# Copy to .env and fill in real values for local development.
# Never commit a real .env -- see docs/RI-PLANNING.md, EP-00-T05 (gestão de segredos).

# --- Gateway (EP-05) ---
GATEWAY_HOST=0.0.0.0
GATEWAY_PORT=8000

# --- Example Sales-domain MCP server (EP-06-T02) ---
SALES_DOMAIN_HOST=0.0.0.0
SALES_DOMAIN_PORT=8100
# How the Gateway reaches it (service name resolves inside docker compose;
# use 127.0.0.1 for `make dev`, which runs both processes on the host).
SALES_DOMAIN_URL=http://sales-domain:8100/mcp

# --- Example Finance-domain MCP server (EP-06-T03) ---
FINANCE_DOMAIN_HOST=0.0.0.0
FINANCE_DOMAIN_PORT=8101
FINANCE_DOMAIN_URL=http://finance-domain:8101/mcp

# --- Observability (EP-08) ---
# Unset (default): traces print to stdout via ConsoleSpanExporter.
# Set to "http://otel-collector:4318" and run with `--profile observability`
# to export real OTLP traces to the local otel-collector + Jaeger
# (EP-08-T04; UI at http://localhost:16686). Requires the `emcp-bus[otlp]`
# extra (already installed in the Docker image, see deploy/docker/Dockerfile).
# OTEL_EXPORTER_OTLP_ENDPOINT=http://otel-collector:4318

# Where the Gateway and example domain servers append audit events
# (EP-08-T02) -- JSONL, append-only, never contains raw token/secret values.
EMCP_AUDIT_LOG_PATH=/tmp/emcp-audit.jsonl

# TTL (milliseconds) the Gateway hints clients to cache a `tools/list`
# response for (EP-05-T03, SEP-2549) -- always `cacheScope: "private"`,
# never configurable to "public" (README.md §45 Teste 5).
# EMCP_TOOLS_LIST_CACHE_TTL_MS=5000

# --- PDP (EP-03) ---
# Required: the Gateway fails closed at startup if this is unreachable
# (README.md §38, EP-05-T06) -- there is no "run without a PDP" mode.
OPA_URL=http://opa:8181

# --- Identity / OIDC (EP-01-T01/T03) ---
# Unset (default): no OIDC provider configured, every request is
# unauthenticated -- deny-by-default falls back to the Gateway's own
# handler-level checks instead of the SDK's RequireAuthMiddleware (see
# emcp_bus/gateway/server.py's module docstring). Uncomment all three to
# enable real bearer-token auth against the `keycloak` compose service
# (profile `identity`; realm imported from deploy/keycloak/realm-export.json
# -- clients sales-read-agent/sales-write-agent/finance-payments-agent,
# secrets `dev-<client-id>-secret`, matching config/clients/*.yaml). Run with
# `docker compose --profile core --profile identity up`. Any OIDC-compliant
# IdP works here, not just Keycloak (EP-01-T03 is IdP-agnostic).
# OIDC_JWKS_URL=http://keycloak:8080/realms/emcp/protocol/openid-connect/certs
# OIDC_ISSUER=http://keycloak:8080/realms/emcp
# OIDC_AUDIENCE=emcp-gateway

# --- Downstream / outbound identity (EP-07) ---
# Never the inbound MCP Client's token -- see config/backends/*.yaml and
# src/emcp_bus/downstream/identity.py. Also the credential the domain
# servers themselves require of every inbound request when run via `main()`
# (EP-05-T07's `BackendCredentialGate`) -- a request lacking it never
# reaches a tool handler, whether or not it also came through the Gateway.
SALES_DOMAIN_SERVICE_TOKEN=dev-sales-domain-service-token
FINANCE_DOMAIN_SERVICE_TOKEN=dev-finance-domain-service-token

# credential_mode: token_exchange (RFC 8693 via Keycloak's Standard Token
# Exchange, GA since Keycloak 26.2) is an alternative to the static
# service-account tokens above -- unset (default) unless a backend in
# config/backends/*.yaml actually declares `credential_mode: token_exchange`
# (the RI's seed backends don't; this is an available, verified-working
# extension, see src/emcp_bus/downstream/identity.py's module docstring and
# deploy/keycloak/realm-export.json's `gateway-token-exchange` client).
# GATEWAY_TOKEN_EXCHANGE_CLIENT_ID=gateway-token-exchange
# GATEWAY_TOKEN_EXCHANGE_CLIENT_SECRET=dev-gateway-token-exchange-secret

# --- Example agent LLM (EP-13-T01) ---
# Required only for tests/e2e/test_example_agent.py and running
# agents/example_agent/ directly -- skipped (not failed) if unset. Any
# OpenAI-compatible endpoint works; verified 2026-09-14 against OCI
# Generative AI's OpenAI-compatible surface with real tool-calling
# (meta.llama-3.3-70b-instruct).
# LLM_BASE_URL=https://inference.generativeai.<region>.oci.oraclecloud.com/openai/v1
# LLM_API_KEY=
# LLM_MODEL=meta.llama-3.3-70b-instruct

# --- Langfuse self-hosted (EP-13-T02, profile `llm-observability`) ---
# See deploy/langfuse/docker-compose.override.yml -- opt-in, heavy (6
# containers), decoupled from `core`/`identity`. Point the RI's existing
# OTel plumbing (EP-08-T01) at it with standard OTel SDK env vars, no code
# change needed:
# OTEL_EXPORTER_OTLP_ENDPOINT=http://langfuse-web:3000/api/public/otel
# OTEL_EXPORTER_OTLP_HEADERS=Authorization=Basic <base64(public_key:secret_key)>
# Get a public/secret key pair from the Langfuse UI (http://localhost:3000)
# after first boot, or pre-seed one via LANGFUSE_INIT_PROJECT_PUBLIC_KEY/
# LANGFUSE_INIT_PROJECT_SECRET_KEY (see the override file's own env vars).