.env.example

# Copyright 2026 OpenSourceOM
# SPDX-License-Identifier: Apache-2.0
# OpenSourceOM environment configuration
# Copy to .env and fill in values before running docker compose up

# --- General ---
OM_ENV=development
OM_LOG_LEVEL=info
# Browser origin for OAuth callbacks and invite links. No trailing path.
OM_PUBLIC_URL=http://localhost:8080

# --- API ---
OM_API_PORT=8080
# om serve applies pending migrations before it listens. Set false to keep
# schema changes on an explicit `om migrate` (the Helm init container does that).
# OM_AUTO_MIGRATE=true

# Optional. When set, the setup form can only create this first admin.
# OM_ADMIN_EMAIL=

# Optional Google or GitHub sign-in. Register the callback
# {OM_PUBLIC_URL}/auth/google/callback or {OM_PUBLIC_URL}/auth/github/callback.
# A verified email must match an existing admin. Password login works without these.
# OM_GOOGLE_CLIENT_ID=
# OM_GOOGLE_CLIENT_SECRET=
# OM_GITHUB_CLIENT_ID=
# OM_GITHUB_CLIENT_SECRET=

# Optional. When set, adding an admin also emails the temporary password.
# OM_SMTP_HOST=
# OM_SMTP_PORT=587
# OM_SMTP_USERNAME=
# OM_SMTP_PASSWORD=
# OM_SMTP_FROM=admins@example.com

# --- Graph store (placeholder) ---
OM_GRAPH_BACKEND=postgres
POSTGRES_USER=opensourceom
POSTGRES_PASSWORD=opensourceom
POSTGRES_DB=opensourceom
POSTGRES_HOST=postgres
POSTGRES_PORT=5432

# --- Collectors ---
# AWS (read-only role recommended)
AWS_REGION=us-east-1
# AWS_ACCESS_KEY_ID=
# AWS_SECRET_ACCESS_KEY=

# Azure (DefaultAzureCredential: az login, managed identity, or env vars)
# AZURE_SUBSCRIPTION_ID=
AZURE_LOCATION=eastus
# AZURE_TENANT_ID=
# AZURE_CLIENT_ID=
# AZURE_CLIENT_SECRET=

# GCP (Application Default Credentials)
# GCP_PROJECT_ID=
GCP_REGION=us-central1
# GOOGLE_APPLICATION_CREDENTIALS=/path/to/service-account.json

# --- Enrichment ---
# Optional NVD API key for higher rate limits.
# NVD matches CPE 2.3 names on workload packages.
# NVD_API_KEY=
# JSON catalog used instead of NVD. Matches package URLs and image refs too.
# OM_CVE_CATALOG=examples/cve-catalog.json

# --- Kubernetes ---
K8S_CLUSTER=default
# K8S_NAMESPACE=

# --- Exports ---
# SLACK_WEBHOOK_URL=
# JIRA_URL=
# JIRA_EMAIL=
# JIRA_API_TOKEN=
# JIRA_PROJECT=SEC

# --- Optional integrations ---
# SLACK_WEBHOOK_URL=
# JIRA_URL=