# asset-engine stack tunables. Copy to `.env` on ana-docker before deploying.
#
# The deploy playbook seeds `.env` from this template on first run only —
# it won't clobber an existing `.env`.

# Image tag. Built locally from the asset-engine git repo by the playbook.
ASSET_ENGINE_IMAGE=asset-engine:local

# Host port exposing the FastAPI app (container listens on 8000 internally).
# Internal tooling, LAN-only — this port is the only entry point. No Traefik.
ASSET_ENGINE_PORT=8200

# Bind address for the host port. 0.0.0.0 = LAN-reachable.
ASSET_ENGINE_BIND=0.0.0.0

# Host paths for state. Container runs as uid 1000 — paths must be writable
# by that uid (mkdir'd by the playbook without sudo, so lkraven-owned when
# lkraven is uid 1000 on the host).
#
# DB lives separately from outputs so we can grow outputs/ onto a different
# volume later without restoring DB state on top of it.
ASSET_ENGINE_DB_DIR=/opt/docker/conf/asset-engine/db
ASSET_ENGINE_OUTPUTS_DIR=/opt/docker/conf/asset-engine/outputs

# SSH key dir for orchestrating irv-ml1 services (bring up / down via SSH +
# docker compose). Holds id_ed25519 (mode 600) + known_hosts (mode 644)
# pre-populated with irv-ml1's pinned ed25519 fingerprint. Generated on the
# host directly so the private key never crosses the network. Bind-mounted
# read-only into the container at /app/runtime/ssh.
ASSET_ENGINE_SSH_DIR=/opt/docker/conf/asset-engine/ssh

# Inference target. Default is irv-ml1 over WG. Override if the fleet's
# inference host moves.
INFERENCE_HOST=10.100.79.3

# OIDC seam — empty in v1 (auth is no-op). Populate when v2 forward-auth
# lands. Pre-allocated here so the surface is visible in the config file
# before code reads it.
OIDC_ISSUER=
OIDC_CLIENT_ID=
OIDC_CLIENT_SECRET=