open-pulse-webkit/.env.example at main · sdsc-ordes/open-pulse-webkit · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
# ── Open Pulse — backend endpoints ────────────────────────────────────────
# Copy to `.env` and fill in. Server-side only — these values must NOT be
# exposed to the browser. A server-side route (serverless function, small
# API, or your framework's server route) is expected to proxy client queries
# through, so credentials never leave the host.
#
# Endpoints below point at the live deployment on this machine. Ports
# match `infra/.env` in /open-pulse/open-pulse. Credentials use the
# upstream `replace-me` placeholder convention — fill in real values
# locally and never commit `.env`.


# ── Neo4j ─────────────────────────────────────────────────────────────────
# HTTP browser + REST API. Bolt is the binary protocol used by the
# official Neo4j drivers.
NEO4J_HTTP_ENDPOINT=http://openpulse.epfl.ch:7503
NEO4J_BOLT_ENDPOINT=bolt://openpulse.epfl.ch:7504
# Format: <user>/<password>. Matches NEO4J_AUTH in infra/.env.
NEO4J_AUTH=neo4j/xxxxxxxx


# ── SPARQL (Oxigraph behind Caddy proxy) ──────────────────────────────────
# The Caddy proxy terminates HTTP Basic auth and forwards to Oxigraph.
# Query path is /query, update path is /update.
# Production RDF: named graph https://open-pulse.epfl.ch/graph/{YYYY-MM}/hybrid
# (today: …/graph/2026-05/hybrid) is also the Oxigraph default graph — plain
# { ?s ?p ?o } works. Use GRAPH <…> { … } to pin a snapshot or query _backup/_links graphs.
SPARQL_ENDPOINT=http://openpulse.epfl.ch:7502
# Format: <user>/<password>. Matches SPARQL_AUTH in infra/.env. Required
# for writes; reads are open unless SPARQL_READ_AUTH_PATHS is set on the
# proxy.
SPARQL_AUTH=openpulse/xxxxxxxx


# ── OpenSearch ────────────────────────────────────────────────────────────
# Two transports are supported:
#
#   1. Direct (default).
#      Point OPENSEARCH_ENDPOINT at the cluster's :9200 port and leave
#      OPENSEARCH_DASHBOARDS_PROXY unset (or =false). The cluster ships
#      a self-signed cert, so clients usually disable TLS verification
#      in dev (`rejectUnauthorized: false` in Node, `verify=False` in
#      Python).
#
#   2. OpenSearch Dashboards console proxy.
#      Used when :9200 is not exposed. OPENSEARCH_ENDPOINT points at
#      the Dashboards base URL (typically :7508 in this deployment) and
#      OPENSEARCH_DASHBOARDS_PROXY=true tells the skill scripts to
#      tunnel queries through /api/console/proxy. The proxy enforces
#      CSRF; the scripts send `osd-xsrf: true`.
#
# Credentials are the OpenSearch admin user in both cases.
OPENSEARCH_ENDPOINT=http://openpulse.epfl.ch:7508
OPENSEARCH_DASHBOARDS_PROXY=true
OPENSEARCH_USERNAME=admin
# Strong-password regex enforced by OpenSearch: upper + lower + digit +
# special, min 8 chars. `Replace-Me-1!` is the upstream placeholder that
# satisfies the regex.
OPENSEARCH_PASSWORD=xxxxxxxxx


# ── CHAOSS Metrics API (Open Pulse hub) ───────────────────────────────────
# GET-only JSON metrics computed live over Neo4j+SPARQL+OpenSearch. Set the
# base URL only — the query-chaoss skill appends /api/v1/metrics/chaoss.
# Use https://openpulse.epfl.ch (TLS) or http://openpulse.epfl.ch:7507.
CHAOSS_ENDPOINT=https://openpulse.epfl.ch
# Format: <user>/<password>. HTTP Basic, password-only — the username is
# ignored. `read-me-only` is the read-only password (enough for all queries).
CHAOSS_AUTH=dev/xxxxxxxx


# ── Open Pulse Hub — operations API (collections / pipeline / crawler) ─────
# Same host as CHAOSS, different base paths. Used by the op-collections,
# op-extractor and op-crawler skills.
OPENPULSE_ENDPOINT=https://openpulse.epfl.ch
# Reader session — enough for ALL GET/monitoring calls (HTTP Basic,
# password-only). Same read password as CHAOSS.
OPENPULSE_AUTH=dev/xxxxxxxx