.env.example

# Atom local development config.
#
#   cp .env.example .env
#
# These defaults boot a working local stack with BOTH flows:
#   - `make up`     : everything in Docker Compose
#   - `cargo run`   : Atom on the host, Postgres in Docker (`make db`)
#
# Log in with identifier `admin` and the ADMIN_SECRET below.
# Do NOT use these values outside local development.

# --- Postgres -----------------------------------------------------------
# Credentials match `make up` so Cargo and Compose share one Postgres volume.
POSTGRES_USER=atom
POSTGRES_PASSWORD=atom
POSTGRES_DB=atom
# Used by a host `cargo run`. The Compose `atom` service overrides this with
# the in-network postgres:5432 address, so it is safe to keep localhost here.
DATABASE_URL=postgres://atom:atom@localhost:5432/atom

# --- Atom service -------------------------------------------------------
# Listen ports live in the "Ports" section below.
JWT_EXPIRY_SECS=3600
ATOM_LOG_LEVEL=info
ATOM_LOG_FORMAT=text
ATOM_PUBLIC_BASE_URL=http://localhost:8080
ATOM_CORS_ALLOWED_ORIGINS=http://localhost:8080,http://localhost:3005,http://localhost:3000

# --- Admin bootstrap ----------------------------------------------------
# Creates the admin password credential on first boot. Log in as `admin`.
ADMIN_SECRET=12345678
ATOM_MIN_PASSWORD_CHARS=8
# ADMIN_ENTITY_ID=00000000-0000-0000-0000-000000000001

# --- Secret encryption at rest -----------------------------------------
# Root AES-256-GCM key encrypting every recoverable secret: signing private
# keys and retrievable credential secrets (shared keys). Required to create
# shared keys. Local-only value below; replace for shared or production use:
#   openssl rand -base64 32
ATOM_KEY_ENCRYPTION_KEY=MDEyMzQ1Njc4OWFiY2RlZjAxMjM0NTY3ODlhYmNkZWY=
# Operator-visible key id recorded on each encrypted row (rotation seam).
ATOM_KEY_ENCRYPTION_KEY_ID=local:v1
# Local/dev only. Production should leave this false.
ATOM_ALLOW_PLAINTEXT_SIGNING_KEYS=false

# --- Postgres pool controls --------------------------------------------
ATOM_DB_MAX_CONNECTIONS=20
ATOM_DB_MIN_CONNECTIONS=0
ATOM_DB_ACQUIRE_TIMEOUT_SECS=30
ATOM_DB_CONNECT_TIMEOUT_SECS=10
ATOM_DB_IDLE_TIMEOUT_SECS=600
ATOM_DB_MAX_LIFETIME_SECS=1800

# --- Audit retention and abuse controls --------------------------------
ATOM_AUDIT_RETENTION_DAYS=365
ATOM_AUDIT_RETENTION_ENABLED=true
ATOM_AUDIT_CLEANUP_INTERVAL_SECS=86400
ATOM_AUDIT_CLEANUP_BATCH_SIZE=5000
# Off by default: successful high-volume authz/auth events stay in metrics/traces.
# Set true only when you need every allow decision in durable DB audit.
ATOM_AUDIT_HOT_PATH_ALLOW_DB_ENABLED=false
ATOM_LOGIN_FAILURE_LIMIT=5
ATOM_LOGIN_FAILURE_WINDOW_SECS=900
ATOM_TRUSTED_PROXY_CIDRS=
# GraphQL introspection is off by default (production-safe). Leave unset to keep
# it off; the atom-dev Compose profile turns it on. Set true only for dev.
# ATOM_GRAPHQL_INTROSPECTION_ENABLED=true

# --- Optional: event publishing (AMQP) ----------------------------------
# Off by default: with no URL set, Atom writes no event_outbox rows and
# starts no delivery task — zero behavior change. When set, every
# audit-worthy operation (create/update/delete, etc.) is queued in
# event_outbox and delivered to this AMQP broker, published to the default
# exchange with one fixed routing key for every event (consumers filter by
# the payload's own "event" field, not by AMQP routing).
# NOTE: if this is set, Atom will fail to start unless the broker is
# reachable at boot (see main.rs) — start your broker first.
# ATOM_EVENTS_AMQP_URL=amqp://guest:guest@localhost:5672/%2f
# Leave empty (default) to publish to the default exchange, which requires
# no topology declaration and works even when Atom's broker credentials are
# restricted to one pre-provisioned queue (e.g. FluxMQ's local-principal
# publish ACL). Set a name to instead declare and publish to a custom
# durable topic exchange.
# ATOM_EVENTS_AMQP_EXCHANGE=
# Routing key used for every published event; under the default exchange
# this doubles as the destination queue name.
# ATOM_EVENTS_AMQP_ROUTING_KEY=atom.events
# Optional mTLS client identity for brokers that require it (e.g. FluxMQ's
# local-principal listener). Cert and key must be set together.
# ATOM_EVENTS_AMQP_TLS_CLIENT_CERT_PATH=
# ATOM_EVENTS_AMQP_TLS_CLIENT_KEY_PATH=
# Optional CA bundle to verify the broker's server certificate (amqps:// only).
# ATOM_EVENTS_AMQP_TLS_CA_PATH=
# ATOM_EVENTS_OUTBOX_POLL_INTERVAL_SECS=5
# ATOM_EVENTS_OUTBOX_BATCH_SIZE=100
# Only bounds retries for a row whose payload can never be parsed (e.g. left
# over from an older schema_version) — retrying that can never succeed.
# A row that fails to publish (broker outage, etc.) always keeps retrying
# regardless of this value, however long the outage lasts.
# ATOM_EVENTS_OUTBOX_MAX_ATTEMPTS=10
# How long Atom waits on the broker for any single operation — one delivery
# attempt, or the initial connect at startup — before giving up and either
# retrying later (delivery) or failing startup (connect). Guards against a
# broker that accepts the connection but stalls rather than erroring
# outright.
# ATOM_EVENTS_PUBLISH_TIMEOUT_SECS=30

# --- Metrics ------------------------------------------------------------
# Prometheus metrics at GET /metrics. On by default. Set false to skip the
# recorder and unmount /metrics (no rebuild); for a zero-cost build compile with
# `--no-default-features`. /metrics is UNAUTHENTICATED — network-restrict it to
# your scraper in production.
# ATOM_METRICS_ENABLED=false

# --- gRPC TLS -----------------------------------------------------------
# Off by default (plaintext) — fine for local dev. In production, either enable
# TLS here or confine gRPC to a private network / service mesh. Set both cert and
# key to enable server TLS; add the client CA to require client certs (mTLS).
# Compose mounts ATOM_CERTS_CA_DIR at /certs:ro, so container paths can be:
# ATOM_GRPC_TLS_CERT_PATH=/certs/grpc-server.crt
# ATOM_GRPC_TLS_KEY_PATH=/certs/grpc-server.key
# ATOM_GRPC_TLS_CLIENT_CA_PATH=/certs/grpc-client-ca.crt
# For cargo run, use host paths instead, for example ./certs/grpc-server.crt.

# --- Local convenience --------------------------------------------------
# Allow password login before email verification, so local dev needs no SMTP.
ATOM_ALLOW_UNVERIFIED_EMAIL_LOGIN=true
# Allow unauthenticated human self-registration. Defaults to true.
# ATOM_SELF_REGISTRATION_ENABLED=true

# --- Certificates (disabled for local dev) ------------------------------
# Off by default so a fresh `cp .env.example .env` boots without CA files.
# To enable: generate a root CA under ./certs (see README "Certificates"),
# set ATOM_CERTS_ENABLED=true and ATOM_CERTS_CA_MODE=file_root_issuer.
ATOM_CERTS_ENABLED=false
# ATOM_CERTS_CA_MODE=file_root_issuer
# ATOM_CERTS_ROOT_CA_CERT_PATH=/certs/root-ca.crt
# ATOM_CERTS_ROOT_CA_KEY_PATH=/certs/root-ca.key
# ATOM_CERTS_CA_DIR=./certs
# For cargo run, point cert paths at host files instead, e.g. ./certs/root-ca.crt
# ATOM_CERTS_INTERMEDIATE_CA_CERT_PATH=/certs/intermediate-ca.crt
# ATOM_CERTS_INTERMEDIATE_CA_KEY_PATH=/certs/intermediate-ca.key
# ATOM_CERTS_LEAF_DEFAULT_TTL_SECS=2592000
# ATOM_CERTS_LEAF_MAX_TTL_SECS=2592000

# --- Optional: email verification redirects (only if SMTP enabled) ------
# ATOM_EMAIL_VERIFICATION_REDIRECT=http://localhost:8080/auth/email/verify
# ATOM_OAUTH_SUCCESS_REDIRECT=http://localhost:3005/auth/callback
# ATOM_OAUTH_ERROR_REDIRECT=http://localhost:3005/auth/callback
# ATOM_PASSWORD_RESET_REDIRECT=http://localhost:3005/reset-password
# ATOM_INVITATION_REDIRECT=http://localhost:3005/invitations/accept

# --- Optional: SMTP for signup verification email -----------------------
# ATOM_SMTP_HOST=smtp.example.com
# ATOM_SMTP_PORT=587
# ATOM_SMTP_USERNAME=atom@example.com
# ATOM_SMTP_PASSWORD=change-me
# ATOM_SMTP_FROM=atom@example.com
# ATOM_SMTP_TLS=starttls

# --- Optional: email template overrides ---------------------------------
# Compose mounts ATOM_EMAIL_TEMPLATES_HOST_DIR (default ./email-templates) at
# /email-templates:ro and points ATOM_EMAIL_TEMPLATES_DIR there, so
# overriding a template is just editing a file and restarting the container
# — no rebuild required. For cargo run, set ATOM_EMAIL_TEMPLATES_DIR to a
# host path directly instead, e.g. ./email-templates.
# ATOM_EMAIL_TEMPLATES_HOST_DIR=./email-templates
# ATOM_EMAIL_TEMPLATES_DIR=./email-templates

# --- Optional: OIDC providers JSON --------------------------------------
# ATOM_OIDC_PROVIDERS=[{"name":"google","issuer":"https://accounts.google.com","client_id":"...","client_secret":"...","scopes":["openid","email","profile"]}]

# --- Ports --------------------------------------------------------------
# atom HTTP bind (cargo run)
LISTEN_ADDR=0.0.0.0:8080
# atom gRPC bind (cargo run)
GRPC_ADDR=0.0.0.0:8081
# atom HTTP (compose)
ATOM_HTTP_PORT=8080
# atom gRPC (compose)
ATOM_GRPC_PORT=8081
# postgres (compose)
POSTGRES_PORT=5432
# atom-dev HTTP (compose)
ATOM_DEV_HTTP_PORT=8081
# atom-dev gRPC (compose)
ATOM_DEV_GRPC_PORT=18081
# atom-ui Next.js (compose)
ATOM_UI_HTTP_PORT=3005

# --- Optional: Dockerized Next UI ---------------------------------------
# GraphQL endpoint the Dockerized UI calls (in-network default).
# ATOM_GRAPHQL_URL=http://atom:8080/graphql
# ATOM_UI_REGISTRATION_ENABLED=true
# ATOM_UI_FORWARD_CLIENT_IP_HEADERS=false