mirror of
https://github.com/mcloh/Enterprise-MCP-Service-Bus.git
synced 2026-11-05 22:14:11 +00:00
96 lines
4.9 KiB
Plaintext
96 lines
4.9 KiB
Plaintext
# Copy to .env and fill in real values for local development.
|
|
# Never commit a real .env -- see docs/RI-PLANNING.md, EP-00-T05 (gestão de segredos).
|
|
|
|
# --- Gateway (EP-05) ---
|
|
GATEWAY_HOST=0.0.0.0
|
|
GATEWAY_PORT=8000
|
|
|
|
# --- Example Sales-domain MCP server (EP-06-T02) ---
|
|
SALES_DOMAIN_HOST=0.0.0.0
|
|
SALES_DOMAIN_PORT=8100
|
|
# How the Gateway reaches it (service name resolves inside docker compose;
|
|
# use 127.0.0.1 for `make dev`, which runs both processes on the host).
|
|
SALES_DOMAIN_URL=http://sales-domain:8100/mcp
|
|
|
|
# --- Example Finance-domain MCP server (EP-06-T03) ---
|
|
FINANCE_DOMAIN_HOST=0.0.0.0
|
|
FINANCE_DOMAIN_PORT=8101
|
|
FINANCE_DOMAIN_URL=http://finance-domain:8101/mcp
|
|
|
|
# --- Observability (EP-08) ---
|
|
# Unset (default): traces print to stdout via ConsoleSpanExporter.
|
|
# Set to "http://otel-collector:4318" and run with `--profile observability`
|
|
# to export real OTLP traces to the local otel-collector + Jaeger
|
|
# (EP-08-T04; UI at http://localhost:16686). Requires the `emcp-bus[otlp]`
|
|
# extra (already installed in the Docker image, see deploy/docker/Dockerfile).
|
|
# OTEL_EXPORTER_OTLP_ENDPOINT=http://otel-collector:4318
|
|
|
|
# Where the Gateway and example domain servers append audit events
|
|
# (EP-08-T02) -- JSONL, append-only, never contains raw token/secret values.
|
|
EMCP_AUDIT_LOG_PATH=/tmp/emcp-audit.jsonl
|
|
|
|
# TTL (milliseconds) the Gateway hints clients to cache a `tools/list`
|
|
# response for (EP-05-T03, SEP-2549) -- always `cacheScope: "private"`,
|
|
# never configurable to "public" (README.md §45 Teste 5).
|
|
# EMCP_TOOLS_LIST_CACHE_TTL_MS=5000
|
|
|
|
# --- PDP (EP-03) ---
|
|
# Required: the Gateway fails closed at startup if this is unreachable
|
|
# (README.md §38, EP-05-T06) -- there is no "run without a PDP" mode.
|
|
OPA_URL=http://opa:8181
|
|
|
|
# --- Identity / OIDC (EP-01-T01/T03) ---
|
|
# Unset (default): no OIDC provider configured, every request is
|
|
# unauthenticated -- deny-by-default falls back to the Gateway's own
|
|
# handler-level checks instead of the SDK's RequireAuthMiddleware (see
|
|
# emcp_bus/gateway/server.py's module docstring). Uncomment all three to
|
|
# enable real bearer-token auth against the `keycloak` compose service
|
|
# (profile `identity`; realm imported from deploy/keycloak/realm-export.json
|
|
# -- clients sales-read-agent/sales-write-agent/finance-payments-agent,
|
|
# secrets `dev-<client-id>-secret`, matching config/clients/*.yaml). Run with
|
|
# `docker compose --profile core --profile identity up`. Any OIDC-compliant
|
|
# IdP works here, not just Keycloak (EP-01-T03 is IdP-agnostic).
|
|
# OIDC_JWKS_URL=http://keycloak:8080/realms/emcp/protocol/openid-connect/certs
|
|
# OIDC_ISSUER=http://keycloak:8080/realms/emcp
|
|
# OIDC_AUDIENCE=emcp-gateway
|
|
|
|
# --- Downstream / outbound identity (EP-07) ---
|
|
# Never the inbound MCP Client's token -- see config/backends/*.yaml and
|
|
# src/emcp_bus/downstream/identity.py. Also the credential the domain
|
|
# servers themselves require of every inbound request when run via `main()`
|
|
# (EP-05-T07's `BackendCredentialGate`) -- a request lacking it never
|
|
# reaches a tool handler, whether or not it also came through the Gateway.
|
|
SALES_DOMAIN_SERVICE_TOKEN=dev-sales-domain-service-token
|
|
FINANCE_DOMAIN_SERVICE_TOKEN=dev-finance-domain-service-token
|
|
|
|
# credential_mode: token_exchange (RFC 8693 via Keycloak's Standard Token
|
|
# Exchange, GA since Keycloak 26.2) is an alternative to the static
|
|
# service-account tokens above -- unset (default) unless a backend in
|
|
# config/backends/*.yaml actually declares `credential_mode: token_exchange`
|
|
# (the RI's seed backends don't; this is an available, verified-working
|
|
# extension, see src/emcp_bus/downstream/identity.py's module docstring and
|
|
# deploy/keycloak/realm-export.json's `gateway-token-exchange` client).
|
|
# GATEWAY_TOKEN_EXCHANGE_CLIENT_ID=gateway-token-exchange
|
|
# GATEWAY_TOKEN_EXCHANGE_CLIENT_SECRET=dev-gateway-token-exchange-secret
|
|
|
|
# --- Example agent LLM (EP-13-T01) ---
|
|
# Required only for tests/e2e/test_example_agent.py and running
|
|
# agents/example_agent/ directly -- skipped (not failed) if unset. Any
|
|
# OpenAI-compatible endpoint works; verified 2026-09-14 against OCI
|
|
# Generative AI's OpenAI-compatible surface with real tool-calling
|
|
# (meta.llama-3.3-70b-instruct).
|
|
# LLM_BASE_URL=https://inference.generativeai.<region>.oci.oraclecloud.com/openai/v1
|
|
# LLM_API_KEY=
|
|
# LLM_MODEL=meta.llama-3.3-70b-instruct
|
|
|
|
# --- Langfuse self-hosted (EP-13-T02, profile `llm-observability`) ---
|
|
# See deploy/langfuse/docker-compose.override.yml -- opt-in, heavy (6
|
|
# containers), decoupled from `core`/`identity`. Point the RI's existing
|
|
# OTel plumbing (EP-08-T01) at it with standard OTel SDK env vars, no code
|
|
# change needed:
|
|
# OTEL_EXPORTER_OTLP_ENDPOINT=http://langfuse-web:3000/api/public/otel
|
|
# OTEL_EXPORTER_OTLP_HEADERS=Authorization=Basic <base64(public_key:secret_key)>
|
|
# Get a public/secret key pair from the Langfuse UI (http://localhost:3000)
|
|
# after first boot, or pre-seed one via LANGFUSE_INIT_PROJECT_PUBLIC_KEY/
|
|
# LANGFUSE_INIT_PROJECT_SECRET_KEY (see the override file's own env vars).
|