.env.example

# =============================================================================
# Cordum Environment Configuration
# Copy to .env and customize for your deployment
# =============================================================================

# -----------------------------------------------------------------------------
# Core Settings
# -----------------------------------------------------------------------------

# Environment mode (set to "production" for strict security defaults)
CORDUM_ENV=development
# CORDUM_PRODUCTION=true

# TLS minimum version (1.2 or 1.3, default 1.3 in production)
# CORDUM_TLS_MIN_VERSION=1.3

# Enable gRPC reflection (for debugging only)
# CORDUM_GRPC_REFLECTION=1

# Log format (json or text)
# CORDUM_LOG_FORMAT=json

# -----------------------------------------------------------------------------
# Infrastructure - NATS
# -----------------------------------------------------------------------------

# NATS connection
NATS_URL=nats://localhost:4222
NATS_USE_JETSTREAM=1

# JetStream settings
# NATS_JS_ACK_WAIT=30s
# NATS_JS_MAX_AGE=168h
# NATS_JS_REPLICAS=3

# NATS TLS (optional)
# NATS_TLS_CA=/path/to/ca.crt
# NATS_TLS_CERT=/path/to/client.crt
# NATS_TLS_KEY=/path/to/client.key
# NATS_TLS_INSECURE=false
# NATS_TLS_SERVER_NAME=nats.example.com

# -----------------------------------------------------------------------------
# Infrastructure - Redis
# -----------------------------------------------------------------------------

# Redis authentication password
# REQUIRED in production — generate with: openssl rand -hex 32
# WARNING: The default 'cordum-dev' is for LOCAL DEVELOPMENT ONLY.
# Production deployments MUST override this value.
REDIS_PASSWORD=cordum-dev

# Redis connection (include password if REDIS_PASSWORD is set)
REDIS_URL=redis://:${REDIS_PASSWORD}@localhost:6379

# Redis clustering (comma-separated host:port seeds)
# REDIS_CLUSTER_ADDRESSES=redis-0:6379,redis-1:6379,redis-2:6379

# Data TTLs
REDIS_DATA_TTL=24h
# REDIS_DATA_TTL_SECONDS=86400

# Redis TLS (optional)
# REDIS_TLS_CA=/path/to/ca.crt
# REDIS_TLS_CERT=/path/to/client.crt
# REDIS_TLS_KEY=/path/to/client.key
# REDIS_TLS_INSECURE=false
# REDIS_TLS_SERVER_NAME=redis.example.com

# -----------------------------------------------------------------------------
# Gateway - Authentication
# -----------------------------------------------------------------------------

# API key (required - set a strong random key)
CORDUM_API_KEY=
# Alternative: JSON array of keys with metadata
# CORDUM_API_KEYS=[{"key":"key1","tenant":"default","role":"admin"}]
# Or load from file (reloads on change)
# CORDUM_API_KEYS_PATH=/etc/cordum/api-keys.json

# Default tenant for single-tenant mode
TENANT_ID=default

# Allow anonymous auth (dev only - NEVER in production)
# CORDUM_ALLOW_INSECURE_NO_AUTH=1

# Allow X-Principal-Id header override (disabled by default in production)
# CORDUM_ALLOW_HEADER_PRINCIPAL=true

# -----------------------------------------------------------------------------
# Gateway - User Authentication (optional)
# -----------------------------------------------------------------------------

# Enable user/password authentication (stores users in Redis)
CORDUM_USER_AUTH_ENABLED=true

# Default admin user (created on first start if password is set)
CORDUM_ADMIN_USERNAME=admin
# Required when CORDUM_USER_AUTH_ENABLED=true. Must be >= 8 characters.
# Gateway refuses to start if user auth is enabled and this is empty.
CORDUM_ADMIN_PASSWORD=admin123
CORDUM_ADMIN_EMAIL=admin@cordum.local

# -----------------------------------------------------------------------------
# Gateway - JWT Authentication (optional)
# -----------------------------------------------------------------------------

# JWT validation (use HMAC secret OR public key, not both)
# CORDUM_JWT_HMAC_SECRET=your-256-bit-secret
# CORDUM_JWT_PUBLIC_KEY=-----BEGIN PUBLIC KEY-----...
# CORDUM_JWT_PUBLIC_KEY_PATH=/path/to/public.pem
# CORDUM_JWT_ISSUER=https://auth.example.com
# CORDUM_JWT_AUDIENCE=cordum-api
# CORDUM_JWT_DEFAULT_ROLE=user
# CORDUM_JWT_CLOCK_SKEW=5m
# CORDUM_JWT_REQUIRED=true

# -----------------------------------------------------------------------------
# Gateway - Network & Limits
# -----------------------------------------------------------------------------

# Listen addresses
# GATEWAY_GRPC_ADDR=:8080
# GATEWAY_HTTP_ADDR=:8081
# GATEWAY_METRICS_ADDR=:9092

# Allow non-loopback metrics bind in production
# GATEWAY_METRICS_PUBLIC=1

# Rate limiting (per tenant, falls back to client IP)
# These match the gateway defaults; lower for local development if needed.
API_RATE_LIMIT_RPS=2000
API_RATE_LIMIT_BURST=4000

# CORS allowed origins (comma-separated, multiple var names supported)
# CORDUM_ALLOWED_ORIGINS=https://dashboard.example.com
# CORDUM_CORS_ALLOW_ORIGINS=https://dashboard.example.com
# CORS_ALLOW_ORIGINS=https://dashboard.example.com

# HTTP TLS (optional)
# GATEWAY_HTTP_TLS_CERT=/path/to/server.crt
# GATEWAY_HTTP_TLS_KEY=/path/to/server.key

# gRPC TLS (optional)
# GRPC_TLS_CERT=/path/to/server.crt
# GRPC_TLS_KEY=/path/to/server.key

# -----------------------------------------------------------------------------
# Gateway - Tunable Parameters
# -----------------------------------------------------------------------------

# HSTS max-age in seconds (default: 63072000 = 2 years). Set lower during rollout.
# CORDUM_HSTS_MAX_AGE=63072000

# Session token TTL (Go duration, default: 24h)
# CORDUM_SESSION_TTL=24h

# HTTP server timeouts (Go durations)
# GATEWAY_HTTP_READ_TIMEOUT=15s
# GATEWAY_HTTP_WRITE_TIMEOUT=30s
# GATEWAY_HTTP_IDLE_TIMEOUT=60s

# Login brute-force protection
# MAX_LOGIN_ATTEMPTS=5
# LOGIN_LOCKOUT_PERIOD=15m

# bcrypt cost factor for password and API key hashing (default: 12)
# CORDUM_BCRYPT_COST=12

# OIDC JWKS refresh interval (Go duration, default: 6h)
# CORDUM_OIDC_JWKS_REFRESH_INTERVAL=6h

# NATS JetStream MaxAckPending (default: 2048)
# NATS_MAX_ACK_PENDING=2048

# Audit export retry and buffer settings
# CORDUM_AUDIT_EXPORT_MAX_RETRIES=3
# CORDUM_AUDIT_BUFFER_SIZE=1000

# -----------------------------------------------------------------------------
# Gateway - Artifacts
# -----------------------------------------------------------------------------

# Artifact size limit (bytes, default 10MB)
# ARTIFACT_MAX_BYTES=10485760

# Artifact TTLs by retention class
# ARTIFACT_TTL_SHORT=1h
# ARTIFACT_TTL_STANDARD=168h
# ARTIFACT_TTL_AUDIT=8760h

# -----------------------------------------------------------------------------
# Gateway - Pack Marketplace
# -----------------------------------------------------------------------------

# Default pack catalog
# CORDUM_PACK_CATALOG_URL=https://packs.cordum.io/catalog.json
# CORDUM_PACK_CATALOG_ID=official
# CORDUM_PACK_CATALOG_TITLE=Official Packs
# CORDUM_PACK_CATALOG_DEFAULT_DISABLED=1

# Marketplace settings
# CORDUM_MARKETPLACE_HTTP_TIMEOUT=15s

# -----------------------------------------------------------------------------
# Scheduler
# -----------------------------------------------------------------------------

# Config file paths
POOL_CONFIG_PATH=/etc/cordum/pools.yaml
TIMEOUT_CONFIG_PATH=/etc/cordum/timeouts.yaml

# Job metadata TTL
JOB_META_TTL=168h
# JOB_META_TTL_SECONDS=604800

# Worker snapshot interval
WORKER_SNAPSHOT_INTERVAL=5s

# Config reload interval
# SCHEDULER_CONFIG_RELOAD_INTERVAL=30s

# Metrics
# SCHEDULER_METRICS_ADDR=:9090
# SCHEDULER_METRICS_PUBLIC=1

# -----------------------------------------------------------------------------
# Workflow Engine
# -----------------------------------------------------------------------------

# HTTP address for health checks
# WORKFLOW_ENGINE_HTTP_ADDR=:9093

# Scan settings
WORKFLOW_ENGINE_SCAN_INTERVAL=5s
WORKFLOW_ENGINE_RUN_SCAN_LIMIT=200

# -----------------------------------------------------------------------------
# Safety Kernel
# -----------------------------------------------------------------------------

# gRPC address
SAFETY_KERNEL_ADDR=localhost:50051

# Policy source (file or URL)
SAFETY_POLICY_PATH=/etc/cordum/safety.yaml
# SAFETY_POLICY_URL=https://policies.example.com/safety.yaml
# SAFETY_POLICY_URL_ALLOWLIST=policies.example.com,internal.example.com
# SAFETY_POLICY_URL_ALLOW_PRIVATE=1

# Policy signature verification (required in production)
# SAFETY_POLICY_PUBLIC_KEY=/path/to/policy-signing.pub
# SAFETY_POLICY_SIGNATURE=/path/to/safety.yaml.sig
# SAFETY_POLICY_SIGNATURE_PATH=/path/to/safety.yaml.sig
# SAFETY_POLICY_SIGNATURE_REQUIRED=true

# Policy reload and overlays
# SAFETY_POLICY_RELOAD_INTERVAL=30s
# SAFETY_POLICY_CONFIG_SCOPE=tenant
# SAFETY_POLICY_CONFIG_ID=default
# SAFETY_POLICY_CONFIG_KEY=policy
# SAFETY_POLICY_CONFIG_DISABLE=false

# Decision caching
# SAFETY_DECISION_CACHE_TTL=5s

# TLS server
# SAFETY_KERNEL_TLS_CERT=/path/to/server.crt
# SAFETY_KERNEL_TLS_KEY=/path/to/server.key

# TLS client verification
# SAFETY_KERNEL_TLS_CA=/path/to/ca.crt
# SAFETY_KERNEL_TLS_REQUIRED=true

# -----------------------------------------------------------------------------
# Context Engine
# -----------------------------------------------------------------------------

# gRPC address
# CONTEXT_ENGINE_ADDR=:50070

# TLS server
# CONTEXT_ENGINE_TLS_CERT=/path/to/server.crt
# CONTEXT_ENGINE_TLS_KEY=/path/to/server.key

# TLS client
# CONTEXT_ENGINE_TLS_CA=/path/to/ca.crt
# CONTEXT_ENGINE_TLS_REQUIRED=true

# -----------------------------------------------------------------------------
# Dashboard
# -----------------------------------------------------------------------------

# API base URL (for dashboard to reach gateway)
# Leave empty to use relative /api/v1 through nginx proxy (recommended)
# Set to full URL only when dashboard accesses gateway directly
# CORDUM_API_BASE_URL=http://localhost:8081

# Embed API key in dashboard frontend bundle (default: false)
# WARNING: Setting to true exposes the API key in browser JavaScript.
# Only use in local development — NEVER enable in production.
# CORDUM_DASHBOARD_EMBED_API_KEY=true

# Default tenant/principal for dashboard
CORDUM_TENANT_ID=default
# CORDUM_PRINCIPAL_ID=
# CORDUM_PRINCIPAL_ROLE=

# -----------------------------------------------------------------------------
# Audit — SIEM Export (optional)
# -----------------------------------------------------------------------------

# Export type: webhook | syslog | datadog | cloudwatch | none (default: none)
# CORDUM_AUDIT_EXPORT_TYPE=none

# Webhook — HTTP POST with JSON payload
# CORDUM_AUDIT_EXPORT_WEBHOOK_URL=https://siem.example.com/api/events
# CORDUM_AUDIT_EXPORT_WEBHOOK_SECRET=your-hmac-secret

# Syslog — RFC 5424 (tcp:// or udp://)
# CORDUM_AUDIT_EXPORT_SYSLOG_ADDR=tcp://syslog.corp.com:514

# Datadog — Log Intake API
# CORDUM_AUDIT_EXPORT_DD_API_KEY=your-datadog-api-key
# CORDUM_AUDIT_EXPORT_DD_SITE=us1
# CORDUM_AUDIT_EXPORT_DD_TAGS=env:production,service:cordum-gateway

# AWS CloudWatch Logs
# CORDUM_AUDIT_EXPORT_CW_LOG_GROUP=/cordum/audit
# CORDUM_AUDIT_EXPORT_CW_LOG_STREAM=gateway
# AWS_ACCESS_KEY_ID=...
# AWS_SECRET_ACCESS_KEY=...
# AWS_REGION=us-east-1