settings.yaml

default:
  ALLOWED_HOSTS:
    - "localhost"
    - "127.0.0.1"
  ALLOW_CONCURRENT_SESSIONS: False
  SECRET_KEY: "dev-only-not-for-production"  # Dev only; production must override
  LOGGING: WARNING  # LogLevel: DEBUG, INFO, WARNING, ERROR, CRITICAL
  SSL_CAFILE: null
  BASE_URL: null
  # Restrict which settings the override API may write. null (the default)
  # imposes no restriction. A list turns every unlisted setting read-only:
  # entries are "<SettingsClassName>.<KEY>", where KEY is a top-level field or a
  # __-delimited nested path. Listing a setting that is already read-only
  # changes nothing -- this only ever restricts. Applies to all three services.
  SETTINGS_OVERRIDE:
    ALLOWED_KEYS: null
    # ALLOWED_KEYS:
    #   - Settings.LOGGING
    #   - Settings.PMM__annotations_enabled
    #   - SEPSettings.CONNECTIVITY_CHECK_DEFAULT
    #   - TasksSettings.LOG_RETENTION_DAYS
  BACKEND_CORS_ORIGINS:
    - http://localhost:8000
    - http://127.0.0.1:8000
  AUTH:
    PROVIDER:
      casdoor:
        endpoint: http://localhost:9999
        front_endpoint: //:9999
        allowed_issuers:
          - http://localhost:9999
          - http://127.0.0.1:9999
        certificate_path: null  # Path to JWT key certificate
        application_name: sep-app
  PMM:
    ENDPOINT: https://127.0.0.1:8443
    VERIFY_SSL: true
    FRONTEND: null  # Optional: PMM frontend URL for links
    EXECUTION_TARGET: null  # Optional: explicit Nomad node for PMM tasks
    ANNOTATIONS_ENABLED: false
    ANNOTATIONS_TIMEOUT: 5  # Optional: PMM annotation request timeout in seconds
  SEP:
    INVENTORY:
      # Tombstone collection. A retired node/service/schema/table is deleted
      # permanently once it has been retired for COLLECTION_RETENTION AND
      # nothing SEP persisted still resolves it. Deletion is irreversible and
      # cascades to the entity's subtree, so shortening the retention widens
      # what a run removes. Nothing is ever deleted while the interval is null.
      COLLECTION_INTERVAL: null  # Celery beat interval seeded for inventory-collection, e.g. "1 days"
      COLLECTION_RETENTION: 30 days
      # Entities of each type one API call may collect, and the most calls one
      # scheduled run issues before leaving the rest to the next tick.
      COLLECTION_BATCH_SIZE: 500
      COLLECTION_MAX_BATCHES: 20
    SNIPPETS:
      # Restrict snippet sync to shell scripts. Bare strings are parsed as
      # extension filters; MIME-type filters use the "mime:<value>" form.
      # Files that don't match are skipped, so add ".py" here to sync Python
      # snippets even though an interpreter for them is configured by default.
      SYNC_FILTER:
        - .sh
    UVICORN_HOST: "127.0.0.1"
    UVICORN_PORT: 8000
    SSL_KEYFILE: null
    SSL_CERTFILE: null
    PROXY_HEADERS: False
    # The URL prefix a reverse proxy serves SEP under, passed through unstripped.
    # "" is the origin root. Read once at startup, so env and this file are the
    # only ways to set it. BASE_URL must include the prefix when one is set.
    ROOT_PATH: ""
    ARTIFACT_DOWNLOAD_TTL: 600
    # Celery beat waits this long for the HTTP API to answer /health before
    # starting ungated. Raise it on a deployment whose application startup runs
    # long; starting ungated is what lets an overdue periodic task fail on
    # connect to SEP's own API.
    API_READINESS_TIMEOUT: 60.0
    API_READINESS_POLL_INTERVAL: 0.5
    CONNECTIVITY_CHECK_DEFAULT: False
    ALERT_DEFINITIONS_DIR: null
    OAUTH:
      REDIRECT_URI: /oauth/callback
    SESSION_REFRESH:
      COOKIE_NAME: refreshToken
      PATH: /api/oauth
      SECURE: False
      SAMESITE: lax
      MAX_AGE: 604800
    APPS:
      - MODULE_NAME: inventory
      - MODULE_NAME: snippets
      - MODULE_NAME: atw
      - MODULE_NAME: alters
      - MODULE_NAME: archives
      - MODULE_NAME: mysql_backups
      - MODULE_NAME: checksums
      - MODULE_NAME: backup_mongo
      - MODULE_NAME: backup_pg
      - MODULE_NAME: dipper
      - MODULE_NAME: topology
        ENABLED: false
      - MODULE_NAME: alerts
      - MODULE_NAME: alert_troubleshooting
      - MODULE_NAME: report
    HEALTH_REPORT:
      # Periodic report generation - empty by default (no automatic generation).
      # Each entry pairs a SCHEDULE (interval or crontab) with optional params:
      #   SINCE    - start of report window (default: "now-7d")
      #   UNTIL    - end of report window   (default: "now")
      #   FULL     - generate a full report (default: true)
      #   REFRESH  - re-run advisor checks before collecting results (default: false)
      #   SECTIONS - list of sections to include (default: all)
      #   UPLOAD   - upload to ServiceNow after generation (default: false)
      #              requires global UPLOAD, ENDPOINT, API_KEY, and CLIENT_ID below
      #
      # Interval examples:
      #   SCHEDULES:
      #     - SCHEDULE: {EVERY: 7, PERIOD: days}         # weekly full report (default)
      #       SINCE: "now-10d"                           # covering last 10 days
      #     - SCHEDULE: {EVERY: 3, PERIOD: days}         # quick report every 3 days
      #       FULL: false
      #
      # Crontab examples:
      #   SCHEDULES:
      #     - SCHEDULE: {MINUTE: "0", HOUR: "6", DAY_OF_WEEK: "5"}
      #       SINCE: "now-7d"                            # every Friday at 6AM
      #       FULL: false                                # quick weekly report
      #     - SCHEDULE: {MINUTE: "0", HOUR: "2", DAY_OF_WEEK: "6"}
      #       SINCE: "now-14d"                           # every Saturday at 2AM, 14-day window
      #       UPLOAD: true                               # upload this report to ServiceNow
      #     - SCHEDULE: {MINUTE: "0", HOUR: "3", DAY_OF_MONTH: "1"}
      #       SINCE: "now-30d"                           # 1st of each month at 3AM
      SCHEDULES: []
      UPLOAD: false    # Enable ServiceNow upload (true/false)
      ENDPOINT:        # ServiceNow upload API URL
      API_KEY:         # API key for authenticating with the upload endpoint
      CLIENT_ID:       # Customer identifier sent with each upload
      # Rendered PDFs are staged on shared disk keyed by job id (worker writes,
      # web serves) so only small metadata transits the Celery result backend.
      ARTIFACT_DIR: data/health-reports  # Shared staging dir (mount in worker + web)
      ARTIFACT_TTL: 3600                  # Seconds to retain a staged PDF; mirror CELERY.RESULT_EXPIRES
      CLEANUP_INTERVAL: {EVERY: 15, PERIOD: minutes}  # purge_report_artifacts cadence
    # Diagnostic bundle delivery plan - unset by default (no receiver configured).
    # The skeleton below is settable through this file and environment variables
    # only: the whole plan is cross-validated as a unit at settings load, so the
    # settings API rejects both a whole-object and a per-leaf write. The parts that
    # differ per deployment - the receiver endpoint and the secret values - go
    # through DIAGNOSTICS_DELIVERY_INPUTS, documented after the examples below.
    #
    # NOTE: unlike its neighbours, the keys inside this block are case-SENSITIVE and
    # lowercase. Header names, secret names and multipart field names go on the wire
    # verbatim, so nothing here is case-folded for you.
    #
    # A plan is zero or more HTTP resolution steps followed by exactly one multipart
    # upload step carrying the bundle. Every header/query/body/field value declares
    # where it comes from via `source`:
    #   {source: literal, value: "..."}                          constant from config
    #   {source: input, field: source_ref|case_ref|manifest}     from the send call
    #   {source: secret, name: <key in secrets>}                 masked credential
    #   {source: output, step: <step>, output: <name>}           an earlier step's value
    #   {source: manifest_key, key: <manifest key>}              one manifest scalar
    # `input` with field `manifest` sends the whole manifest as one JSON string;
    # `manifest_key` sends a single key as its own value. A key that the send's
    # manifest does not carry as a scalar fails that send.
    # Secrets are rejected in `query` (query strings reach logs, caches and proxies
    # unredacted) - place them in `headers`, `body`, or the upload's `fields`.
    #
    # Single-request intake receiver (no resolution steps):
    #   DIAGNOSTICS_DELIVERY:
    #     endpoint: https://intake.example.com/
    #     max_bundle_size_mb: 30                  # mebibytes; checked before any request
    #     secrets:
    #       api_key: "..."                        # masked in the API and in exports
    #     upload:
    #       path: attachment/upload
    #       headers:
    #         x-api-key: {source: secret, name: api_key}
    #       fields:
    #         source: {source: input, field: source_ref}
    #         collected_at: {source: manifest_key, key: collected_at}
    #       file_field: file                      # multipart part carrying the bundle
    #       file_content_type: application/octet-stream
    #       reference_pointer: /result/sys_id     # JSON Pointer to the upload reference
    #
    # Lookup-then-attach (one resolution step feeding the upload):
    #   DIAGNOSTICS_DELIVERY:
    #     endpoint: https://snow.example.com/
    #     secrets:
    #       api_key: "..."
    #     resolution_steps:
    #       - name: lookup
    #         method: POST                        # GET or POST
    #         path: ticket_details
    #         headers:
    #           x-sn-apikey: {source: secret, name: api_key}
    #         body:
    #           ticket_number: {source: input, field: case_ref}
    #         outputs:
    #           sys_id: /result/sys_id            # JSON Pointer into this step's response
    #     upload:
    #       path: attachment/upload
    #       headers:
    #         x-sn-apikey: {source: secret, name: api_key}
    #       fields:
    #         table_name: {source: literal, value: sn_customerservice_case}
    #         table_sys_id: {source: output, step: lookup, output: sys_id}
    #       reference_pointer: /result/sys_id
    #
    # Optional connectivity probe. Declares the one request the admin Settings
    # "Test connection" panel issues against the receiver for the `delivery`
    # target; without it that target answers `probe_undeclared` and nothing is
    # sent. The probe is deliberately NOT derived from the steps above: a
    # resolution step may be a mutating POST, and its values may cite send inputs
    # that only exist during a real send. So it is declared separately, under two
    # constraints the schema enforces:
    #   - the method is always GET, and there is no body;
    #   - values may only be {source: literal} or {source: secret} - `input`,
    #     `output` and `manifest_key` are refused when the plan is parsed.
    # `path` must be relative to `endpoint`: a path carrying a scheme or a host
    # would send the probe's credentials to another origin and is refused. As
    # everywhere else, secrets are rejected in `query`.
    #   DIAGNOSTICS_DELIVERY:
    #     probe:
    #       path: api/now/table/sn_customerservice_case
    #       query:
    #         sysparm_limit: {source: literal, value: "1"}
    #         sysparm_fields: {source: literal, value: sys_id}
    #       headers:
    #         x-sn-apikey: {source: secret, name: api_key}
    #
    # Optional case search. Declares the one request the send dialog's support
    # case reference field issues as the user types; without it that field stays
    # the plain text input it has always been and no search is ever issued. Like
    # the probe it is declared rather than derived, under the same constraints:
    #   - the method is always GET, and there is no body;
    #   - values may only be {source: literal}, {source: secret} or
    #     {source: term} - `input`, `output` and `manifest_key` are refused when
    #     the plan is parsed.
    # `{source: term}` carries the typed term, optionally wrapped in literal
    # `prefix` / `suffix` affixes, because a receiver's search parameter is
    # rarely the bare term: ServiceNow's Table API wants an encoded query whose
    # operator precedes it. `separator` emits the term a second time after that
    # literal, which is how one term is compared against two fields when the
    # receiver refuses this credential its full-text index. The term is emitted
    # once, or twice around `separator`, and only ever inside a header or query
    # value, so it can never reach `path`. As for the probe,
    # `path` must be relative to `endpoint` and secrets are rejected in `query`.
    # `term_pattern` is required and is a regular expression the WHOLE typed
    # term must match before it is composed into any value. It is what keeps the
    # declared query the whole query: a receiver's query language gives its
    # clause separators no escape, so a term carrying them would widen the
    # search and return rows the plan never selected. Keep it to the characters
    # a real reference or title fragment needs; `.*` reopens the hole.
    # The three pointers map the response: `results_pointer` addresses the list
    # of rows, and the other two are applied to each row. A row whose pointers
    # miss is skipped; a `results_pointer` addressing no list fails the search.
    # Repeated references are deduplicated, first occurrence kept.
    #   DIAGNOSTICS_DELIVERY:
    #     case_search:
    #       path: api/now/table/sn_customerservice_case
    #       query:
    #         sysparm_query:
    #           source: term
    #           prefix: numberLIKE
    #           separator: ^ORshort_descriptionLIKE
    #         sysparm_fields: {source: literal, value: "number,short_description"}
    #         sysparm_limit: {source: literal, value: "10"}
    #       headers:
    #         x-sn-apikey: {source: secret, name: api_key}
    #       term_pattern: '[A-Za-z0-9 ._-]+'
    #       results_pointer: /result
    #       reference_pointer: /number
    #       title_pointer: /short_description
    #
    # Per-deployment inputs for the plan above - unset by default. Supplies the
    # values the skeleton leaves open, so an image can bake a plan whose secret
    # names are declared but empty and an operator fill them in later. Unlike the
    # skeleton this IS settable through the settings API, as one atomic
    # whole-object write: both its leaves are sealed, so a `__`-delimited leaf
    # write is refused, and the secret names submitted must be exactly the ones
    # the plan declares. Delivery stays off until every declared secret has a
    # non-empty value.
    #   DIAGNOSTICS_DELIVERY_INPUTS:
    #     endpoint: https://snow.example.com/  # optional; omit to keep the plan's
    #     secrets:
    #       api_key: "..."                     # keyed by the plan's secret names
    # Secrets render as `**********` in the settings API and in the YAML export,
    # and resubmitting the mask through PATCH keeps the stored value. Feeding an
    # exported block back in through this file fails settings construction rather
    # than sending the mask to the receiver as the credential.
    #
    # Staging and housekeeping for the diagnostics sends that use the plan above.
    # Read from YAML/env only (env prefix `SEP__ATW__`); defaults shown.
    #   ATW:
    #     bundle_dir: data/atw-bundles     # where a bundle is staged while it uploads
    #     bundle_ttl: 3600                 # seconds before an abandoned bundle is reaped
    #     cleanup_interval:                # `null` unregisters the sweep entirely
    #       every: 15
    #       period: minutes
    #     stale_send_after: 3600           # seconds a send may stall before it is failed;
    #                                      # must exceed the slowest legitimate send
    DATABASE:
      ENGINE: sqlite  # Database engine: sqlite, postgresql
      USER: null
      PASSWORD: null
      HOST: ""  # Database host (empty string for SQLite to avoid URL construction issues)
      PORT: null
      NAME: sep.db
    SYNCERS:
      - SYNCER: PMMSyncer
        STALE_RUN_AFTER: 3600  # Seconds an idle in-progress run may sit before it is reclaimed; must exceed the longest expected sync
        MISSING_GRACE_GENERATIONS: 2  # Consecutive complete syncs that must report an entity absent before it is removed; minimum 2
      - SYNCER: MySQLSyncer
        IGNORE_SCHEMAS:
          - sys
          - performance_schema
          - mysql
          - information_schema
        DEFAULT_EXECUTOR_HOST: null  # Optional: Nomad node name from /api/tasks/hosts/ for RDS/DBaaS
      - SYNCER: SystemFactsSyncer
        DEFAULT_EXECUTOR_HOST: null  # Optional: Nomad node name from /api/tasks/hosts/ for RDS/DBaaS
    SYNC_REFRESH_TIME: 5  # Browser refresh interval during sync (seconds)
  INVENTORY:
    SSL_KEYFILE: null
    SSL_CERTFILE: null
    DATABASE:
      ENGINE: sqlite
      USER: null
      PASSWORD: null
      HOST: ""  # Empty string for SQLite to avoid URL construction issues
      PORT: null
      NAME: inventory.db
  TASKS:
    SSL_KEYFILE: null
    SSL_CERTFILE: null
    DATABASE:
      ENGINE: sqlite
      USER: null
      PASSWORD: null
      HOST: ""  # Empty string for SQLite to avoid URL construction issues
      PORT: null
      NAME: tasks.db
    SYNC_LOCK_TTL: 300  # TaskHistory sync lock timeout (seconds)
    PRE_EXECUTION_CONNECTIVITY_CHECK: warn  # disabled | warn | block
    INVENTORY_SYNC_INTERVAL: null  # Celery beat interval seeded for inventory-sync, e.g. "15 minutes"; null seeds no schedule
    INVENTORY_SYNC_SYNCER: null  # Dotted "module.ClassName" syncer the seeded schedule targets; null runs every configured syncer
    HOOK_MODULE_ALLOWLIST:  # Module roots a task hook path may import from; extend for out-of-tree apps
      - app.sep.apps
    NOMAD:
      ENDPOINT: http://127.0.0.1:4646
      SECURE: False
      VERIFY_SSL: True
      SSL_KEYFILE: null
      SSL_CERTFILE: null
      SSL_CAFILE: null
      CERT_EXPIRY_WARN_DAYS: 7  # Alert when CA/client PEM not_valid_after is within this many days
      CHECK_CERT_EXPIRY_INTERVAL: "1 days"  # Celery beat interval for check_nomad_cert_expiry; null to disable
      TIMEOUT: 10  # Request timeout in seconds
      MINIFY_PAYLOAD: True  # Minify payloads before dispatch
      LOG_SOCKET_READ_TIMEOUT: 10  # Socket read timeout for logs
    ANONYMIZER:
      DEFAULT_ENTITIES:
        - CREDIT_CARD
        - EMAIL_ADDRESS
        - IBAN_CODE
        - IP_ADDRESS
        - PHONE_NUMBER
        - US_SSN
        - US_ITIN

development:
  PMM:
    ENDPOINT: https://127.0.0.1:8443
    VERIFY_SSL: false
  TASKS:
    ANONYMIZER:
      DEFAULT_ENTITIES: []
  SEP:
    UVICORN_RELOAD: true
    # UVICORN_EXTRA_RELOAD_DIRS:
    #   - /path/to/extra/dir
    # UVICORN_EXTRA_RELOAD_INCLUDES:
    #   - "*.yaml"
    # UVICORN_EXTRA_RELOAD_EXCLUDES:
    #   - "*.log"
    SNIPPETS:
      SYNC_INTERVAL: 60 seconds
      ENABLE_MANUAL_SYNC: true
      AUTO_APPROVE_BUILTIN_SNIPPETS: true
    INVENTORY_ENDPOINT: http://localhost:8000/api/inventory
    TASKS_ENDPOINT: http://localhost:8000/api/tasks
    SECURITY_HEADERS:
      CONTENT_SECURITY_POLICY_EXCLUDE_PATHS:
        - /api/docs
        - /api/inventory/docs
        - /api/tasks/docs
    APPS:
      - MODULE_NAME: tasks
    SYNCERS:
      - SYNCER: PMMSyncer
        STALE_RUN_AFTER: 3600  # Seconds an idle in-progress run may sit before it is reclaimed; must exceed the longest expected sync
        MISSING_GRACE_GENERATIONS: 2  # Consecutive complete syncs that must report an entity absent before it is removed; minimum 2
      - SYNCER: MySQLSyncer
        IGNORE_SCHEMAS:
          - sys
          - performance_schema
          - mysql
          - information_schema
        DEFAULT_EXECUTOR_HOST: null  # Optional: Nomad node name from /api/tasks/hosts/ for RDS/DBaaS
      - SYNCER: SystemFactsSyncer
        DEFAULT_EXECUTOR_HOST: null  # Optional: Nomad node name from /api/tasks/hosts/ for RDS/DBaaS
  AUTH:
    PROVIDER:
      casdoor:
        organization_name: built-in
  CELERY:
    BROKER_URL: "filesystem://"
    BROKER_TRANSPORT_OPTIONS:
      DATA_FOLDER_IN: data/celery/broker
      DATA_FOLDER_OUT: data/celery/broker
      PROCESSED_FOLDER: data/celery/processed
      CONTROL_FOLDER: data/celery/control
    RESULT_BACKEND: file://data/celery/results
    RESULT_EXPIRES: 3600
    RESULT_PERSISTENT: True
    BEAT_DBURI: "sqlite:///schedule.db"
    BEAT_ENGINE_OPTIONS:
      POOL_PRE_PING: true  # Test beat/worker pooled connections on checkout; set false to opt out
  ALERTING:
    SOURCE_SUFFIX: ":dev"

production_docker:
  ALLOW_CONCURRENT_SESSIONS: True
  ALLOWED_HOSTS:
    - "*"
  PMM:
    ENDPOINT: https://127.0.0.1
    VERIFY_SSL: false
  BACKEND_CORS_ORIGINS:
    - https://127.0.0.1:8444
  AUTH:
    PROVIDER:
      casdoor:
        allowed_issuers: '*'
        application_name: sep-app
        certificate_path: /data/certs/casdoor/sep_token_jwt_key.pem
        client_id: redacted_match_casdoor_json
        client_secret: redacted_match_casdoor_json
        endpoint: http://127.0.0.1:8000
        front_endpoint: //:9999
        organization_name: sep
  CELERY:
    BEAT_DBURI: postgresql://postgres:xxx@sep-db:5432
    BEAT_SCHEMA: sep
    BROKER_URL: redis://redis:6379/0
    RESULT_BACKEND: redis://redis:6379/1
    RESULT_EXPIRES: 3600
    WORKER_STATE_DB: celery_worker_state
    BEAT_ENGINE_OPTIONS:
      POOL_PRE_PING: true  # Test beat/worker pooled connections on checkout; set false to opt out
  DATABASE:
    ENGINE: postgresql
    HOST: sep-db
    NAME: sep
    PASSWORD: xxx
    PORT: 5432
    USER: postgres
  INVENTORY:
    DATABASE:
      ENGINE: postgresql
      HOST: sep-db
      NAME: sep
      PASSWORD: xxx
      PORT: 5432
      USER: postgres
    SSL_CERTFILE: /data/certs/sep/inventory_api-cert.pem
    SSL_KEYFILE: /data/certs/sep/inventory_api-cert-key.pem
  SEP:
    DATABASE:
      ENGINE: postgresql
      HOST: sep-db
      NAME: sep
      PASSWORD: xxx
      PORT: 5432
      USER: postgres
    INVENTORY_ENDPOINT: https://127.0.0.1:9001
    OAUTH:
      REDIRECT_URI: /oauth/callback
    PROXY_HEADERS: True
    SSL_CERTFILE: /data/certs/sep/localhost-cert.pem
    SSL_KEYFILE: /data/certs/sep/localhost-cert-key.pem
    SECURITY_HEADERS:
      CONTENT_SECURITY_POLICY_EXCLUDE_PATHS:
        - /api/docs
        - /api/inventory/docs
        - /api/tasks/docs
    SESSION_REFRESH:
      COOKIE_NAME: refreshToken
      PATH: /api/oauth
      SECURE: True
      SAMESITE: lax
      MAX_AGE: 604800
    SYNCERS:
      - SYNCER: PMMSyncer
        STALE_RUN_AFTER: 3600  # Seconds an idle in-progress run may sit before it is reclaimed; must exceed the longest expected sync
        MISSING_GRACE_GENERATIONS: 2  # Consecutive complete syncs that must report an entity absent before it is removed; minimum 2
      - SYNCER: MySQLSyncer
        IGNORE_SCHEMAS:
          - sys
          - performance_schema
          - mysql
          - information_schema
        DEFAULT_EXECUTOR_HOST: null  # Optional: Nomad node name from /api/tasks/hosts/ for RDS/DBaaS
      - SYNCER: SystemFactsSyncer
        DEFAULT_EXECUTOR_HOST: null  # Optional: Nomad node name from /api/tasks/hosts/ for RDS/DBaaS
    TASKS_ENDPOINT: https://127.0.0.1:9002
  SSL_CAFILE: /data/certs/sep-ca.pem
  TASKS:
    DATABASE:
      ENGINE: postgresql
      HOST: sep-db
      NAME: sep
      PASSWORD: xxx
      PORT: 5432
      USER: postgres
    NOMAD:
      ENDPOINT: https://127.0.0.1:4647
      SECURE: False
      SSL_CAFILE: /data/certs/nomad/nomad-agent-ca.pem
      SSL_CERTFILE: /data/certs/nomad/global-client-nomad.pem
      SSL_KEYFILE: /data/certs/nomad/global-client-nomad-key.pem
      CERT_EXPIRY_WARN_DAYS: 7  # Alert when CA/client PEM not_valid_after is within this many days
      CHECK_CERT_EXPIRY_INTERVAL: "1 days"  # Celery beat interval for check_nomad_cert_expiry; null to disable
    SSL_KEYFILE: /data/certs/sep/tasks_api-cert-key.pem
    SSL_CERTFILE: /data/certs/sep/tasks_api-cert.pem