# =============================================================================
# Env untuk stack sicabe-host (satu file untuk SEMUA host).
# Salin ke .env lalu isi nilainya:  cp env.example .env
#
# Dipakai oleh: docker-socket-proxy + config-agent + gateway (semua host),
# dan control-panel (hanya host panel / profile "panel").
# =============================================================================

# ── Image dari registry (WAJIB) ──────────────────────────────────────────────
# Hasil: ./scripts/build-image.sh --all --push --registry <registry>
# Kosongkan SICABE_REGISTRY bila memakai image lokal (mis. saat uji).
#SICABE_REGISTRY=registry.example.com/sicabe
SICABE_TAG=latest

# ── Gateway (WAJIB, semua host) ──────────────────────────────────────────────
# Satu API key untuk docker-proxy + config-agent (diperiksa nginx).
GATEWAY_API_KEY=
# Bind ke 127.0.0.1 (default, aman) atau IP internal. JANGAN ke internet.
GATEWAY_BIND_IP=127.0.0.1
GATEWAY_PORT=22375

# ── Config-agent (WAJIB, semua host) ─────────────────────────────────────────
# Direktori deploy sicabe-doc di host ini (berisi .env, config/trino/catalog, ...).
SICABE_DEPLOY_DIR=/path/ke/sicabe-doc/deploy
# UID/GID host yang menulis file (katalog/OPA) — agar tidak root-owned.
AGENT_UID=1000
AGENT_GID=1000
# CA TLS Trino — WAJIB di host panel agar panel memverifikasi sertifikat Trino
# (self-signed). Isi direktori yang memuat PEM-nya (dihasilkan
# ./scripts/export-trino-ca.sh → <panel>/.ca/trino.crt).
# Di host NON-panel boleh dikosongkan (panel-lah yang butuh CA).
AGENT_CA_HOST_PATH=/path/ke/sicabe-control-panel/.ca
AGENT_CA_FILE=/ca/trino.crt

# =============================================================================
# Di bawah ini HANYA untuk host panel (profile "panel").
# Boleh dibiarkan kosong di host non-panel (compose tetap valid).
# =============================================================================

# ── Panel: wajib ─────────────────────────────────────────────────────────────
# URL publik panel (harus sama dengan yang diakses browser & redirect URI Keycloak).
PANEL_URL=http://localhost:3000
PANEL_PORT=3000
# openssl rand -base64 32
NEXTAUTH_SECRET=

# ── Login lokal (hybrid dengan SSO) — OPSIONAL ───────────────────────────────
# Akun lokal tanpa Keycloak; password = bcrypt hash. Pakai varian _B64 di sini
# karena Compose meng-interpolasi '$' (bcrypt selalu memuat '$').
#   node -e "console.log(Buffer.from(require('bcryptjs').hashSync('PASSWORD',10)).toString('base64'))"
#PANEL_LOCAL_USER=admin
#PANEL_LOCAL_PASSWORD_HASH_B64=
#PANEL_LOCAL_ROLE=data-admin
# Identitas Trino utk sesi lokal (tanpa JWT) — service account (Basic).
#TRINO_SERVICE_ACCOUNT=svc_dbt
# Client Keycloak panel (scripts/create-keycloak-client.sh).
KEYCLOAK_CLIENT_SECRET=dev-keycloak-secret
# Host/agent yang dikelola panel. WAJIB ada `configUrl` (config-agent).
# Di host panel (network host) gateway lokal = 127.0.0.1:${GATEWAY_PORT}.
# Format JSON tanpa kutip pembungkus (hindari masalah parsing .env).
SICABE_HOSTS=[{"name":"local-gw","proxyUrl":"http://127.0.0.1:22375","apiKey":"CHANGE_ME","configUrl":"http://127.0.0.1:22375","configApiKey":"CHANGE_ME","publicHost":"localhost","enabled":true}]

# ── Panel: opsional (ada default di kode) ────────────────────────────────────
KEYCLOAK_URL=http://127.0.0.1:12080
KEYCLOAK_CLIENT_ID=sicabe-control-panel
KEYCLOAK_WEB_URL=http://localhost:12080
TRINO_URL=https://localhost:12443
TRINO_WEB_URL=https://localhost:12443
NESSIE_URL=http://127.0.0.1:12120
AIRFLOW_URL=http://127.0.0.1:12082
STARROCKS_HOST=127.0.0.1
STARROCKS_PORT=12930
STARROCKS_WEB_URL=http://localhost:12030
OPENMETADATA_URL=http://127.0.0.1:12085
GRAFANA_URL=http://127.0.0.1:12300
MINIO_CONSOLE_URL=http://localhost:12901
SICABE_COMPOSE_PROJECTS=sicabe