.env.example

# LearnStack Hub — local dev environment variables for backend + compose.
#
# This file is the single source of truth for **backend + compose** env vars
# (Hub API process env, Dapr sidecar env, APISIX gateway env, Vault / Kafka /
# Postgres connection bootstrap). Next.js applications under `frontend/apps/*`
# read their own `.env.local` from the app directory (Next reads `.env.local`
# relative to the app, not the repo root); each per-app file mirrors the
# backend-facing values it needs plus its own client-bound vars
# (`NEXT_PUBLIC_*`, BFF session cookie name, etc.). See
# `frontend/apps/operator-portal/.env.local.example` for the operator portal's
# own file.
#
# Copy to `.env` at the repo root (NOT committed — `.gitignore` covers it).
# `infra/compose/dev.yml` reads this via `${VAR:-default}` interpolation at
# parse time. Every value has a dev-safe fallback so the stack still boots
# even without `.env`.
#
# DEV WORKFLOW (P02c-0): Hub repo does NOT run its own Postgres / Valkey /
# Vault / Kafka / Keycloak / Mailpit. Those services live in the sibling
# `learnstack` repo's compose stack. Start `learnstack` compose FIRST, then
# this one. The Hub services connect to LearnStack's via host.docker.internal.
#
# Every value below is **dev-only**. Production wires real values through
# `ISecretProvider` against an authenticated Vault cluster.

# ─── Postgres (shared with LearnStack core; Hub uses a SEPARATE database) ─
POSTGRES_HOST=host.docker.internal
POSTGRES_PORT=5432
POSTGRES_USER=learnstack
POSTGRES_PASSWORD=learnstack
# Hub uses its own database within the shared Postgres instance.
# `infra/postgres/init/01-create-hub-database.sql` provisions it on first boot.
HUB_POSTGRES_DB=learnstack_hub

# ─── Keycloak (shared LearnStack instance; learnstack-hub realm) ──────────
# The realm itself is exported in learnstack/infra/keycloak/realms/learnstack-hub.json
# and loaded by LearnStack's Keycloak service at first boot.
KEYCLOAK_HOST=host.docker.internal
KEYCLOAK_PORT=8080
KEYCLOAK_HUB_REALM=learnstack-hub
KEYCLOAK_HUB_WEB_CLIENT_ID=learnstack-hub-web

# ─── Vault (shared instance; Hub uses learnstack-hub/* namespace) ─────────
# Boot value matches learnstack/.env.example so the same Vault instance is
# reachable from both compose stacks.
VAULT_HOST=host.docker.internal
VAULT_PORT=8200
VAULT_ROOT_TOKEN=learnstack-dev-root-token
# Hub-specific Vault secret namespace. Cert material (P02c-5),
# mTLS client cert (P02c-2 + P02c-3 chain), HMAC body-signature shared secret
# all live under this prefix.
VAULT_HUB_PATH_PREFIX=learnstack-hub

# ─── Kafka (shared cluster; Hub publishes learnstack.hub.* topics) ────────
KAFKA_HOST=host.docker.internal
KAFKA_PORT=9092

# ─── Hub APISIX (Hub's own gateway instance — DIFFERENT port from LearnStack APISIX) ─
# LearnStack APISIX uses 9080/9443/9091. Hub uses 9180/9543/9191 so both can
# run concurrently on the same workstation.
HUB_APISIX_HTTP_PORT=9180
HUB_APISIX_HTTPS_PORT=9543
HUB_APISIX_PROMETHEUS_PORT=9191

# ─── Hub Dapr sidecar (separate from LearnStack core's sidecar) ───────────
# LearnStack Dapr placement is 50005, sidecar HTTP 3500 / gRPC 50001.
# Hub Dapr placement is 50006, sidecar HTTP 3501 / gRPC 50002.
HUB_DAPR_PLACEMENT_PORT=50006
HUB_DAPR_SIDECAR_HTTP_PORT=3501
HUB_DAPR_SIDECAR_GRPC_PORT=50002

# ─── Hub API host (LearnStack.Hub.Api, runs on workstation via `dotnet run`) ─
ASPNETCORE_ENVIRONMENT=Development
# The composition root reads DeploymentMode exactly once and fails closed:
# it may be omitted only when ASPNETCORE_ENVIRONMENT=Development, and an
# unrecognised value is rejected rather than coerced. Values (ADR-0020):
# Development | SaaS | Dedicated | SelfHostedOnline | SelfHostedAirGapped.
Hub__DeploymentMode=Development
# Different from LearnStack.Api's 5080 so both can run side-by-side.
#
# Bind to 0.0.0.0 (not localhost / 127.0.0.1) so containers can reach the
# host process through `host.docker.internal:5181`. On Docker Desktop
# (macOS / Windows) a localhost-bound Kestrel happens to be reachable via
# host-gateway routing; on Linux it is NOT — the daemon's host-gateway
# mapping points at the host's loopback interface, and a Kestrel listening
# only on 127.0.0.1 will refuse the connection. Both Hub APISIX upstream
# and Hub Dapr `-app-channel-address host.docker.internal` rely on this
# being reachable from inside containers.
ASPNETCORE_URLS=http://0.0.0.0:5181

# ─── LearnStack core API URL (for outbound calls in P02c-2+) ──────────────
# Hub's LearnStackApiClient calls these endpoints with mTLS + signed JWT +
# HMAC body signature. In dev the cert + signature chain is stubbed; P02c-2
# wires the real chain.
LEARNSTACK_CORE_API_URL=http://host.docker.internal:5080
LEARNSTACK_CORE_INTERNAL_PATH_PREFIX=/api/internal

# ─── Hub HMAC body-signature shared secret (Vault path in production) ─────
# The shared secret both halves of the contract surface
# (Hub → LearnStack and LearnStack → Hub) use to sign `X-Signature`
# bodies per ADR-0019 § Inter-system contracts.
#
# Authoritative production Vault path:
#   ADR-0019 § Inter-system contracts names the LearnStack-side path:
#     learnstack/hub/internal-api-hmac-key
#   (See ../LearnStack/docs/decisions/0019-learnstack-hub.md.)
#
#   The Hub-side path that pulls the SAME secret has not been formalised
#   yet — ADR-0019 covers the cross-repo contract but stops short of
#   pinning the Hub-internal Vault layout. P02c-2 (Hub-side internal API
#   + outbound LearnStackApiClient) is the natural moment to land an ADR
#   amendment / Standards 20 extension that defines both halves
#   symmetrically. Until then the production Hub-side path is
#   intentionally undefined here — do NOT invent one in passing.
#
# Dev value below is dev-only; ≥32 bytes for HMAC-SHA256 plus an obvious
# placeholder shape so Leakwatch entropy threshold passes.
HUB_INTERNAL_API_HMAC_KEY=hub-dev-hmac-shared-secret-min-32-bytes-padding

# ─── Operator portal (Next.js operator-portal app, runs on workstation) ───
# Port 3100 matches the redirect URI declared in
# learnstack/infra/keycloak/realms/learnstack-hub.json.
HUB_OPERATOR_PORTAL_PORT=3100