.env.example

# Storage policy. Blank values use repository-relative defaults. On Windows the
# storage guard still requires the resolved roots to live on the fixed D: drive.
OPS_CACHE_ROOT=
OPS_ARTIFACT_ROOT=
OPS_DATA_ROOT=
OPS_MODEL_ROOT=

# Fail-closed capacity thresholds used by scripts/storage/check-capacity.ps1.
OPS_MIN_C_FREE_GB=10
OPS_MIN_D_FREE_GB=20

# Portable workspace-volume threshold used by scripts/storage/check-capacity.sh.
OPS_MIN_WORKSPACE_FREE_GB=20

# Local service ports. Change only in an untracked .env file.
OPERATOR_WEB_PORT=3000
OPSMIND_DEPLOYMENT_ENVIRONMENT=local
PLATFORM_API_PORT=8080
PLATFORM_MANAGEMENT_PORT=8082
OPSMIND_MANAGEMENT_EXPOSED_ENDPOINTS=health
OPSMIND_MAX_JSON_BODY_BYTES=65536
AI_RUNTIME_MAX_JSON_BODY_BYTES=1048576
AI_RUNTIME_BODY_RECEIVE_TIMEOUT_SECONDS=5
AI_RUNTIME_PORT=8000
TOOL_GATEWAY_PORT=8081
PROMETHEUS_PORT=9090
POSTGRES_PORT=5432
REDIS_PORT=6379
MINIO_API_PORT=9000
MINIO_CONSOLE_PORT=9001

# Local infrastructure identities. Secret placeholders must remain empty here
# and in .env; supply their values through the process environment or an
# approved secret manager only.
POSTGRES_DB=opsmind
# POSTGRES_USER owns migrations only; the application uses the separate
# non-owner role so PostgreSQL RLS remains meaningful.
POSTGRES_USER=opsmind_migrator
POSTGRES_APP_USER=opsmind_app
POSTGRES_DISPATCHER_USER=opsmind_dispatcher
POSTGRES_WORKFLOW_RECONCILER_USER=opsmind_workflow_reconciler
POSTGRES_AI_RUNTIME_USER=opsmind_ai_runtime
POSTGRES_TOOL_GATEWAY_MIGRATOR_USER=opsmind_tool_gateway_migrator
POSTGRES_TOOL_GATEWAY_USER=opsmind_tool_gateway
POSTGRES_PASSWORD=
POSTGRES_APP_PASSWORD=
POSTGRES_DISPATCHER_PASSWORD=
POSTGRES_WORKFLOW_RECONCILER_PASSWORD=
POSTGRES_AI_RUNTIME_PASSWORD=
POSTGRES_TOOL_GATEWAY_MIGRATOR_PASSWORD=
POSTGRES_TOOL_GATEWAY_PASSWORD=
SPRING_PROFILES_ACTIVE=
SPRING_DATASOURCE_URL=jdbc:postgresql://127.0.0.1:5432/opsmind
# Used by the manual `migrate` command; keep it on the migration role.
SPRING_DATASOURCE_USERNAME=opsmind_migrator
SPRING_DATASOURCE_PASSWORD=
OPSMIND_FLYWAY_ENABLED=true
OPSMIND_DB_POOL_MAX=10
OPSMIND_DB_CONNECTION_TIMEOUT_MS=3000
OPSMIND_DISPATCHER_ENABLED=false
OPSMIND_WORKFLOW_RECONCILER_ENABLED=false
AI_RUNTIME_STATE_BACKEND=memory
AI_RUNTIME_DATABASE_HOST=127.0.0.1
AI_RUNTIME_DATABASE_PORT=5432
AI_RUNTIME_DATABASE_NAME=opsmind
AI_RUNTIME_DATABASE_USER=opsmind_ai_runtime
AI_RUNTIME_DATABASE_PASSWORD=
AI_RUNTIME_DB_POOL_MIN=1
AI_RUNTIME_DB_POOL_MAX=8
AI_RUNTIME_DB_POOL_TIMEOUT_SECONDS=3
TOOL_GATEWAY_DATABASE_URL=jdbc:postgresql://127.0.0.1:5432/opsmind
TOOL_GATEWAY_DATABASE_USER=opsmind_tool_gateway
TOOL_GATEWAY_DATABASE_PASSWORD=
TOOL_GATEWAY_PERSISTENCE_ENABLED=false
TOOL_GATEWAY_FLYWAY_ENABLED=false
TOOL_GATEWAY_DB_POOL_MAX=8
TOOL_GATEWAY_DB_CONNECTION_TIMEOUT_MS=3000
TOOL_GATEWAY_EXECUTION_LEASE_DURATION=PT30S
TOOL_GATEWAY_PROMETHEUS_ENABLED=false
TOOL_GATEWAY_PROMETHEUS_BASE_URI=https://prometheus.invalid.example
TOOL_GATEWAY_PROMETHEUS_ALLOW_INTERNAL_CLEARTEXT=false
TOOL_GATEWAY_PROMETHEUS_CONNECT_TIMEOUT=PT2S
TOOL_GATEWAY_PROMETHEUS_REQUEST_TIMEOUT=PT4S
TOOL_GATEWAY_PROMETHEUS_MAX_RESPONSE_BYTES=65536
TOOL_GATEWAY_PROMETHEUS_MAX_SERIES=1
TOOL_GATEWAY_PROMETHEUS_MAX_POINTS=10
TOOL_GATEWAY_PROMETHEUS_QUERY_WINDOW=PT2M
TOOL_GATEWAY_PROMETHEUS_QUERY_STEP=PT1M
# Minimum lifetime; effective lease never expires before the signed request deadline.
AI_RUNTIME_RESERVATION_LEASE_SECONDS=30
AI_RUNTIME_INVOCATION_RETENTION_DAYS=30
# Asymmetric analysis capability: private key is a secret-mounted file on the
# Platform API; AI Runtime receives only the public JWKS file.
OPSMIND_AI_CAPABILITY_ISSUANCE_ENABLED=false
OPSMIND_AI_CAPABILITY_ISSUER=https://platform.invalid.example
OPSMIND_AI_CAPABILITY_AUDIENCE=opsmind-ai-runtime
OPSMIND_AI_CAPABILITY_KEY_ID=
OPSMIND_AI_CAPABILITY_PRIVATE_KEY_FILE=
OPSMIND_AI_CAPABILITY_JWKS_FILE=
OPSMIND_AI_CAPABILITY_MAX_LIFETIME=PT4M
OPSMIND_TOOL_CAPABILITY_ISSUANCE_ENABLED=false
OPSMIND_TOOL_CAPABILITY_ISSUER=https://platform.invalid.example
OPSMIND_TOOL_CAPABILITY_AUDIENCE=opsmind-tool-gateway
OPSMIND_TOOL_CAPABILITY_AUTHORIZED_PARTY=opsmind-platform-api
OPSMIND_TOOL_CAPABILITY_KEY_ID=
OPSMIND_TOOL_CAPABILITY_PRIVATE_KEY_FILE=
OPSMIND_TOOL_CAPABILITY_MAX_LIFETIME=PT2M
OPSMIND_TOOL_GATEWAY_CLIENT_ENABLED=false
OPSMIND_TOOL_GATEWAY_ENDPOINT=https://tool-gateway.invalid.example/internal/v1/tools/execute
OPSMIND_TOOL_GATEWAY_ALLOW_LOCAL_CLEARTEXT=false
OPSMIND_TOOL_GATEWAY_CONNECT_TIMEOUT=PT2S
OPSMIND_TOOL_GATEWAY_REQUEST_TIMEOUT=PT10S
OPSMIND_TOOL_GATEWAY_MAX_RESPONSE_BODY_BYTES=131072
OPSMIND_TOOL_WORKLOAD_AUTH_ENABLED=false
OPSMIND_TOOL_WORKLOAD_ISSUER=https://idp.invalid.example/opsmind
OPSMIND_TOOL_WORKLOAD_TOKEN_ENDPOINT=https://idp.invalid.example/opsmind/oauth2/token
OPSMIND_TOOL_WORKLOAD_ALLOW_LOCAL_CLEARTEXT=false
OPSMIND_TOOL_WORKLOAD_AUDIENCE=opsmind-tool-gateway-workload
OPSMIND_TOOL_WORKLOAD_CLIENT_ID=
OPSMIND_TOOL_WORKLOAD_CLIENT_SECRET=
OPSMIND_TOOL_WORKLOAD_SCOPE=tool.execute
OPSMIND_TOOL_WORKLOAD_CONNECT_TIMEOUT=PT2S
OPSMIND_TOOL_WORKLOAD_REQUEST_TIMEOUT=PT5S
OPSMIND_TOOL_WORKLOAD_REFRESH_SKEW=PT30S
OPSMIND_TOOL_WORKLOAD_MAX_TOKEN_LIFETIME=PT5M
OPSMIND_TOOL_WORKLOAD_MAX_RESPONSE_BODY_BYTES=16384
OPSMIND_CAPABILITY_MAX_LIFETIME_SECONDS=300
# Platform-to-runtime client stays disabled. Cleartext is limited to an
# explicitly enabled single-label local Compose service name.
OPSMIND_AI_RUNTIME_CLIENT_ENABLED=false
OPSMIND_AI_RUNTIME_ENDPOINT=https://ai-runtime.invalid.example/api/v1/analysis
OPSMIND_AI_RUNTIME_ALLOW_LOCAL_CLEARTEXT=false
OPSMIND_AI_RUNTIME_CONNECT_TIMEOUT=PT2S
OPSMIND_AI_RUNTIME_REQUEST_TIMEOUT=PT30S
OPSMIND_AI_RUNTIME_MAX_RESPONSE_BODY_BYTES=1048576
# Durable artifact storage is disabled until an approved backend/KMS profile is
# deployed. Do not put AWS access keys, session tokens, object URLs, or secret
# values in this file; the adapter uses the external default credential chain.
OPSMIND_EVIDENCE_ARTIFACT_STORAGE_ENABLED=false
OPSMIND_EVIDENCE_ARTIFACT_STORAGE_ENDPOINT=https://s3.invalid.example
OPSMIND_EVIDENCE_ARTIFACT_STORAGE_ALLOW_LOOPBACK_CLEARTEXT=false
OPSMIND_EVIDENCE_ARTIFACT_STORAGE_REGION=disabled
OPSMIND_EVIDENCE_ARTIFACT_STORAGE_BUCKET=disabled
OPSMIND_EVIDENCE_ARTIFACT_STORAGE_PATH_STYLE_ACCESS=false
OPSMIND_EVIDENCE_ARTIFACT_STORAGE_EXPECTED_BUCKET_OWNER=
# Request identifier may be an alias; verification uses the canonical response reference.
OPSMIND_EVIDENCE_ARTIFACT_STORAGE_KMS_KEY_ID=
OPSMIND_EVIDENCE_ARTIFACT_STORAGE_EXPECTED_KMS_KEY_REFERENCE=
OPSMIND_EVIDENCE_ARTIFACT_STORAGE_ENCRYPTION_PROFILE=production-kms
OPSMIND_EVIDENCE_ARTIFACT_STORAGE_MAXIMUM_OBJECT_BYTES=0
OPSMIND_EVIDENCE_ARTIFACT_STORAGE_CONNECT_TIMEOUT=PT2S
OPSMIND_EVIDENCE_ARTIFACT_STORAGE_SOCKET_TIMEOUT=PT30S
OPSMIND_EVIDENCE_ARTIFACT_STORAGE_API_CALL_ATTEMPT_TIMEOUT=PT30S
OPSMIND_EVIDENCE_ARTIFACT_STORAGE_API_CALL_TIMEOUT=PT35S
OPSMIND_EVIDENCE_ARTIFACT_STORAGE_SOURCE_VERIFICATION_BUDGET=PT5S
OPSMIND_EVIDENCE_ARTIFACT_STORAGE_SETTLEMENT_SAFETY_MARGIN=PT5S
OPSMIND_EVIDENCE_ARTIFACT_STORAGE_MAXIMUM_CONNECTIONS=8
OPSMIND_EVIDENCE_ARTIFACT_STORAGE_UPLOAD_LEASE_DURATION=PT1M
OPSMIND_INVESTIGATION_V1_ENABLED=false
OPSMIND_INVESTIGATION_FIXTURE=false
OPSMIND_INVESTIGATION_STORE=in-memory
OPSMIND_INVESTIGATION_EXECUTION_MODE=inline
OPSMIND_INVESTIGATION_TEMPORAL_CLUSTER_ID=disabled
OPSMIND_INVESTIGATION_TEMPORAL_NAMESPACE=disabled
OPSMIND_INVESTIGATION_TEMPORAL_WORKFLOW_TYPE=opsmind-investigation-v1
OPSMIND_INVESTIGATION_TEMPORAL_TASK_QUEUE=disabled
OPSMIND_INVESTIGATION_TEMPORAL_CLIENT_ENABLED=false
OPSMIND_INVESTIGATION_TEMPORAL_TARGET=disabled
OPSMIND_INVESTIGATION_TEMPORAL_TLS_ENABLED=true
OPSMIND_INVESTIGATION_TEMPORAL_ALLOW_LOCAL_CLEARTEXT=false
# Must fit inside the starter lease together with RPC_MARGIN.
OPSMIND_INVESTIGATION_TEMPORAL_RPC_TIMEOUT=PT5S
OPSMIND_INVESTIGATION_TEMPORAL_WORKER_IDENTITY=disabled
OPSMIND_INVESTIGATION_TEMPORAL_WORKER_BUILD_ID=disabled
OPSMIND_INVESTIGATION_TEMPORAL_CLIENT_REQUIRED_WORKER_POLLER_MAX_AGE=PT30S
OPSMIND_INVESTIGATION_TEMPORAL_CLIENT_REQUIRED_WORKER_POLLER_FUTURE_SKEW=PT5S
OPSMIND_INVESTIGATION_TEMPORAL_WORKER_ENABLED=false
OPSMIND_INVESTIGATION_TEMPORAL_WORKER_MAX_CONCURRENT_WORKFLOW_TASK_EXECUTORS=32
OPSMIND_INVESTIGATION_TEMPORAL_WORKER_MAX_CONCURRENT_WORKFLOW_TASK_POLLERS=5
OPSMIND_INVESTIGATION_TEMPORAL_WORKER_SHUTDOWN_TIMEOUT=PT10S
OPSMIND_INVESTIGATION_TEMPORAL_OBSERVER_ENABLED=false
OPSMIND_INVESTIGATION_TEMPORAL_OBSERVER_TARGET=disabled
OPSMIND_INVESTIGATION_TEMPORAL_OBSERVER_TLS_ENABLED=true
OPSMIND_INVESTIGATION_TEMPORAL_OBSERVER_ALLOW_LOCAL_CLEARTEXT=false
OPSMIND_INVESTIGATION_TEMPORAL_OBSERVER_RPC_TIMEOUT=PT5S
OPSMIND_INVESTIGATION_TEMPORAL_OBSERVER_API_KEY=
OPSMIND_WORKFLOW_RECONCILER_POLL_INTERVAL=PT1S
OPSMIND_WORKFLOW_RECONCILER_LEASE_DURATION=PT30S
OPSMIND_WORKFLOW_RECONCILER_SETTLEMENT_MARGIN=PT5S
OPSMIND_WORKFLOW_RECONCILER_MAX_ATTEMPTS=8
OPSMIND_WORKFLOW_RECONCILER_MAX_AGE=PT1H
OPSMIND_WORKFLOW_RECONCILER_MAX_HANDOFF_AGE=PT1H
OPSMIND_WORKFLOW_RECONCILER_INITIAL_BACKOFF=PT1S
OPSMIND_WORKFLOW_RECONCILER_MAX_BACKOFF=PT1M
OPSMIND_WORKFLOW_RECONCILER_ABSENCE_CONFIRMATION_DELAY=PT10S
OPSMIND_WORKFLOW_RECONCILER_NAMESPACE_RETENTION=P30D
OPSMIND_WORKFLOW_RECONCILER_RETENTION_SAFETY_MARGIN=P1D
OPSMIND_INVESTIGATION_WORKFLOW_STARTER_ENABLED=false
OPSMIND_INVESTIGATION_WORKFLOW_STARTER_POLL_INTERVAL=PT1S
# Required invariant: TEMPORAL_RPC_TIMEOUT + RPC_MARGIN < LEASE_DURATION.
OPSMIND_INVESTIGATION_WORKFLOW_STARTER_LEASE_DURATION=PT30S
OPSMIND_INVESTIGATION_WORKFLOW_STARTER_RPC_MARGIN=PT5S
OPSMIND_INVESTIGATION_WORKFLOW_STARTER_MAX_AGE=PT1H
OPSMIND_INVESTIGATION_WORKFLOW_STARTER_INITIAL_BACKOFF=PT1S
OPSMIND_INVESTIGATION_WORKFLOW_STARTER_MAX_BACKOFF=PT1M
OPSMIND_INVESTIGATION_WORKFLOW_STARTER_MAX_ATTEMPTS=8
OPSMIND_INVESTIGATION_WORKFLOW_STARTER_TENANT_LIMIT=25
OPSMIND_INVESTIGATION_WORKFLOW_STARTER_BATCH_SIZE=1
OPSMIND_DISPATCHER_DB_URL=disabled
OPSMIND_DISPATCHER_DB_USERNAME=disabled
OPSMIND_DISPATCHER_DB_PASSWORD=
OPSMIND_DISPATCHER_DB_POOL_MAX=4
OPSMIND_DISPATCHER_DB_CONNECTION_TIMEOUT_MS=3000
OPSMIND_WORKFLOW_RECONCILER_DB_URL=disabled
OPSMIND_WORKFLOW_RECONCILER_DB_USERNAME=disabled
OPSMIND_WORKFLOW_RECONCILER_DB_PASSWORD=
OPSMIND_WORKFLOW_RECONCILER_DB_POOL_MAX=2
OPSMIND_WORKFLOW_RECONCILER_DB_CONNECTION_TIMEOUT_MS=3000
OPSMIND_WORKFLOW_RECONCILER_DB_QUERY_TIMEOUT_SECONDS=1
MINIO_ROOT_USER=opsmind_local
MINIO_ROOT_PASSWORD=
MINIO_IMAGE=registry.invalid.example/opsmind/object-store-review-required:unapproved

# External identity endpoints stay non-routable placeholders until their
# owning conformance phases approve and verify the real endpoints. The
# provider base URL is the official DeepSeek OpenAI-compatible origin, but
# provider traffic remains disabled by default below.
OIDC_ISSUER_URL=https://idp.invalid.example/opsmind
OIDC_AUDIENCE=opsmind-platform-api
OIDC_REQUIRED_AMR=mfa
OIDC_MAX_TOKEN_LIFETIME=PT5M
OIDC_CLOCK_SKEW=PT60S
OIDC_JWKS_REFRESH_MINIMUM_INTERVAL=PT1S
DEEPSEEK_API_BASE_URL=https://api.deepseek.com
AI_PROVIDER_ALLOWED_HOSTS=api.deepseek.com
AI_PROVIDER=disabled
AI_FIXTURE_PROVIDER_ENABLED=false
DEEPSEEK_MODEL=deepseek-v4-flash
AI_ALLOWED_DATA_CLASSES=
AI_PROVIDER_REGION=
AI_EGRESS_POLICY_FILE=
AI_EGRESS_POLICY_HOST_PATH=./.opsmind/config/ai-egress-policy.json
AI_INPUT_COST_USD_PER_MILLION=0
AI_OUTPUT_COST_USD_PER_MILLION=0
# Global PostgreSQL quota; size it to at least 12 * healthy replica count plus
# rollout headroom, subject to the provider's own rate limit.
AI_PROVIDER_PROBE_MAX_CALLS_PER_HOUR=120
DEEPSEEK_API_KEY=

# Safety defaults. A key alone never enables model egress or write actions.
OPS_ENABLE_DEEPSEEK_EGRESS=false
OPS_ENABLE_WRITE_ACTIONS=false
OPSMIND_SECURITY_MODE=fail-closed
# dev/up stay blocked until the operator verifies Docker daemon/build storage
# is on an approved capacity-monitored volume (D: on this workstation).
OPS_DOCKER_STORAGE_VERIFIED=false