEND_PII="true"

# ----------------------------------------------------------------------------
# Go execution path (River) — CHAOS-3142
# ----------------------------------------------------------------------------
# This file wires the River domain/queue/coordinator role names into
# postgres's own bootstrap (docker/init-extra-dbs.sh) and the shared Celery
# env anchor. A Go worker topology (see deploy/go-workers/README.md) needs
# the SAME values to agree with this project on role identity -- but Docker
# Compose only reads a `.env` file (for both `${VAR}` interpolation and
# COMPOSE_PROFILES) from the directory of the compose file actually being
# invoked, or from the shell. This file being correct does NOT propagate
# these values to a Go worker topology declared in a different compose
# file/directory; that file's own `.env` (or your shell) needs the same
# values set explicitly. Defaults below match what init-extra-dbs.sh already
# assumes; only set these to override.
# RIVER_DOMAIN_DATABASE_ROLE="devhealth_domain"
# RIVER_DOMAIN_DATABASE_PASSWORD="devhealth_domain"
# RIVER_QUEUE_DATABASE_ROLE="devhealth_queue"
# RIVER_QUEUE_DATABASE_PASSWORD="devhealth_queue"
# RIVER_COORDINATOR_DATABASE_ROLE="devhealth_coordinator"
# RIVER_COORDINATOR_DATABASE_PASSWORD="devhealth_coordinator"
#
# CHAOS-3941: a provider unit that routes to neither River nor a LIVE Celery
# consumer is refused, not published into an empty queue. The dispatcher asks
# the broker who is listening; these tune that probe only. Leave them unset --
# 1.5s per broadcast, one broadcast per 60s -- unless a slow broker makes the
# probe report "unknown" and the refusal stops firing.
# WORKER_CELERY_CONSUMER_PROBE_TIMEOUT_SECONDS="1.5"
# WORKER_CELERY_CONSUMER_PROBE_TTL_SECONDS="60"
#
# There are no provider/dataset route switches (CHAOS-4054). Capability is
# always on in the binary: a shipped route is executable. What should run is
# the user's own sync config (IntegrationDataset.is_enabled); where it can run
# is each worker's -Q/--queues topology in the tracked service definitions.
#
# The canonical work-items Go route needs two config artifacts. Every worker
# image ships them at /app/config and the binary defaults there, so these are
# overrides rather than requirements. An unreadable path fails readiness before
# a provider request or write.
# WORKER_GITHUB_WORK_ITEMS_STATUS_MAPPING_PATH=""
# WORKER_GITHUB_WORK_ITEMS_INVESTMENT_CONFIG_PATH=""