# The control plane: backend, consumer, realtime, tracking, forms, web, admin.
#
# One region on a container host, with the database, the root key and the
# object store in the cloud region next to it. Every value here is also what a
# joining node inherits, which is why the addresses have to be ones another
# machine can reach: `warmbly join` renders a node's configuration from this
# environment, and 127.0.0.1 does not resolve to your control plane from a VPS.

APP_ENV=prod
DEPLOYMENT_MODE=self_hosted

# --- data -------------------------------------------------------------------
# Reached across the internet, so TLS is verified rather than merely offered.
PRIMARY_DB=postgres://warmbly:<password>@db.eu-central-1.rds.amazonaws.com:5432/warmbly?sslmode=verify-full
REDIS=rediss://:<password>@bus.example.com:6380

# --- event bus --------------------------------------------------------------
EVENTBUS_PROVIDER=nats
NATS_URL=tls://<token>@bus.example.com:4222
# json is required wherever workers are exercised: the worker command and
# result envelopes carry bodies Avro cannot serialize.
CODEC_PROVIDER=json

# --- encryption -------------------------------------------------------------
# Nodes are handed KMS_PROVIDER=brokered instead of this, so no machine in the
# fleet needs an AWS credential of its own.
KMS_PROVIDER=aws
KMS_AWS_KEY_ID=alias/warmbly
AWS_REGION=eu-central-1
AWS_ACCESS_KEY_ID=
AWS_SECRET_ACCESS_KEY=

# Back these two up before storing a single mailbox. Losing either is
# unrecoverable, and a database backup without them cannot be decrypted.
AUTH_SECRET=
CREDENTIALS_ENCRYPTION_KEY=
INTERNAL_API_TOKEN=
SECRET_KEY_BASE=

# The credential for the two routes that open a sealed key and sign a blob
# operation. Falls back to INTERNAL_API_TOKEN when unset; set it to its own
# value here, because the tracking and forms services are internet-facing and
# carry the shared one. Nodes receive this, the edge services do not.
NODE_BROKER_TOKEN=

# --- storage ----------------------------------------------------------------
# s3, not filesystem: a worker on another machine reads the message body the
# backend wrote, and it does not have your disk.
BLOB_PROVIDER=s3
BLOB_BUCKET=warmbly-blobs-<suffix>
BLOB_PUBLIC_BASE_URL=https://api.example.com/public

# --- addresses --------------------------------------------------------------
API_PUBLIC_URL=https://api.example.com
# What a node is told to call back on. It must be reachable from every machine
# in the fleet, not just from inside the container network.
ENCRYPTED_KEYS_BACKEND_URL=https://api.example.com
APP_URL=https://app.example.com
CORS_ALLOW_ORIGINS=https://app.example.com,https://admin.example.com
WEBSOCKET_URL=wss://rt.example.com/socket/websocket
PHX_HOST=rt.example.com
TRACKING_DOMAIN=track.example.com
FORMS_DOMAIN=forms.example.com
# The CIDRs your container host's proxy sends from. Without it every request
# looks like it came from the proxy and per-IP rate limiting protects nothing.
TRUSTED_PROXIES=

# --- platform mail ----------------------------------------------------------
# Login codes, invitations, resets and digests. NOT campaign mail, which goes
# out through the mailboxes your customers connect.
#
# SES needs a verified domain identity with published DKIM records, and
# production access: a sandboxed account only delivers to verified addresses.
# The consumer sends notification digests through the same transport, so it
# needs ses:SendEmail as well.
MAIL_TRANSPORT=ses
EMAIL_ADDRESS=noreply@example.com
EMAIL_NAME=Warmbly

# --- mailbox OAuth clients --------------------------------------------------
BOX_GOOGLE_CLIENT_ID=
BOX_GOOGLE_CLIENT_SECRET=
BOX_OUTLOOK_CLIENT_ID=
BOX_OUTLOOK_CLIENT_SECRET=