.env.provision.example

# iblai infra provision-env — environment variables (single-server)
# Copy to .env (or .env.provision), fill in values, then run:
#   iblai infra provision-env -f .env
# Never commit a populated .env to git — .gitignore blocks .env.* by default.

# --- AWS credentials (one of) ---
# Either supply access keys directly...
AWS_ACCESS_KEY_ID=AKIAIOSFODNN7EXAMPLE
AWS_SECRET_ACCESS_KEY=wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEY
# ...or point at a named profile in ~/.aws/credentials
# AWS_PROFILE=my-profile

# --- Region (optional, default us-east-1) ---
AWS_DEFAULT_REGION=us-east-1

# --- Project identity (required) ---
PROJECT_NAME=mydeploy             # alphanumeric + - _, ≤ 32 chars, lowercased
ENVIRONMENT=staging               # dev | staging | prod  (default: staging)

# --- Domain (required) ---
DOMAIN=platform.example.com       # base domain — 19 IBL subdomains derived from this
# HOSTED_ZONE_ID=Z0123456789ABCDEFGHIJ
#   ↑ leave unset to auto-detect from Route53. Set explicitly only when
#     multiple zones in the account match DOMAIN.

# --- SSH access (required) ---
VPN_IP=auto                       # 'auto' uses your current public IP; or e.g. 203.0.113.7
SSH_KEY_METHOD=generate           # generate | existing_file | aws_keypair
# If SSH_KEY_METHOD=existing_file, set ONE of:
# SSH_PUBLIC_KEY_PATH=~/.ssh/id_rsa.pub
# SSH_PUBLIC_KEY="ssh-ed25519 AAAA... user@host"
# SSH_PRIVATE_KEY_PATH=~/.ssh/id_rsa   # optional, for the follow-up `iblai infra setup` step
# If SSH_KEY_METHOD=aws_keypair, set:
# SSH_KEY_NAME=my-existing-keypair-name

# --- Compute (optional, defaults shown) ---
# NOTE: t3.2xlarge has 32 GB RAM. If you enable AI features in the setup
# step, 64 GB (e.g. m5.4xlarge or r5.2xlarge) is strongly recommended.
INSTANCE_TYPE=t3.2xlarge
VOLUME_SIZE=100                   # min 100 GB
VOLUME_TYPE=gp3                   # gp2 | gp3 | io1

# --- Network (optional) ---
VPC_CIDR=10.0.0.0/16

# --- Certificates (optional, default: auto) ---
# auto   → ACM if a Route53 zone matches DOMAIN, else HTTP-only
# acm    → require a Route53 zone (errors if none)
# upload → use uploaded PEMs (set CERT_*_PATH below)
# none   → HTTP-only ALB
CERT_METHOD=auto

# Required only when CERT_METHOD=upload:
# CERT_BODY_PATH=/path/to/fullchain.pem
# CERT_KEY_PATH=/path/to/private.key
# CERT_CHAIN_PATH=/path/to/intermediate.pem    # optional

# --- Route53 conflict handling (optional) ---
# When ACM is in use and Route53 already has CNAMEs for any of the 19
# IBL subdomains, those records must be removed before A records can
# replace them. true (default) deletes them; false fails fast so the
# operator can review.
AUTO_DELETE_CONFLICTING_DNS=true