bootstrap.env.example

# =============================================================================
# NotiOps — bootstrap variables (template)
# =============================================================================
# ⚠️ LEGACY FILE — 此文件属于原 notiops-devops SAM 部署流程(deploy.sh)。
# 融合系统已改用 CDK,部署入口为 setup.sh(交互式引导配置 region、Secret 等),
# 不再依赖本文件中的变量。保留仅供历史参考。
# =============================================================================
#
# [原说明] Copy this file to `bootstrap.env` and fill in the values for your
# account. All deploy commands in docs/DEPLOYMENT.md `source` this file so you
# only enter each value once.
#
#   cp bootstrap.env.example bootstrap.env
#   $EDITOR bootstrap.env
#   source bootstrap.env
#   ./deploy.sh          ← DEPRECATED,改用 ./setup.sh
#
# `bootstrap.env` is in .gitignore — never commit it (it carries secret ARNs).
# =============================================================================

# --- AWS account / region ----------------------------------------------------
export AWS_ACCOUNT_ID="123456789012"

# Region where the bot ECS tasks + report-handler Lambda run. See
# docs/DEPLOYMENT.md §2.3 "Region selection". Most installs use
# us-east-1 (DevOps Agent service is us-east-1 only today, so co-
# locating Lambda with it avoids cross-region calls).
export AWS_REGION="us-east-1"

# Region where the AWS DevOps Agent service runs. Today the service is
# us-east-1 only — override only if AWS later regionalizes it. Used in
# the IAM Resource ARN for `aidevops:ListJournalRecords` /
# `aidevops:GetJournalRecord`.
export DEVOPS_AGENT_REGION="us-east-1"

# --- VPC / networking (Fargate task placement) -------------------------------
# Any VPC + ≥2 public subnets across 2 AZs. Tasks need outbound internet
# (Feishu / Slack APIs, Bedrock, ECR pulls).
export VPC_ID="vpc-xxxxxxxx"
export PUBLIC_SUBNETS="subnet-aaa,subnet-bbb"

# --- DevOps Agent ------------------------------------------------------------
# In the DevOps Agent console: Space → Settings → register a generic webhook
# and copy these three values.
export AGENT_SPACE_ID="xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx"
export WEBHOOK_URL="https://event-ai.us-east-1.api.aws/webhook/generic/<uuid>"
export WEBHOOK_SECRET="<paste raw HMAC secret here, do NOT include the ARN>"

# --- Feishu (skip this section if you only deploy Slack) ---------------------
export FEISHU_APP_ID="cli_xxxxxxxxxxxxxxxx"
export FEISHU_APP_SECRET="xxxxxxxxxxxxxxxxxxxxxxxxxxxxxx"
# Group chat that receives push events (CloudWatch alarms / Health / Backup).
# Get it via: GET https://open.feishu.cn/open-apis/im/v1/chats with
# tenant_access_token. Leave empty to disable push delivery for Feishu.
export FEISHU_TARGET_CHAT_ID="oc_xxxxxxxxxxxxxxx"

# --- Slack (skip this section if you only deploy Feishu) ---------------------
export SLACK_BOT_TOKEN="xoxb-xxxxxxxxxxxxxx"
export SLACK_APP_TOKEN="xapp-1-xxxxxxxxxxxxxx"
# Channel that receives push events. Get the ID from channel settings panel.
# Leave empty to disable push delivery for Slack.
export SLACK_TARGET_CHANNEL_ID="C0XXXXXXXXX"

# --- DingTalk (Phase 1: chitchat + investigate; Phase 2a: report writeback) --
# DingTalk needs TWO robot configurations because the platform splits
# inbound and outbound across two robot classes:
#
#  1. H5-app Stream-Mode robot — handles INBOUND @-mentions / DMs.
#     In open-dev.dingtalk.com → 应用开发 → 钉钉应用 → create an
#     Internal H5 app → enable 机器人 capability → Stream Mode.
#     Copy AppKey + AppSecret from Credentials & Basic Info.
export DINGTALK_APP_KEY="dingxxxxxxxxxxxxxxxx"
export DINGTALK_APP_SECRET="xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx"
#
#  2. Custom robot (自定义机器人) — handles OUTBOUND report writebacks
#     and push notifications from the report-handler Lambda. In each
#     target group: 群设置 → 群机器人 → 添加机器人 → 自定义 → copy
#     the resulting Webhook URL and (recommended) the 加签 secret.
#     Optional. Leave PUSH_WEBHOOK_URL empty if you don't need
#     report writebacks / push events delivered to DingTalk.
export DINGTALK_PUSH_WEBHOOK_URL=""
export DINGTALK_PUSH_WEBHOOK_SECRET=""

# --- Optional overrides (have sensible defaults — only set if you need to) ---
# export BEDROCK_MODEL_ID="us.anthropic.claude-sonnet-4-6"   # default Sonnet 4.6
# export AGENTIC_CHAT_MODE="enabled"                         # disabled / qa_only / enabled
# export AWS_MCP_MODE="docs_only"                            # disabled / docs_only
# export ENABLE_MCP_PRICING="true"                           # AWS Pricing MCP sidecar
# export DEFAULT_LOCALE="en"                                 # zh / en — fallback locale
# export DEFAULT_LLM_PROVIDER="claude"                       # claude / nova / gpt — default model alias

# --- GPT-5.x (Bedrock Mantle Responses) ---
# Only consulted when DefaultLlmProvider=gpt or any chat switches to gpt.
# Mantle endpoint is not in us-east-1, so a cross-region call is made.
# export GPT_REGION="us-east-2"                              # us-east-2 / us-west-2 / us-gov-west-1
# export GPT_REASONING_EFFORT="medium"                       # low / medium / high (latency cost)
# export GPT_TEXT_VERBOSITY="low"                            # low / medium / high

# --- Filled-in Secrets Manager ARNs (filled by deploy.sh after first run) ----
# Once `deploy.sh` creates the Secrets Manager entries it will print these
# ARNs and ask you to paste them back into bootstrap.env so subsequent runs
# can re-use them. Leave empty on first deploy.
export WEBHOOK_SECRET_ARN=""
export FEISHU_APP_ID_SECRET_ARN=""
export FEISHU_APP_SECRET_SECRET_ARN=""
export SLACK_BOT_TOKEN_SECRET_ARN=""
export SLACK_APP_TOKEN_SECRET_ARN=""
export DINGTALK_APP_KEY_SECRET_ARN=""
export DINGTALK_APP_SECRET_SECRET_ARN=""
export DINGTALK_PUSH_WEBHOOK_SECRET_ARN=""