# ============================================================================
# SiCABE Control Panel — konfigurasi env (salin ke .env lalu sesuaikan)
#
# SEMUA URL service dapat di-override dari environment. Nilai default di bawah
# memakai nama service dalam network compose (sicabe-doc/deploy, `name: sicabe`).
# Bila panel dijalankan DI HOST, pakai port host (12xxx) seperti kolom "host".
#
# Konvensi:
#   * var tanpa prefix  -> dibaca sisi SERVER (fetch/API, rahasia aman)
#   * *_WEB_URL dll     -> tautan/UI client; di-fetch dari /api/platform/endpoints
#   * .env TIDAK di-commit; contoh ini ikut di-track (!.env.example)
# ============================================================================

# ── Trino ────────────────────────────────────────────────────────────────────
# Endpoint SQL/API (route /api/trino & /api/query). HTTPS saja: Trino memakai
# auth hybrid OAuth2 + Basic dengan allow-insecure-over-http=false (HTTP polos
# tidak melayani apa pun). Login dev pun memakai Bearer, didapat via Keycloak
# ROPC di CredentialsProvider.
#   SSO & dev (Bearer/JWT) : HTTPS → https://localhost:12443
#   dalam compose          : http://trino:8080
TRINO_URL=https://localhost:12443
# CA utk Trino HTTPS self-signed. Pin sertifikat server (PEM) di sini.
# Bisa juga per-host lewat `caPem` di SICABE_HOSTS (lebih diutamakan).
TRINO_CA_FILE=.ca/trino.crt
# Nama host (entri SICABE_HOSTS) yang menjalankan Trino — untuk memilih CA per-host.
#SICABE_TRINO_HOST=host-prod-1
# Trino Web UI.
#TRINO_WEB_URL=https://localhost:12443

# ── Keycloak ─────────────────────────────────────────────────────────────────
# Base URL + realm utk OIDC (login panel & refresh token).
#   dalam compose : http://keycloak:8080
#   host          : http://localhost:12080
KEYCLOAK_URL=http://keycloak:8080
KEYCLOAK_REALM=sicabe
# Client OIDC panel (harus ada di realm tsb).
KEYCLOAK_CLIENT_ID=sicabe-control-panel
# Secret client. WAJIB di-production (tanpa nilai -> fail saat login).
#KEYCLOAK_CLIENT_SECRET=
# Admin Console Keycloak (tautan dashboard utk admin).
#KEYCLOAK_WEB_URL=http://localhost:12080

# ── Iceberg table explorer backend (Nessie) ──────────────────────────────────
# Halaman /tables memakai catalog Iceberg REST Nessie.
# base ops = {NESSIE_URL}/iceberg/v1/{NESSIE_BRANCH}.
#   dalam compose : http://nessie:19120
#   host          : http://localhost:12120
#NESSIE_URL=http://nessie:19120
#NESSIE_BRANCH=main

# ── Dremio (REST v3 — sources & SQL) ────────────────────────────────────────
# Endpoint REST Dremio OSS + kredensial lokal (login /apiv2 -> token _dremio).
#   dalam compose : http://dremio:9047
#   host          : http://localhost:12947
DREMIO_URL=http://dremio:9047
DREMIO_USER=
DREMIO_PASSWORD=

# ── MinIO ────────────────────────────────────────────────────────────────────
# MinIO Console (tautan dashboard & sidebar).
#   host          : http://localhost:12901
#MINIO_CONSOLE_URL=http://localhost:12901

# ── StarRocks ────────────────────────────────────────────────────────────────
# FE MySQL protocol (route /api/starrocks).
#   dalam compose : STARROCKS_HOST=starrocks-fe, PORT=9030
#   host          : STARROCKS_HOST=localhost, PORT=12930
STARROCKS_HOST=localhost
STARROCKS_PORT=12930
STARROCKS_USER=root
#STARROCKS_PASSWORD=
# StarRocks UI HTTP (tautan halaman StarRocks).
#STARROCKS_WEB_URL=http://localhost:12030

# ── Apache Airflow ───────────────────────────────────────────────────────────
# Base URL — dipakai utk REST API (lib/airflow) DAN tautan UI (sidebar/dashboard).
#   dalam compose : http://airflow-webserver:8080
#   host          : http://localhost:12082
AIRFLOW_URL=http://localhost:12082
AIRFLOW_USER=admin

# ── OpenMetadata & Grafana (governance) ──────────────────────────────────────
# URL API/UI — single source (halaman governance + tautan).
#   host          : OpenMetadata http://localhost:12085, Grafana http://localhost:12300
OPENMETADATA_URL=http://localhost:12085
GRAFANA_URL=http://localhost:12300

# ── Auth (NextAuth) ──────────────────────────────────────────────────────────
NEXTAUTH_URL=http://localhost:3000
# WAJIB di-production.
# ── Login lokal (hybrid dengan SSO) ──────────────────────────────────────────
# Akun admin LOKAL dari env — bisa login tanpa browser SSO, berlaku juga di
# produksi. Password = BCRYPT HASH (bukan plaintext).
#   Buat hash:  node -e "console.log(require('bcryptjs').hashSync('PASSWORD',10))"
# Untuk Docker/Compose pakai varian _B64 (bcrypt memuat '$' yang bisa di-
# interpolasi Compose):
#   node -e "console.log(Buffer.from(require('bcryptjs').hashSync('PASSWORD',10)).toString('base64'))"
#PANEL_LOCAL_USER=admin
#PANEL_LOCAL_PASSWORD_HASH=$2b$10$...
#PANEL_LOCAL_PASSWORD_HASH_B64=JDJiJDEwJC4uLg==
#PANEL_LOCAL_ROLE=data-admin
# Identitas Trino untuk sesi login lokal (tanpa JWT Keycloak): service account.
# Password dibaca dari .env platform via config-agent → TRINO_SVC_<ACC>_PASSWORD.
#TRINO_SERVICE_ACCOUNT=svc_dbt
#NEXTAUTH_SECRET=

# ── Multi-host Docker control ────────────────────────────────────────────────
# Registry host Docker yang dikelola panel (via docker-socket-proxy per host).
# Nilai JSON array. Bila kosong → default single host http://127.0.0.1:2375
# (kompatibel perilaku lama).
#   Field per host: name (unik), proxyUrl, apiKey (opsional), enabled,
#   sshTunnel (opsional: {host, port, user}).
#   Multi-host (opsional, untuk Tahap 2): configUrl/configApiKey menunjuk ke
#   `sicabe-config-agent` host tsb; caPem = CA TLS host (PEM) bila perlu.
#   ⚠️ apiKey/configApiKey adalah SECRET — jangan di-commit; isi via env/deploy.
#   Development lokal (single host, tanpa proxy):
#     SICABE_HOSTS='[{"name":"local","proxyUrl":"unix:///var/run/docker.sock","enabled":true}]'
#SICABE_HOSTS='[{"name":"host-prod-1","proxyUrl":"http://127.0.0.1:22375","apiKey":"","configUrl":"http://127.0.0.1:22375","configApiKey":"","enabled":true}]'
# Config panel yang PERSISTEN (hosts/modules/services), diedit dari UI Settings.
# Bila file ini ada, ia MENGGANTIKAN SICABE_HOSTS di atas (env = seed saja).
# Memuat api key → gitignored, perms 0600.
#SICABE_CONFIG_FILE=data/config.json
# Lokasi file state (monitored toggle per container). Default data/state.json.
# Key = `${host}/${container}` (kompatibel dgn key lama `${container}`).
#SICABE_STATE_FILE=data/state.json
# Daftar project Docker Compose yang dimonitor (label com.docker.compose.project).
# Comma-separated; default "sicabe".
#SICABE_COMPOSE_PROJECTS=sicabe
# Override host per-service (opsional). Bila kosong, host di-resolve otomatis
# dari daftar host/komponen (dipakai untuk membaca kredensial dari host yang tepat).
#SICABE_AIRFLOW_HOST=host-prod-1
#SICABE_STARROCKS_HOST=host-prod-1
# Host yang menjalankan OPA (menu Authorization; baca/tulis config/opa/data.json).
#SICABE_OPA_HOST=host-prod-1

# ── Lain-lain ────────────────────────────────────────────────────────────────
# Direktori catalog Trino & file .env platform (bila dijalankan non-standar).
# .env platform dibaca READ-ONLY oleh panel (tidak pernah ditimpa).
#TRINO_CATALOG_DIR=deploy/config/trino/catalog
#SICABE_ENV_FILE=deploy/.env
# Dokumen data OPA (ACL authz Trino) — dibaca menu Authorization lewat ConfigStore.
#OPA_DATA_FILE=/path/ke/sicabe-doc/deploy/config/opa/data.json
# Project dbt SiCABE (dibaca /api/dbt untuk models, sources, lineage DAG).
# Panel di host: arahkan ke folder platform (mis. sicabe-doc/deploy/config/airflow/dbt/sicabe).
#DBT_PROJECT_DIR=/path/ke/sicabe-doc/deploy/config/airflow/dbt/sicabe
# Password admin Airflow dibaca dari SICABE_ENV_FILE (AIRFLOW_ADMIN_PASSWORD).