.env.example

# ──────────────────────────────────────────────────────────────────────────────
# ARIA — Secrets and runtime env vars template
# Copy this file to .env and fill in your values. Never commit .env to Git.
# Non-secret configuration (model IDs, connector types, GCP settings, etc.)
# lives in conf.yaml — see conf_template.yaml for all options.
# ──────────────────────────────────────────────────────────────────────────────


# ── Required (all deployments) ────────────────────────────────────────────────

# ServiceNow — password for the service account defined in conf.yaml (servicenow.user)
SNOW_PASSWORD=<your-servicenow-password>

# Slack — bot token with chat:write scope (channel set in conf.yaml slack.channel_id)
SLACK_BOT_TOKEN=<your-slack-bot-token>


# ── LLM provider — set ONE block depending on llm.provider in conf.yaml ───────

# --- anthropic (llm.provider: anthropic) — recommended for non-GCP deployments
ANTHROPIC_API_KEY=<your-anthropic-api-key>

# --- vertex_ai (llm.provider: vertex_ai) — GCP container deployments (no API key needed)
# Auth is via ADC — set GOOGLE_APPLICATION_CREDENTIALS if not running on GKE/Cloud Run.
# GOOGLE_APPLICATION_CREDENTIALS=/path/to/service-account.json  # only if ADC is not auto-resolved
VERTEX_AI_PROJECT_ID=<your-gcp-project-id>
VERTEX_AI_LOCATION=europe-west1

# --- claude_code (llm.provider: claude_code) — local dev only, NOT for production (#84)
# No additional env vars needed; uses the local Claude Code CLI subscription.


# ── Vault backend — set ONE block depending on runtime.vault_backend in conf.yaml ─

# --- env (default) — secrets come from this .env file; no additional config needed.

# --- gcp — GCP Secret Manager via ADC
GCP_PROJECT_ID=<your-gcp-project-id>

# --- hashicorp — HashiCorp Vault
VAULT_TOKEN=<your-vault-token>

# --- aws — AWS Secrets Manager
AWS_ACCESS_KEY_ID=<your-aws-access-key-id>
AWS_SECRET_ACCESS_KEY=<your-aws-secret-access-key>


# ── Pipeline behaviour ────────────────────────────────────────────────────────

# Path to a custom conf.yaml (default: ./conf.yaml relative to working directory)
# ARIA_CONFIG_PATH=/etc/aria/conf.yaml

# Enable the built-in Alpine.js ops dashboard at /dashboard
# ARIA_DASHBOARD_ENABLED=true

# Operating mode: inform | hitm | autonomous (only 'inform' is implemented in Phase 1.5)
# ARIA_OPERATING_MODE=inform

# LLM provider override — overrides llm.provider in conf.yaml
# ARIA_LLM_PROVIDER=anthropic

# Vault backend override — overrides runtime.vault_backend in conf.yaml
# ARIA_VAULT_BACKEND=env

# Log format: human (coloured, for terminals) | json (for log aggregators)
# ARIA_LOG_FORMAT=human

# Log directory for rolling file output
# ARIA_LOG_DIR=logs/

# SQLite run history database path
# ARIA_RUN_DB_PATH=data/runs.db

# Dry-run mode — uses in-memory stubs; no real ServiceNow/Slack/SSH calls
# ARIA_DRY_RUN=false


# ── Optional connectors ───────────────────────────────────────────────────────

# CDP — SSH private key PEM content for Agent 2 log extraction from Cloudera CDP nodes
# Set via: export CDP_SSH_KEY="$(cat /path/to/private_key)"
CDP_SSH_KEY=<pem-content-of-ssh-private-key>

# CDP — SSH host public key for strict host verification (prevents MITM attacks)
# Format: "<key-type> <base64-encoded-public-key>" e.g. "ssh-ed25519 AAAA..."
# Leave empty to use WarningPolicy (logs a warning but still connects)
CDP_HOST_KEY=

# GCP — service account JSON key (base64-encoded) for Cloud Logging / BigQuery access
# Only needed if NOT using ADC (e.g. running outside GCP with a SA key file)
GCP_SA_KEY=<base64-encoded-service-account-json>

# MS Teams (optional alternative notifier — swap connector in dependencies.py)
TEAMS_WEBHOOK_URL=<your-teams-incoming-webhook-url>

# Google Chat (optional alternative notifier — swap connector in dependencies.py)
GOOGLE_CHAT_WEBHOOK_URL=<your-google-chat-webhook-url>