.env.example

#
# REQUIRED SETTINGS
#

PORT=8080

# Set this to the full url used by your users to access Marble's frontend
MARBLE_APP_URL=http://localhost:3000
MARBLE_BACKOFFICE_URL=http://localhost:3003

# Set your license key here if you have one in order to access premium features.
LICENSE_KEY=

# RSA private key, in PEM format, used for for signing authentication tokens. MUST be changed for production.
# We recommend using AUTHENTICATION_JWT_SIGNING_KEY_FILE to point to a private key on disk.
# To generate a private key, use `openssl genrsa -out /path/to/private/key.pem 4096`.
# AUTHENTICATION_JWT_SIGNING_KEY="-----BEGIN RSA PRIVATE KEY-----...-----END RSA PRIVATE KEY-----"
# AUTHENTICATION_JWT_SIGNING_KEY_FILE="/path/to/private/key.pem"
AUTHENTICATION_JWT_SIGNING_KEY_FILE=".jwt-key.example.pem"

# Configure your PostgreSQL database connection information, either by providing a DSN using this form:
# PG_CONNECTION_STRING='postgres://postgres:marble@localhost:5432/marble?sslmode=prefer'

# Or by setting each piece of information in those variables:
PG_HOSTNAME=localhost
PG_PORT=5432
PG_USER=postgres
PG_PASSWORD=marble
PG_DATABASE=marble
# For production, this SHOULD be set to 'require'
PG_SSL_MODE=prefer
# Optional: role to impersonate after acquiring a DB connection
# PG_IMPERSONATE_ROLE=

# Change the three settings below to create your initial organization and users.
# The user must also have a matching account in the authentication store used (in Firebase, for example).
# Subsequent users will be able to be created from the application.
CREATE_ORG_NAME=Zorg
CREATE_ORG_ADMIN_EMAIL=jbe@zorg.com

# Configure the ID of your Firebase project for authentication and the path to the service account's JSON private key file.
#  - The 'Project ID' can be found in the 'General' section of your Firebase project's settings page.
#  - The private key must be generated in the 'Service accounts' tab by clicking 'Generate new private key'
# If using the Firebase emulator, this should match the emulator's project ID. In a real deployment, it should be auto-detected from your credentials.
# GOOGLE_CLOUD_PROJECT=test-project
GOOGLE_APPLICATION_CREDENTIALS=/path/to/service/account/private/key.json

# Configure the document blob storage backend.
# The example values MUST be changed for anything but a local test environment since the file provider does not support all features.
#
# Several blob storage implementations are supported:
#  - 'file://{path}?create_dir=true' (see https://pkg.go.dev/gocloud.dev/blob/fileblob#URLOpener)
#  - 'gs://{bucket_name}' for Google Cloud Storage
#  - 's3://{bucket_name}' for AWS S3 or any S3-compatible platform (Minio, ...)
#  - 'azblob://{bucket_name}' for Azure Blob Storage
#
# Depending on the used cloud provider, the idiomatic way to discover credentials will be used, such as:
#  - GOOGLE_APPLICATION_CREDENTIALS or Application Default Credentials for Google Cloud Platform
#  - AWS_DEFAULT_REGION, AWS_ACCESS_KEY_ID and AWS_SECRET_ACCESS_KEY or default profile for Amazon Web Services
#  - AZURE_STORAGE_ACCOUNT and AZURE_STORAGE_KEY or equivalent for Azure
#
# If you are using Minio, you should use the S3 provider with some options set, depending on your setup, for example:
#  - s3://marble?awssdk=v1&endpoint=https://minio.local&s3ForcePathStyle=true
# When testing Marble, you can add the 'requireSSL=false' query parameter to connect in cleartext.
#
# See https://gocloud.dev/howto/blob/ for more details.
INGESTION_BUCKET_URL="file://./tempFiles/data-ingestion-bucket?create_dir=true"
CASE_MANAGER_BUCKET_URL="file://./tempFiles/case-manager-bucket?create_dir=true"
OFFLOADING_BUCKET_URL="file://./tempFiles/offloading-bucket?create_dir=true"
ANALYTICS_BUCKET_URL="file://./tempFiles/offloading-bucket?create_dir=true"
CONTINUOUS_SCREENING_BUCKET_URL="file://./tempFiles/continuous-screening-bucket?create_dir=true"

# Configure the connection details to your Metabase instance.
#  - To retrieve the JWT signing key, go to your Metabase admin panel, in 'Settings', then 'Embedding', and click 'Manage' under 'Static embedding'
METABASE_SITE_URL=
METABASE_JWT_SIGNING_KEY=
METABASE_GLOBAL_DASHBOARD_ID=

# Configure access to the Open Sanctions API to use sanction checks
#
# If you use the SaaS Open Sanctions API, only uncomment OPENSANCTIONS_API_KEY and provide its values.
# If you self-host the API, uncomment all relevant settings to point to your deployment and configure authentication.
#  - OPENSANCTIONS_AUTH_METHOD supports 'bearer' and 'basic'
#    If basic, provide the username and password in the form of 'user:password'
# SCREENING_OPENSANCTIONS_API_HOST=http://self.hosted.local
# OPENSANCTIONS_AUTH_METHOD=bearer
# OPENSANCTIONS_API_KEY=

#
# TUNING
#

# 'liveness' to only log health check probes
REQUEST_LOGGING_LEVEL=all
# 'text', 'json' or 'gcp'
LOGGING_FORMAT=text
# 'info' or 'debug'
# LOG_LEVEL=info

# You can customize the default timeout durations by uncommenting the following settings. Provided values are defaults.
# BATCH_TIMEOUT_SECOND=55
# DECISION_TIMEOUT_SECOND=10
# DEFAULT_TIMEOUT_SECOND=5

#
# OPTIONAL SETTINGS
#

# MUST be set to a value other than 'development' (or not set at all) when in production, or unsafe CORS settings will apply.
ENV=development

# Uncomment this line if you are using the Firebase emulator for testing.
# FIREBASE_AUTH_EMULATOR_HOST="localhost:9099"

# Set your Firebase settings as described in your app
FIREBASE_API_KEY=dummy
# For SSO, if your auth domain is different from <project_id>.firebaseapp.com, define it here.
# FIREBASE_AUTH_DOMAIN=
# If your Firebase project differs from the global Google Cloud project you use, you can set it here.
# FIREBASE_PROJECT_ID=test-project

# If running the worker or migration process in an environment requiring all processes to respond on an HTTP port, uncomment this setting.
# For example, Cloud Run requires all services to process liveness checks to keep running.
# The migration process only serves it while the migrations run, so it can also be used as a signal that the job is over.
# CLOUD_RUN_PROBE_PORT=9000

# Authenticate with OpenID Connect SSO
# See the configuration steps on https://docs.checkmarble.com/update/docs/sso-openid-connect#/

# optional configuration for API and worker profiling
# DEBUG_ENABLE_PROFILING=true
# mandatory Bearer token to authenticate the utilitary /debug/pprof/* endpoints
# DEBUG_PROFILING_TOKEN=replaceme


# 'liveness' (only log liveness requests) || 'all' (log all requests) || any other value for no request logs (for example if the infrastructure layer already logs all requests)
REQUEST_LOGGING_LEVEL=all
# 'json' || 'text' (default) || 'gcp' (adapted logging keys for Stackdriver-compatible structured logging)
LOGGING_FORMAT=text

#####
# Configure various external integrations.
#####

# Send traces to either an OpenTelemetry-compatible GRPC collector (otlp, default) or to Google Cloud Platform (gcp) (see https://cloud.google.com/trace/docs/setup/go-ot).
# The GCP collector requires Application Default Credentials.
ENABLE_TRACING=false
# TRACING_EXPORTER=gcp|otlp
# OTEL_EXPORTER_OTLP_ENDPOINT=http://localhost:4317
# TRACING_SAMPLING_RATES={"/decisions": 0.05...} (json map of span names and sampling rates)

# Collect prometheus metrics on decisions, ingestion, etc (full list is subject to change).
# If enabled, the metrics can be pulled on the **unauthenticated** /metrics endpoint. We advise not to expose it on public networks.
# ENABLE_PROMETHEUS=true

SEGMENT_WRITE_KEY=
DISABLE_SEGMENT=false
SENTRY_DSN=

# Set to true to offload decision rules content to blob storage.
# This will enable a background task moving the rule payloads that are older than `OFFLOADING_BEFORE`
# to blob storage to improve database efficiency, while keeping retention requirements.
# Note that OFFLOADING_BUCKET_URL must be set on the API and worker, while the others need only be set on the worker.
# OFFLOADING_BUCKET_URL: see section above on object storage configuration.
# OFFLOADING_ENABLED=false
# OFFLOADING_JOB_INTERVAL=30m
# OFFLOADING_BEFORE=168h
# OFFLOADING_BATCH_SIZE=10000
# OFFLOADING_SAVE_POINTS=1000
# OFFLOADING_WRITES_PER_SEC=200

# Configure metrics collection.
# By default, the metrics collection is enabled
# DISABLE_TELEMETRY=false
# METRICS_COLLECTION_JOB_INTERVAL=1h

# Abort and exit if license cannot be validated.
KILL_IF_READ_LICENSE_ERROR=false

# BIGQUERY_PROJECT_ID=

# Configure AI agent settings
# openai or aistudio
# AI_AGENT_MAIN_AGENT_PROVIDER_TYPE=
# URL of the AI provider (can be left empty for aistudio)
# AI_AGENT_MAIN_AGENT_URL=
# API key of the AI provider
# AI_AGENT_MAIN_AGENT_KEY=
# Backend of the AI provider (for aistudio) gemini or vertex
# AI_AGENT_MAIN_AGENT_BACKEND=
# Project ID of the AI provider (for aistudio)
# AI_AGENT_MAIN_AGENT_PROJECT=
# Location of the AI provider (for aistudio e.g. us-central1)
# AI_AGENT_MAIN_AGENT_LOCATION=
# API key of the Perplexity API (for enrichment)
# AI_AGENT_PERPLEXITY_API_KEY=
# Path to a local JSON file overriding the light/heavy AI agent models (default_light_model,
# default_heavy_model, and/or per-feature overrides). Merged field by field on top of the
# resolved ai_agent_models.json, every field is optional and falls back to the base's value.
# AI_AGENT_MODELS_CONFIG_OVERRIDE_FILE=

MARBLE_API_INTERNAL_URL=https://api.internal.checkmarble.com
# Token used to authenticate the screening indexer to access the dataset files. Use openssl to generate one.
SCREENING_INDEXER_TOKEN=some-random-token