example.env

SIGNING_SECRET=<SLACK Bot signing Secret>
BOT_TOKEN=<Slack Bot Token>
APP_TOKEN=<Slack Bot App Token>
SERVER_PORT=5000
TAILSCALE_AUTH_KEY=<Tailscale Auth Key>
PROVISIONER_API_TOKEN=<API Token generated from the Provisioner>
PROVISIONER_URL=https://example.com
GUACAMOLE_CONNECTION_URL=<URL for guacamole connections>
APP_ENVIRONMENT=<nonprod | prod>

# Optional. Oldest GlueOps/codespaces image release whose baked dev() reads
# /etc/glueops/tunnel_endpoint. Unset = regional tunnel endpoints disabled:
# every CDE VM uses the legacy central tunnel regardless of region config.
# Set this (e.g. v0.155.0) when enabling per-region tunnel_endpoint values in
# the provisioner's BAREMETAL_SERVER_CONFIGS; VMs created from older images
# still fall back to the central tunnel so their access URLs stay correct.
# Prerelease tags (vX.Y.Z-RC1) are supported on both sides: a stable release
# outranks its own RCs, so min=v0.155.0-RC1 admits the RCs and the stable cut.
REGIONAL_TUNNEL_MIN_IMAGE_TAG=<codespaces release tag, e.g. v0.155.0 or v0.155.0-RC1>

# VM profiles store (required). The app fails to start if any of these are missing.
# Must be a full URL including the scheme (https://). A bare host is rejected at startup.
PROFILES_S3_ENDPOINT=https://s3.us-east-1.amazonaws.com
PROFILES_S3_BUCKET=<bucket name>
PROFILES_S3_REGION=<bucket region, e.g. us-east-1>
PROFILES_S3_ACCESS_KEY_ID=<access key id>
PROFILES_S3_SECRET_ACCESS_KEY=<secret access key>
# optional, defaults to profiles/
PROFILES_S3_PREFIX=profiles/
# optional, per-S3-call timeout in ms (default 5000)
PROFILES_S3_TIMEOUT_MS=5000
# Encrypts the whole profile store at rest in S3 (AES-256-GCM): names, keys, and values.
# 32 bytes as 64 hex chars. Generate with:  openssl rand -hex 32
PROFILES_ENCRYPTION_KEY=<64 hex chars>