# Copy to .env and fill in real values for local development.
# Never commit a real .env -- see docs/RI-PLANNING.md, EP-00-T05 (gestão de segredos).

# --- Gateway (EP-05) ---
GATEWAY_HOST=0.0.0.0
GATEWAY_PORT=8000

# --- Example Sales-domain MCP server (EP-06-T02) ---
SALES_DOMAIN_HOST=0.0.0.0
SALES_DOMAIN_PORT=8100
# How the Gateway reaches it (service name resolves inside docker compose;
# use 127.0.0.1 for `make dev`, which runs both processes on the host).
SALES_DOMAIN_URL=http://sales-domain:8100/mcp

# --- Example Finance-domain MCP server (EP-06-T03) ---
FINANCE_DOMAIN_HOST=0.0.0.0
FINANCE_DOMAIN_PORT=8101
FINANCE_DOMAIN_URL=http://finance-domain:8101/mcp

# --- Observability (EP-08) ---
# Unset (default): traces print to stdout via ConsoleSpanExporter.
# Set to "http://otel-collector:4318" and run with `--profile observability`
# to export real OTLP traces to the local otel-collector + Jaeger
# (EP-08-T04; UI at http://localhost:16686). Requires the `emcp-bus[otlp]`
# extra (already installed in the Docker image, see deploy/docker/Dockerfile).
# OTEL_EXPORTER_OTLP_ENDPOINT=http://otel-collector:4318

# Where the Gateway and example domain servers append audit events
# (EP-08-T02) -- JSONL, append-only, never contains raw token/secret values.
EMCP_AUDIT_LOG_PATH=/tmp/emcp-audit.jsonl

# TTL (milliseconds) the Gateway hints clients to cache a `tools/list`
# response for (EP-05-T03, SEP-2549) -- always `cacheScope: "private"`,
# never configurable to "public" (README.md §45 Teste 5).
# EMCP_TOOLS_LIST_CACHE_TTL_MS=5000

# --- PDP (EP-03) ---
# Required: the Gateway fails closed at startup if this is unreachable
# (README.md §38, EP-05-T06) -- there is no "run without a PDP" mode.
OPA_URL=http://opa:8181

# --- Identity / OIDC (EP-01-T01/T03) ---
# Unset (default): no OIDC provider configured, every request is
# unauthenticated -- deny-by-default falls back to the Gateway's own
# handler-level checks instead of the SDK's RequireAuthMiddleware (see
# emcp_bus/gateway/server.py's module docstring). Uncomment all three to
# enable real bearer-token auth against the `keycloak` compose service
# (profile `identity`; realm imported from deploy/keycloak/realm-export.json
# -- clients sales-read-agent/sales-write-agent/finance-payments-agent,
# secrets `dev-<client-id>-secret`, matching config/clients/*.yaml). Run with
# `docker compose --profile core --profile identity up`. Any OIDC-compliant
# IdP works here, not just Keycloak (EP-01-T03 is IdP-agnostic).
# OIDC_JWKS_URL=http://keycloak:8080/realms/emcp/protocol/openid-connect/certs
# OIDC_ISSUER=http://keycloak:8080/realms/emcp
# OIDC_AUDIENCE=emcp-gateway

# --- Downstream / outbound identity (EP-07) ---
# Never the inbound MCP Client's token -- see config/backends/*.yaml and
# src/emcp_bus/downstream/identity.py. Also the credential the domain
# servers themselves require of every inbound request when run via `main()`
# (EP-05-T07's `BackendCredentialGate`) -- a request lacking it never
# reaches a tool handler, whether or not it also came through the Gateway.
SALES_DOMAIN_SERVICE_TOKEN=dev-sales-domain-service-token
FINANCE_DOMAIN_SERVICE_TOKEN=dev-finance-domain-service-token