SCOPE/docs/env.institutional.example at main · fraware/SCOPE · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
# Institutional / production environment template for SCOPE
#
# Copy values into your secret store or shell profile. Do NOT commit real secrets.
# Full docs: docs/production_deployment.md, docs/institutional_guide.md
#
# Usage (bash):
#   set -a && source docs/env.institutional.example && set +a   # after editing
# Or export only the lines you need.

# --- Mode -------------------------------------------------------------------
# SCOPE_PRODUCTION_MODE=true

# --- IdP (required for production REST: JWKS *or* static PEM) ---------------
# SCOPE_OIDC_JWKS_URL=https://idp.example/.well-known/jwks.json
# SCOPE_OIDC_PUBLIC_KEY_PEM=/etc/scope/keys/idp_oidc.pub
# SCOPE_OIDC_ISSUER=https://idp.example/
# SCOPE_OIDC_AUDIENCE=scope-api
# SCOPE_OIDC_ENABLED=true

# --- Tenant + policy + artifacts --------------------------------------------
# SCOPE_TENANT_POLICY_MAP={"lab-a":{"policy_dir":"/etc/scope/policy"}}
# SCOPE_TENANT_AUTH_MAP=
# SCOPE_POLICY_DIR=/etc/scope/policy
# SCOPE_POLICY_BUNDLE_ROOT=
# SCOPE_ARTIFACT_STORE_ROOT=/var/scope/artifacts
# SCOPE_ENFORCE_RBAC=true

# --- Ledger (Postgres institutional default) --------------------------------
# SCOPE_LEDGER_BACKEND=postgres
# SCOPE_LEDGER_DATABASE_URL=postgresql://scope:REDACTED@db:5432/scope
# SCOPE_POSTGRES_URL=
# SCOPE_LEDGER_DELIVERY_MODE=fail_closed
# SCOPE_ALLOW_SQLITE_LEDGER_IN_PRODUCTION=   # leave unset in real production

# --- Issuer signing / verification ------------------------------------------
# SCOPE_ISSUER_SIGNING_KEY=/etc/scope/keys/issuer.pem
# SCOPE_ISSUER_PUBLIC_KEY=/etc/scope/keys/issuer.pub
# SCOPE_ISSUER_VERIFY_KEY=
# SCOPE_SIGNING_KEY=
# SCOPE_KMS_ENDPOINT=
# SCOPE_KMS_KEY_ID=

# --- Authorization manifest -------------------------------------------------
# SCOPE_AUTHORIZATION_MANIFEST_PATH=/etc/scope/authorization_manifest.json
# SCOPE_AUTHORIZATION_MANIFEST_PUBLIC_KEY=/etc/scope/policy_signer.pub
# Register the same public key in policy/policy_signing_key_registry.yaml

# --- Dev-only key generation (never production) -----------------------------
# python scripts/generate_dev_institutional_keys.py --out-dir .scope/dev-keys --exports

# --- Sibling checkouts (local live contracts) -------------------------------
# PF_CORE_REPO_PATH=/path/to/pf-core
# PCS_CORE_REPO_PATH=/path/to/pcs-core
# AKTA_REPO_PATH=/path/to/akta
# Or clone into ../siblings via:
#   bash scripts/clone_sibling_contracts.sh
#   .\scripts\clone_sibling_contracts.ps1

# --- GitHub Actions org/repo VARIABLES (not secrets) ------------------------
# Clone URLs (canonical names used by .github/workflows/ci.yml):
#   PF_CORE_REPO=https://github.com/org/pf-core.git
#   PCS_CORE_REPO=https://github.com/org/pcs-core.git
#   AKTA_REPO=https://github.com/org/akta.git
# Clearer aliases also accepted by CI / clone scripts:
#   PF_CORE_REPO_CLONE_URL=
#   PCS_CORE_REPO_CLONE_URL=
#   AKTA_REPO_CLONE_URL=
# Self-hosted pre-mounted paths (alternative to clone URLs):
#   PF_CORE_REPO_PATH=
#   PCS_CORE_REPO_PATH=
#   AKTA_REPO_PATH=
# Fail-closed live contracts:
#   SCOPE_REQUIRE_LIVE_CONTRACTS=true

# --- Institutional CI (local) -----------------------------------------------
# SCOPE_CI_PROFILE=institutional
# SCOPE_REQUIRE_LIVE_POSTGRES=true
# SCOPE_LEDGER_DATABASE_URL=postgresql://scope:scope@127.0.0.1:5432/scope
# bash scripts/ci.sh --institutional

# --- Optional / non-production ----------------------------------------------
# SCOPE_API_KEY=                 # legacy; disabled in production unless
# SCOPE_ALLOW_LEGACY_API_KEY=1
# SCOPE_ALLOW_DEV_IAL0=          # never in production
# SCOPE_QUEUE_DIR=.scope/queues
# SCOPE_REST_SERVICE_IDENTITY=scope-service
# SCOPE_TENANT_ID=default