# Diode Discovery Server Environment
# Rendered by Ansible from OpenBao secrets — do not edit manually.

# ─── Diode Redis (separate from NetBox Redis) ─────────────────────
REDIS_PASSWORD={{ secrets.diode_redis_password }}

# ─── NetBox connection ─────────────────────────────────────────────
NETBOX_DIODE_PLUGIN_API_BASE_URL=http://netbox:8080/api/plugins/diode
NETBOX_DIODE_PLUGIN_SKIP_TLS_VERIFY=true

# ─── Logging ───────────────────────────────────────────────────────
LOGGING_LEVEL=INFO
SENTRY_DSN=

# ─── Reconciler tuning ────────────────────────────────────────────
MIGRATION_ENABLED=true
RECONCILER_RATE_LIMITER_RPS=20
RECONCILER_RATE_LIMITER_BURST=1
DIODE_TO_NETBOX_RATE_LIMITER_RPS=20
DIODE_TO_NETBOX_RATE_LIMITER_BURST=1

# ─── PostgreSQL ───────────────────────────────────────────────────
DIODE_POSTGRES_HOST=postgres
DIODE_POSTGRES_PORT=5432
DIODE_POSTGRES_DB_NAME=diode
DIODE_POSTGRES_USER=diode
DIODE_POSTGRES_PASSWORD={{ secrets.diode_postgres_password }}

# ─── Telemetry ─────────────────────────────────────────────────────
TELEMETRY_ENVIRONMENT=dev
TELEMETRY_METRICS_EXPORTER=prometheus
TELEMETRY_TRACES_EXPORTER=none

# ─── Hydra (OAuth2 provider) ──────────────────────────────────────
HYDRA_POSTGRES_DB_NAME=hydra
HYDRA_POSTGRES_USER=hydra
HYDRA_POSTGRES_PASSWORD={{ secrets.hydra_postgres_password }}

HYDRA_STRATEGIES_ACCESS_TOKEN=jwt
HYDRA_STRATEGIES_REFRESH_TOKEN=jwt
HYDRA_STRATEGIES_JWT_SCOPE_CLAIM=both
HYDRA_TTL_ACCESS_TOKEN=1h
HYDRA_OIDC_SUBJECT_IDENTIFIERS_SUPPORTED_TYPES=public
HYDRA_URLS_SELF_ISSUER=http://hydra:4444

# ─── Auth ──────────────────────────────────────────────────────────
AUTH_HTTP_PORT=8080
OAUTH2_PUBLIC_SERVER_URL=http://hydra:4444
OAUTH2_ADMIN_SERVER_URL=http://hydra:4445
DIODE_AUTH_TOKEN_URL=http://diode-auth:8080/token

# ─── OAuth2 clients ───────────────────────────────────────────────
DIODE_TO_NETBOX_CLIENT_ID=diode-to-netbox
DIODE_TO_NETBOX_CLIENT_SECRET={{ secrets.diode_to_netbox_client_secret }}

NETBOX_TO_DIODE_CLIENT_ID=netbox-to-diode
NETBOX_TO_DIODE_CLIENT_SECRET={{ secrets.netbox_to_diode_client_secret }}

DIODE_INGEST_CLIENT_ID=diode-ingest
DIODE_INGEST_CLIENT_SECRET={{ secrets.diode_ingest_client_secret }}
