.env.example

# Chainguard org under cgr.dev/ to pull images from. docker-compose passes
# it to the controller's image build and runtime env; pipelines reference
# it via env.CHAINGUARD_ORG; per-app Dockerfiles use it as a build ARG;
# setup.sh uses it when creating the Chainguard assumed identity via
# Terraform.
#
# Leave commented out (or set to empty) and setup.sh will prompt for it
# on first run, then persist your answer here. Re-runs reuse the persisted
# value without prompting.
#
# Examples:
#   CHAINGUARD_ORG=chainguard               # the public Chainguard catalog
#   CHAINGUARD_ORG=your-org.example.com
#
# CHAINGUARD_ORG=

# The remaining variables in this file are written by setup.sh based on
# the answers you give to its three prompts. You normally don't edit them
# directly — re-run setup.sh to switch modes.

# Where pipelines pull Chainguard images from. Either:
#   cgr.dev/<org>                          (Mode A — direct cgr.dev)
#   localhost/cgr-proxy/<org>              (Modes B/C — Harbor proxy cache)
# PULL_REGISTRY=

# Where the Python/Node OCI-image pipelines push their built images. Either:
#   ttl.sh/<prefix>                        (Modes A/B default — anonymous, 24h TTL)
#   localhost/library                      (Mode C — Harbor)
# PUSH_REGISTRY=

# Whether Harbor is the active pull-through cache. cgLogin reads this and
# skips the OIDC chainctl exchange when true (Harbor pulls are anonymous).
# HARBOR_ENABLED=false

# Harbor admin password. Default is the chart's own default ("Harbor12345")
# so the demo works out of the box. setup.sh writes this when Harbor is
# enabled; the value drives:
#   - the Helm chart's harborAdminPassword
#   - the Terraform harbor provider (used for the cgr-proxy project)
#   - cgLogin's Mode C push-auth (cgr-proxy admin docker config)
# Override before running setup.sh to use a different password.
# HARBOR_ADMIN_PASSWORD=Harbor12345

# Note: the Chainguard assumed identity UIDP (Mode A) is NOT stored here.
# setup.sh writes it to shared-libraries/cg-images/IDENTITY (filesystem-SCM
# live-loaded; cgLogin reads it at build time).