.env.example

# Copy to .env and fill in values
# cp .env.example .env

# ── Postgres ───────────────────────────────────────────────────────────────────
DATABASE_URL=postgres://liquid-metal:liquid-metal@localhost:5432/liquid-metal
# Optional: separate privileged URL for running migrations (falls back to DATABASE_URL)
# MIGRATIONS_DATABASE_URL=postgres://liquid-metal-owner:password@localhost:5432/liquid-metal
# Optional: path to PEM CA certificate for TLS connections.
# When set, all crates connect to Postgres over TLS. Unset = NoTls (local dev).
# Production: download from Vultr Managed Database → Overview → Download CA Certificate
# POSTGRES_TLS_CA=/etc/ssl/certs/vultr-ca.pem

# ── NATS ───────────────────────────────────────────────────────────────────────
NATS_URL=nats://127.0.0.1:4222
# Optional: user/password auth. When both are set, all crates authenticate.
# Local dev: leave unset (no auth). Production: set in .env or infra secrets.
# NATS_USER=liquidmetal
# NATS_PASSWORD=

# ── API (Rust) ─────────────────────────────────────────────────────────────────
BIND_ADDR=0.0.0.0:7070
# Shared secret for internal provisioning route — required, no default.
# Generate: openssl rand -hex 32
# Supports comma-separated values for zero-downtime rotation:
#   INTERNAL_SECRET=new-secret,old-secret
# Remove the old value after all callers have been updated.
INTERNAL_SECRET=change-me-in-production

# ── Rate Limiting ─────────────────────────────────────────────────────────────
# Per-IP requests per minute. Tuned per route group.
# Auth routes (provision, invites): low ceiling to prevent brute force.
# Protected API routes: higher ceiling for normal CLI/web usage.
# RATE_LIMIT_AUTH_RPM=10
# RATE_LIMIT_API_RPM=60

# ── Feature flags ───────────────────────────────────────────────────────────────
# All flags default to the safe production value when unset.
# Flip in .env for local dev or staged rollouts.
#
# REQUIRE_INVITE=1      # Restrict signups to invite-code holders
# ENABLE_METAL=0        # Disable Firecracker VM provisioning
# ENABLE_LIQUID=0       # Disable Wasm provisioning
# ENFORCE_QUOTAS=0      # Disable per-tier service/resource limits
# MAINTENANCE_MODE=1    # Reject new deploys; drain in-flight only


# ── OIDC Auth (Zitadel) ─────────────────────────────────────────────────────
# Endpoints are discovered automatically via .well-known/openid-configuration.
# Zitadel: Instance Settings → Default Settings → Domains → use the primary domain
OIDC_ISSUER=https://your-instance.us1.zitadel.cloud
# CLI: Projects → liquid-metal → Applications → flux-cli → Client ID
OIDC_CLI_CLIENT_ID=
# Web: Projects → liquid-metal → Applications → web-dashboard → Client ID
OIDC_WEB_CLIENT_ID=

# ── API ────────────────────────────────────────────────────────────────────────
API_URL=http://localhost:7070

# ── Object Storage ─────────────────────────────────────────────────────────────
# Local dev: MinIO (task up starts it on :9000, console on :9001)
OBJECT_STORAGE_ENDPOINT=http://localhost:9000
OBJECT_STORAGE_BUCKET=liquid-metal-artifacts
OBJECT_STORAGE_REGION=us-east-1
OBJECT_STORAGE_ACCESS_KEY=minioadmin
OBJECT_STORAGE_SECRET_KEY=minioadmin
# Production (Vultr Chicago):
# OBJECT_STORAGE_ENDPOINT=https://ord1.vultrobjects.com
# OBJECT_STORAGE_REGION=us-ord
# OBJECT_STORAGE_ACCESS_KEY=<vultr-key>
# OBJECT_STORAGE_SECRET_KEY=<vultr-secret>

# ── Daemon ─────────────────────────────────────────────────────────────────────
# Which node this daemon runs on (used for HA routing + DB tracking)
NODE_ID=node-a
# Local directory for downloaded artifacts (rootfs images + .wasm files)
ARTIFACT_DIR=/var/lib/liquid-metal/artifacts
# Block device for cgroup v2 io.max (Linux only) — find with: lsblk -o NAME,MAJ:MIN
ROOTFS_DEVICE=8:0
PHYSICAL_CORES=4
# Firecracker binary + kernel (Linux only)
FC_BIN=/usr/local/bin/firecracker
FC_KERNEL_PATH=/opt/firecracker/vmlinux
FC_SOCK_DIR=/run/firecracker
BRIDGE=br0

# ── Base Alpine template (Metal rootfs assembly) ─────────────────────────────
# S3 key for the base Alpine ext4 image. Build with: sudo task metal:build-template
BASE_IMAGE_KEY=templates/base-alpine-v1.ext4
# Optional SHA-256 of the template for integrity verification
# BASE_IMAGE_SHA256=

# ── Jailer (production Linux only) ─────────────────────────────────────────────
# USE_JAILER=true enables full namespace + chroot + seccomp isolation
USE_JAILER=false
# JAILER_BIN=/usr/local/bin/jailer
# JAILER_CHROOT_BASE=/srv/jailer
# JAILER_UID=10000
# JAILER_GID=10000

# ── Web Dashboard ─────────────────────────────────────────────────────────────
# Bind address for the web server (default: 0.0.0.0:3000)
WEB_BIND_ADDR=0.0.0.0:3000
# AES-GCM encryption key for session cookies (32 bytes, hex-encoded).
# Generate: openssl rand -hex 32
# Required in production. Omit for local dev (ephemeral key generated).
# COOKIE_SECRET=
# Public URL for OIDC redirect_uri construction (default: http://localhost:3000)
# Must exactly match the Redirect URI registered in the Zitadel web app.
# WEB_PUBLIC_URL=https://app.liquidmetal.dev

# ── flux CLI ───────────────────────────────────────────────────────────────────
# Rust API URL (default: http://localhost:7070)
FLUX_API_URL=http://localhost:7070
# Admin secret for flux invite generate (never set on end-user machines)
# FLUX_ADMIN_SECRET=

# ── Terraform / Infrastructure provisioning ────────────────────────────────────
# Used by: task infra:plan / infra:apply / infra:destroy
# All values are passed as TF_VAR_* by the Taskfile _tf task.

# Vultr
# API key: https://my.vultr.com/settings/#settingsapi
VULTR_API_KEY=
# SSH key ID to inject into nodes: vultr-cli ssh-key list
VULTR_SSH_KEY_ID=
# Bare metal plan: vultr-cli bare-metal plans list
VULTR_BARE_METAL_PLAN=vbm-4c-32gb
# VPS plan for NAT node: vultr-cli plans list
VULTR_VPS_PLAN=vc2-2c-4gb
# OS image ID (Ubuntu 24.04 LTS): vultr-cli os list | grep "Ubuntu 24.04"
VULTR_OS_ID=2136
VULTR_REGION=ord

# Cloudflare
# API token (Zone:DNS:Edit): https://dash.cloudflare.com/profile/api-tokens
CLOUDFLARE_API_TOKEN=
# Zone ID: Cloudflare dashboard → your domain → Overview → right sidebar
CLOUDFLARE_ZONE_ID=
DOMAIN=

# Tailscale
# API key: https://login.tailscale.com/admin/settings/keys
TAILSCALE_API_KEY=
# Tailnet name: Settings → General → Tailnet name
TAILSCALE_TAILNET=

# ── TLS / ACME ───────────────────────────────────────────────────────────────
# Platform cert DEK — a random 32-byte key, KMS-wrapped and base64-encoded.
# Used by the API (cert_manager) and proxy (warm-up + hot-reload) to encrypt
# TLS private keys at rest in domain_certs. The plaintext DEK never touches disk.
#
# Generate once, then store the output as CERT_DEK_WRAPPED:
#   openssl rand -out /tmp/cert_dek.bin 32
#   gcloud kms encrypt --key=$GCP_KMS_KEY \
#     --plaintext-file=/tmp/cert_dek.bin --ciphertext-file=/tmp/cert_dek.enc
#   base64 -w0 /tmp/cert_dek.enc
#   rm /tmp/cert_dek.bin /tmp/cert_dek.enc
# CERT_DEK_WRAPPED=<base64-encoded KMS ciphertext>

# Let's Encrypt ACME account key (JSON-encoded AccountCredentials from instant-acme).
# Generated automatically on first API start if unset — copy from logs and set here.
# ACME_ACCOUNT_KEY={"id":"...","key_pair":{"alg":"ES256","pkcs8":"..."}}
#
# ACME directory URL. Use staging for testing, production for real certs.
# ACME_DIRECTORY_URL=https://acme-staging-v02.api.letsencrypt.org/directory
# ACME_DIRECTORY_URL=https://acme-v02.api.letsencrypt.org/directory
#
# Contact email for Let's Encrypt account (used for expiry notices).
# ACME_CONTACT_EMAIL=ops@liquidmetal.dev
#
# Platform wildcard cert paths (certbot-managed, loaded by Pingora at startup).
# PLATFORM_WILDCARD_CERT=/etc/letsencrypt/live/liquidmetal.dev/fullchain.pem
# PLATFORM_WILDCARD_KEY=/etc/letsencrypt/live/liquidmetal.dev/privkey.pem

# ── GCP ──────────────────────────────────────────────────────────────────────
# Shared project for KMS, Terraform state, and DR backups.
# GCP_PROJECT=your-gcp-project
#
# Envelope encryption — full Cloud KMS cryptoKey resource name.
# Format: projects/{project}/locations/{location}/keyRings/{ring}/cryptoKeys/{key}
# See RUNBOOK.md for key ring + service account creation.
# GCP_KMS_KEY=projects/your-gcp-project/locations/us-central1/keyRings/liquid-metal-dev/cryptoKeys/envelope
#
# KMS service account JSON (roles/cloudkms.cryptoKeyEncrypterDecrypter).
# The API reads GCP_KMS_CREDENTIALS (not GOOGLE_APPLICATION_CREDENTIALS) so it
# doesn't conflict with Terraform's SA. In production (Nomad), the API uses
# GOOGLE_APPLICATION_CREDENTIALS rendered to tmpfs — GCP_KMS_CREDENTIALS is dev-only.
# GCP_KMS_CREDENTIALS=keys/kms-dev.json
#
# Terraform state bucket SA — used by `task infra:*` / terraform commands.
# GOOGLE_APPLICATION_CREDENTIALS=keys/tfstate-dev.json

# Grafana (observability dashboard on NAT VPS)
GRAFANA_ADMIN_PASSWORD=

# ── Default Resource Quotas (per VM) ─────────────────────────────────────────
# Applied to every Metal VM unless overridden per-service.
# Unset = compiled default. 0 = unlimited (no limit for that dimension).
# QUOTA_DISK_READ_BPS=104857600     # 100 MB/s
# QUOTA_DISK_WRITE_BPS=104857600    # 100 MB/s
# QUOTA_DISK_READ_IOPS=5000
# QUOTA_DISK_WRITE_IOPS=2000
# QUOTA_NET_INGRESS_KBPS=100000     # 100 Mbps
# QUOTA_NET_EGRESS_KBPS=100000      # 100 Mbps

# ── Stripe (Billing) ────────────────────────────────────────────────────────
# Optional — billing is disabled when STRIPE_SECRET_KEY is unset (local dev).
# Use test-mode keys (sk_test_*, price_test_*) for development.
# See: https://dashboard.stripe.com/test/apikeys
# STRIPE_SECRET_KEY=sk_test_...
# STRIPE_WEBHOOK_SECRET=whsec_...
# STRIPE_PRICE_ID_PRO=price_test_...   # Pro tier ($10/mo) — Products → Pro → Price ID
# STRIPE_PRICE_ID_TEAM=price_test_...  # Team tier ($20/mo) — Products → Team → Price ID

# ── Observability ──────────────────────────────────────────────────────────
# Prometheus metrics server (API crate). Scraped by VictoriaMetrics.
# METRICS_BIND_ADDR=0.0.0.0:9090

# OpenTelemetry distributed tracing (opt-in). When set, spans are exported
# via OTLP/gRPC to the configured collector (e.g., Grafana Tempo).
# Unset = tracing disabled, zero overhead.
# OTEL_EXPORTER_OTLP_ENDPOINT=http://nat-vps:4317

# VictoriaLogs query endpoint (used by `flux logs` and the API /logs route).
# VICTORIALOGS_URL=http://nat-vps:9428

# ── Operational Knobs ────────────────────────────────────────────────────────
# See RUNBOOK.md for full documentation of every tunable.
# All have safe defaults — only override when tuning for your hardware/load.
#
# DATABASE_POOL_SIZE=16              # API pool (daemon default: 8)
# DB_POOL_TIMEOUT_SECS=5            # Max wait for DB conn before 503
# WATCHDOG_INTERVAL_SECS=60         # Stuck provisioning check frequency
# PROVISIONING_TIMEOUT_MINS=10      # Mark stuck provisions as failed after N min
# OUTBOX_POLL_SECS=1                # Outbox poller frequency
# OUTBOX_BATCH_SIZE=50              # Max outbox rows per poll pass
# OUTBOX_STALE_MINS=30              # Purge unpublished outbox rows after N min
# BILLING_INTERVAL_SECS=60          # Billing aggregation frequency
# CREDIT_RESET_INTERVAL_SECS=3600   # Monthly credit reset check frequency
# IDLE_TIMEOUT_SECS=300             # Serverless idle timeout (0 = disabled)
# IDLE_CHECK_INTERVAL_SECS=60       # Idle checker frequency
# PULSE_BATCH_WINDOW_SECS=5         # Traffic pulse accumulation window
# ORPHAN_SWEEP_INTERVAL_SECS=60     # Deleted-workspace cleanup frequency
# VM_CRASH_CHECK_INTERVAL_SECS=10   # Firecracker process health check frequency
# USAGE_REPORT_INTERVAL_SECS=60     # Metal + Liquid usage reporting frequency
# LAG_MONITOR_INTERVAL_SECS=30      # Provision consumer lag check frequency
# PROVISION_LAG_THRESHOLD=50        # Warn when pending provisions exceed N
# PROVISION_ACK_WAIT_SECS=300       # NATS ack timeout for provision messages
# WASM_FUEL=1000000000              # Fuel budget per Wasm request
# WASM_STACK_BYTES=1048576           # Wasm stack size (1 MiB)
# WASM_MAX_RESPONSE_BYTES=4194304   # Max Wasm stdout capture (4 MiB)
# WASM_MAX_MEMORY_BYTES=134217728   # Per-instance Wasm memory cap (128 MiB)
# WASM_MAX_CONCURRENT_REQUESTS=64   # Per-service Wasm concurrency cap
# WASM_QUEUE_TIMEOUT_SECS=5         # Wait time for concurrency permit before 503
# ROUTE_CACHE_RECONCILE_SECS=60     # Proxy route cache DB sync frequency
# PULSE_DEBOUNCE_SECS=30            # Min seconds between pulses per slug
#
# ── Daemon Hardening ──────────────────────────────────────────────────────
# CGROUP_MEMORY_HEADROOM_PCT=10     # Extra % above guest RAM for FC process overhead
# CGROUP_PIDS_MAX=512               # Fork-bomb protection per VM cgroup
# S3_DOWNLOAD_TIMEOUT_SECS=300      # Artifact download deadline
# PROVISION_TIMEOUT_SECS=600        # Per-provision deadline (generous for Wasm JIT)
# SHUTDOWN_DRAIN_TIMEOUT_SECS=30    # Max time to drain in-flight tasks on shutdown
# HEALTH_PORT=9090                  # Daemon health check HTTP port
# DAEMON_PID_FILE=/run/liquid-metal-daemon.pid  # Lock file to prevent dual-daemon