.env.example

# Database
DATABASE_URL=postgresql://offgrid@localhost:5432/offgrid_console

# Auth.js — generate with: openssl rand -base64 33
AUTH_SECRET=

# Google SSO — https://console.cloud.google.com → Credentials → OAuth client (Web)
#   Authorized redirect URI: http://localhost:3000/api/auth/callback/google
AUTH_GOOGLE_ID=
AUTH_GOOGLE_SECRET=

# Microsoft Entra ID SSO — https://entra.microsoft.com → App registrations
#   Redirect URI: http://localhost:3000/api/auth/callback/microsoft-entra-id
AUTH_MICROSOFT_ENTRA_ID_ID=
AUTH_MICROSOFT_ENTRA_ID_SECRET=
AUTH_MICROSOFT_ENTRA_ID_ISSUER=https://login.microsoftonline.com/<tenant-id>/v2.0

# Keycloak SSO (self-hosted IAM, the identity OSS swap-in) — `make identity` brings it up on :8080
# and auto-imports deploy/keycloak/offgrid-realm.json (realm + client + a test user). These dev
# values work out of the box; the realm survives `make down` (re-imported on boot). For production,
# create a real realm/client and replace the secret. Test login: advisor / advisor-pw.
AUTH_KEYCLOAK_ID=offgrid-console
AUTH_KEYCLOAK_SECRET=offgrid-dev-keycloak-secret
AUTH_KEYCLOAK_ISSUER=http://localhost:8080/realms/offgrid

# Off Grid Gateway — the OpenAI-compatible LLM cluster router.
# Local dev: leave unset or point at a local gateway instance (:7878 is the desktop gateway).
# On-prem fleet: set to the cluster gateway address (e.g. http://127.0.0.1:8800).
OFFGRID_GATEWAY_URL=

# Keycloak admin API — used by the Access module to manage users and machine clients.
# On-prem: set these to match your Keycloak deployment.
OFFGRID_KEYCLOAK_URL=http://localhost:8080
OFFGRID_KEYCLOAK_REALM=offgrid
OFFGRID_KEYCLOAK_CLIENT_ID=offgrid-console
OFFGRID_KEYCLOAK_CLIENT_SECRET=offgrid-dev-keycloak-secret

# Provit — the visual-QA product, surfaced in the console as a first-class module.
# Defaults to the hosted subdomain; override to point at a self-hosted Provit.
OFFGRID_PROVIT_URL=https://provit.getoffgridai.co

# Modules enabled for this deployment (comma-separated). Empty = all.
NEXT_PUBLIC_OFFGRID_MODULES=

# ── Durable agent runs (Temporal) ───────────────────────────────────────────────────────────
# Agent runs default to SYNCHRONOUS in-process execution. Opt into DURABLE execution (retryable,
# resumable, survives a crash) by enabling the queue AND running the worker (npm run worker:agents).
# When Temporal is unreachable the console gracefully falls back to the synchronous path.
#   Enable durable dispatch (either flag opts in):
OFFGRID_QUEUE_ENABLED=
#   Or select the runtime adapter explicitly: OFFGRID_ADAPTER_AGENTRUNTIME=temporal
OFFGRID_ADAPTER_AGENTRUNTIME=
#   Temporal cluster (gRPC frontend). Default: offgrid-s1.local:7233
OFFGRID_TEMPORAL_ADDRESS=offgrid-s1.local:7233
OFFGRID_TEMPORAL_NAMESPACE=default
OFFGRID_AGENT_TASK_QUEUE=offgrid-agents
#   Max Temporal retry attempts for the pipeline activity (default 3).
OFFGRID_AGENT_MAX_ATTEMPTS=3
#   How long the POST /runs request awaits the durable result before returning 202+running (ms).
OFFGRID_AGENT_AWAIT_MS=25000
#   Worker-side: concurrent agent pipelines a single worker drains (backpressure cap, default 2).
OFFGRID_AGENT_MAX_CONCURRENT=2

# ── Read-only public demo (viewer role) ─────────────────────────────────────────────────────
# When a user signs in with the `viewer` role, the console runs in read-only demo mode: they can
# VIEW every module and admin surface but cannot create, update, delete, or trigger anything, and
# never see a secret value. Enforcement is server-side (edge middleware + the authz gates) — the
# UI gating is only an affordance on top. Set these to surface the demo credentials in the hellobar
# so a visitor knows how to sign in. Leave blank to show the read-only note without credentials.
OFFGRID_DEMO_VIEWER_EMAIL=
OFFGRID_DEMO_VIEWER_PASSWORD=

# ═════════════════════════════════════════════════════════════════════════════════════════════
# The rest of the platform. EVERYTHING BELOW IS OPTIONAL.
#
# The console ships a first-party default for every capability, so it runs with just the block
# above. The variables below only need setting when you swap in one of the OSS backends listed in
# the README's capability matrix, or point a capability at a self-hosted service. Leave any block
# unset to use the built-in default. Every value here is a GENERIC PLACEHOLDER — replace hosts,
# ports, keys, and secrets with your own. Never commit real values.
# ═════════════════════════════════════════════════════════════════════════════════════════════

# ── Runtime / general ────────────────────────────────────────────────────────────────────────
# NODE_ENV is set by the framework (development / production); only set it explicitly if you must.
NODE_ENV=
# Org name + primary lineage/audit namespace shown across the console.
OFFGRID_ORG=your-org
# Public URL this console is reached at (used for absolute links, callbacks, webhooks).
OFFGRID_CONSOLE_URL=https://your-console.example.com
# Public base for gateway-fronted public assets (e.g. the file store). Generic placeholder only.
OFFGRID_PUBLIC_BASE=https://your-gateway.example.com
# Which OSS services the status/smoke surface should probe (comma-separated ids). Empty = defaults.
OFFGRID_SERVICES=
# Path to the env file the console reads at runtime (default .env.local).
OFFGRID_ENV_FILE=.env.local
# Multi-tenant apex domain for provisioned per-tenant subdomains (<slug>.<apex>). Public build var.
NEXT_PUBLIC_TENANT_APEX=your-domain.example.com

# ── Admin / service-account auth ───────────────────────────────────────────────────────────────
# Bearer token for service accounts hitting /api/* (Authorization: Bearer <token>). CHANGE THIS.
OFFGRID_ADMIN_TOKEN=changeme-admin-token
# Comma-separated emails granted console admin.
OFFGRID_ADMIN_EMAILS=admin@your-org.example.com
# Generic bearer token some server-to-server calls present.
OFFGRID_TOKEN=changeme
# Token a metrics scraper (Prometheus, etc.) presents to the metrics endpoint.
OFFGRID_METRICS_SCRAPE_TOKEN=changeme
# SCIM provisioning bearer token (Access module user/group sync).
OFFGRID_SCIM_TOKEN=changeme
# Cookie domain shared across subdomains for one SSO session (e.g. .your-domain.example.com).
AUTH_COOKIE_DOMAIN=
# Dev-only credential login. MUST be false/empty in production.
AUTH_DEV_LOGIN=false

# ── Keycloak admin API + extra issuers ─────────────────────────────────────────────────────────
# Admin (service) client the Access module uses to manage users/machine clients.
OFFGRID_KEYCLOAK_ADMIN_CLIENT_ID=offgrid-console-admin
OFFGRID_KEYCLOAK_ADMIN_CLIENT_SECRET=changeme
# Additional accepted OIDC issuers (comma-separated), if you federate more than one.
OFFGRID_KEYCLOAK_ISSUERS=

# ── LLM gateway (LiteLLM-compatible router) ─────────────────────────────────────────────────────
# API key the console presents to the gateway (URL is OFFGRID_GATEWAY_URL, documented above).
OFFGRID_GATEWAY_API_KEY=changeme
# Which configured gateway to use when several are registered (index into the gateway list).
OFFGRID_GATEWAY_INDEX=
# Direct LiteLLM proxy URL + master key, when the console manages LiteLLM config directly.
OFFGRID_LITELLM_URL=http://localhost:4000
OFFGRID_LITELLM_MASTER_KEY=changeme
# Default model ids the platform uses for each task (must exist in your gateway).
OFFGRID_EMBED_MODEL=
OFFGRID_VISION_MODEL=
OFFGRID_GROUNDING_MODEL=
OFFGRID_EVAL_MODEL=
# Per-request image generation/vision timeout (ms).
OFFGRID_IMAGE_TIMEOUT_MS=

# ── Budgets ──────────────────────────────────────────────────────────────────────────────────
# Enforce per-tenant/model spend budgets (true) vs report-only (false).
OFFGRID_BUDGET_ENFORCE=

# ── Guardrails (PII + prompt/response screening) ────────────────────────────────────────────────
# First-party guardrails endpoint (regex/PII floor). Swap-ins below.
OFFGRID_GUARDRAILS_URL=http://localhost:8000
OFFGRID_GUARD_TIMEOUT_MS=60000
# Microsoft Presidio (ML PII) endpoint, if used.
OFFGRID_PRESIDIO_URL=http://localhost:5002
# External HTTP guard (e.g. a hosted or self-hosted guard) URL + API key.
OFFGRID_HTTP_GUARDRAIL_URL=
OFFGRID_HTTP_GUARDRAIL_API_KEY=changeme

# ── Evals + data quality + drift ────────────────────────────────────────────────────────────────
# Gateway API key the eval runner uses (may differ from the app gateway key).
OFFGRID_EVAL_GATEWAY_API_KEY=changeme
# Ragas / Evidently sidecar URLs (the `qa` profile OSS swap-ins).
OFFGRID_RAGAS_URL=http://localhost:8001
OFFGRID_EVIDENTLY_URL=http://localhost:8085
OFFGRID_DATAQUALITY_URL=http://localhost:8086
# promptfoo binary path (local eval CLI), if installed.
OFFGRID_PROMPTFOO_BIN=promptfoo
# QA sampling: fraction of runs auto-scored, and the minimum score to pass.
OFFGRID_QA_SAMPLE_RATE=
OFFGRID_QA_MIN_SCORE=
# Auto-rollback a model/policy change when drift is detected (true/false).
OFFGRID_AUTO_ROLLBACK_ON_DRIFT=

# ── Retrieval / vector store (RAG) ──────────────────────────────────────────────────────────────
# Retrieval adapter: lancedb (default, embedded) | qdrant | pgvector.
OFFGRID_ADAPTER_RETRIEVAL=
# Embedded LanceDB data path.
LANCEDB_PATH=./.lancedb
# Qdrant swap-in (URL + api key + collection).
OFFGRID_QDRANT_URL=http://localhost:6333
OFFGRID_QDRANT_API_KEY=changeme
OFFGRID_QDRANT_COLLECTION=offgrid
# Allow retrieval against an external/remote vector store (true/false; default false for safety).
OFFGRID_VECTORDB_ALLOW_EXTERNAL=

# ── Policy decisions (ABAC / OPA) ───────────────────────────────────────────────────────────────
# Open Policy Agent URL + decision-log sink, if you swap the first-party ABAC for OPA.
OFFGRID_OPA_URL=http://localhost:8181
OFFGRID_OPA_DECISION_LOG_URL=

# ── Secrets backend (OpenBao / Vault KV) ─────────────────────────────────────────────────────────
# OpenBao URL + token + KV mounts. Token is a GENERIC placeholder — set a real one.
OFFGRID_OPENBAO_URL=http://localhost:8200
OFFGRID_BAO_URL=http://localhost:8200
OFFGRID_OPENBAO_TOKEN=changeme
OFFGRID_OPENBAO_MOUNT=secret
OFFGRID_OPENBAO_DB_MOUNT=database

# ── Signing / provenance (audit records, C2PA, Sigstore) ─────────────────────────────────────────
# Symmetric signing key for run records. GENERIC placeholder — set a real, rotated key.
OFFGRID_SIGNING_KEY=changeme-signing-key
# Ed25519 private key (PEM/base64) for signed exports, if used. NEVER commit a real key.
OFFGRID_ED25519_PRIVATE_KEY=
# C2PA content-credential signing (cert + key paths + timestamp authority URL).
OFFGRID_C2PA_CERT=
OFFGRID_C2PA_KEY=
OFFGRID_C2PA_TSA_URL=
# Sigstore keyless signing (Fulcio CA, Rekor log, OIDC identity token).
OFFGRID_FULCIO_URL=https://fulcio.sigstore.dev
OFFGRID_REKOR_URL=https://rekor.sigstore.dev
OFFGRID_SIGSTORE_IDENTITY_TOKEN=

# ── Observability: traces, metrics, logs ─────────────────────────────────────────────────────────
# OTLP/OTEL collector endpoints.
OFFGRID_OTEL_URL=http://localhost:4318
OFFGRID_OTLP_URL=http://localhost:4318
OTEL_DEBUG=
# Langfuse (LLM trace + score) — URL, OTLP ingest, auth header, and public/secret keys.
OFFGRID_LANGFUSE_URL=http://localhost:3030
OFFGRID_LANGFUSE_OTLP_URL=http://localhost:3030/api/public/otel
OFFGRID_LANGFUSE_AUTH=
OFFGRID_LANGFUSE_PUBLIC_KEY=changeme
OFFGRID_LANGFUSE_SECRET_KEY=changeme
# Jaeger (trace UI + query API).
OFFGRID_JAEGER_URL=http://localhost:16686
OFFGRID_JAEGER_WEB_URL=http://localhost:16686
# SigNoz.
OFFGRID_SIGNOZ_URL=http://localhost:3301
# VictoriaMetrics / VictoriaLogs.
OFFGRID_VICTORIAMETRICS_URL=http://localhost:8428
OFFGRID_VICTORIALOGS_URL=http://localhost:9428
# Status page thresholds: how slow (ms) before a service is flagged "slow".
OFFGRID_STATUS_SLOW_MS=
# Edge access-log path.
OFFGRID_EDGE_LOG=

# ── Lineage (OpenLineage / Marquez) ──────────────────────────────────────────────────────────────
OFFGRID_MARQUEZ_URL=http://localhost:5000
OFFGRID_MARQUEZ_WEB_URL=http://localhost:3000
OFFGRID_LINEAGE_NAMESPACE=offgrid

# ── Audit search / SIEM (OpenSearch) ─────────────────────────────────────────────────────────────
OFFGRID_OPENSEARCH_URL=http://localhost:9200
OFFGRID_OPENSEARCH_DASHBOARDS_URL=http://localhost:5601
OFFGRID_OPENSEARCH_INDEX=offgrid-audit
OFFGRID_SIEM_INDEX=offgrid-siem

# ── Data plane (connect → sync → orchestrate → warehouse) ───────────────────────────────────────
# Airbyte (sync).
OFFGRID_AIRBYTE_URL=http://localhost:8000
# Kestra (orchestration) — URL + tenant + basic-auth user/pass.
OFFGRID_KESTRA_URL=http://localhost:8080
OFFGRID_KESTRA_TENANT=main
OFFGRID_KESTRA_USER=
OFFGRID_KESTRA_PASSWORD=changeme
# ClickHouse warehouse — URL + credentials.
OFFGRID_WAREHOUSE_URL=http://localhost:8123
OFFGRID_WAREHOUSE_USER=default
OFFGRID_WAREHOUSE_PASSWORD=changeme
# Redpanda/Kafka admin API (streaming).
OFFGRID_REDPANDA_ADMIN_URL=http://localhost:9644

# ── BI (Superset / Metabase) ─────────────────────────────────────────────────────────────────────
# Superset embed — URL, login, embed dashboard UUID, and metadata DB URI.
OFFGRID_SUPERSET_URL=http://localhost:8088
OFFGRID_SUPERSET_USERNAME=
OFFGRID_SUPERSET_PASSWORD=changeme
OFFGRID_SUPERSET_EMBED_UUID=
OFFGRID_SUPERSET_DB_URI=
# Metabase (alternative BI).
OFFGRID_METABASE_URL=http://localhost:3000

# ── Feature flags (Unleash) ──────────────────────────────────────────────────────────────────────
# Leave OFFGRID_FLAGS_OPEN=true to read flags from Postgres; set Unleash to read from Unleash.
OFFGRID_FLAGS_OPEN=
OFFGRID_UNLEASH_URL=http://localhost:4242/api
OFFGRID_UNLEASH_TOKEN=changeme
OFFGRID_UNLEASH_ADMIN_TOKEN=changeme
OFFGRID_UNLEASH_PROJECT=default
OFFGRID_UNLEASH_ENV=development

# ── Cache (Redis) ──────────────────────────────────────────────────────────────────────────────
# In-process cache by default; set to use Redis.
OFFGRID_REDIS_URL=redis://localhost:6379

# ── Object store (SeaweedFS, S3-compatible) ──────────────────────────────────────────────────────
OFFGRID_SEAWEEDFS_URL=http://localhost:8333
OFFGRID_SEAWEEDFS_PUBLIC_S3_URL=https://your-files.example.com
OFFGRID_SEAWEEDFS_BUCKET=offgrid

# ── Analytics (PostHog, optional) ────────────────────────────────────────────────────────────────
NEXT_PUBLIC_POSTHOG_KEY=
NEXT_PUBLIC_POSTHOG_HOST=https://us.i.posthog.com

# ── Device fleet (Fleet / osquery) ───────────────────────────────────────────────────────────────
# Two accepted names (either works); URL + API token.
OFFGRID_FLEET_URL=https://your-fleet.example.com
OFFGRID_FLEET_TOKEN=changeme
FLEET_URL=https://your-fleet.example.com
FLEET_TOKEN=changeme

# ── Speech (STT / TTS) ───────────────────────────────────────────────────────────────────────────
OFFGRID_STT_URL=http://localhost:9000
OFFGRID_TTS_URL=http://localhost:9001

# ── Provit (visual QA) uploads ──────────────────────────────────────────────────────────────────
OFFGRID_PROVIT_UPLOAD_MAX_BYTES=

# ── Durable app runs (Temporal — complements the agent-run block above) ──────────────────────────
OFFGRID_ADAPTER_APPRUNTIME=
OFFGRID_APP_TASK_QUEUE=offgrid-apps
OFFGRID_APP_MAX_ATTEMPTS=3
OFFGRID_CHAT_TASK_QUEUE=offgrid-chat
OFFGRID_CHAT_AWAIT_MS=25000
OFFGRID_QUEUE_TASK_QUEUE=offgrid-queue
OFFGRID_TEMPORAL_UI_URL=http://localhost:8233

# ── Agent behaviour ──────────────────────────────────────────────────────────────────────────────
# Max reasoning iterations per agent run, and the identity/role the runtime assumes.
OFFGRID_AGENT_MAX_ITERATIONS=
OFFGRID_AGENT_ROLE=

# ── Code execution sandboxes (Docker / Firecracker / E2B) ────────────────────────────────────────
# Container images + binaries used to run untrusted code. Local paths/images only.
OFFGRID_DOCKER_BIN=docker
OFFGRID_SANDBOX_NODE_IMAGE=node:22-slim
OFFGRID_SANDBOX_PY_IMAGE=python:3.12-slim
OFFGRID_FIRECRACKER_BIN=firecracker
OFFGRID_FC_NODE_IMAGE=
OFFGRID_FC_PY_IMAGE=
OFFGRID_KVM_DEVICE=/dev/kvm
# E2B microVM sandbox service URL.
OFFGRID_E2B_URL=

# ── Backups ──────────────────────────────────────────────────────────────────────────────────────
# Backup script path, destination dir, off-box target, retention + staleness thresholds, and the
# scheduler label. Use your own paths/targets; no real host.
OFFGRID_BACKUP_SCRIPT=
OFFGRID_BACKUPS_DIR=/var/backups/offgrid
OFFGRID_BACKUPS_OFFBOX_TARGET=
OFFGRID_BACKUPS_RETENTION_DAYS=14
OFFGRID_BACKUPS_STALE_HOURS=26
OFFGRID_BACKUP_LAUNCHD_LABEL=com.your-org.offgrid.backup

# ── Edge / proxy config paths ────────────────────────────────────────────────────────────────────
OFFGRID_CADDYFILE=

# ── Consumption: outbound sinks (email, WhatsApp) + inbound triggers (webhooks, IMAP) ───────────
# Webhook trigger base URL + shared secret for signed inbound webhooks.
OFFGRID_WEBHOOK_BASE_URL=https://your-hooks.example.com
OFFGRID_WEBHOOK_TOKEN=changeme
# Resend (transactional email) — API key + from address.
RESEND_API_KEY=changeme
RESEND_FROM=no-reply@your-domain.example.com
# SMTP fallback for outbound email.
OFFGRID_SMTP_URL=
OFFGRID_SMTP_USER=
OFFGRID_SMTP_PASS=changeme
OFFGRID_SMTP_FROM=no-reply@your-domain.example.com
# Inbound email: routing domain + IMAP pull (url/user/pass/mailbox).
OFFGRID_INBOUND_EMAIL_DOMAIN=inbox.your-domain.example.com
OFFGRID_EMAIL_IMAP_URL=
OFFGRID_EMAIL_IMAP_USER=
OFFGRID_EMAIL_IMAP_PASS=changeme
OFFGRID_EMAIL_IMAP_MAILBOX=INBOX
# WhatsApp Business API — URL + token + sender number.
OFFGRID_WHATSAPP_URL=
OFFGRID_WHATSAPP_TOKEN=changeme
OFFGRID_WHATSAPP_NUMBER=
# ERP connector password (demo/data-plane integration).
OFFGRID_ERP_PASSWORD=changeme

# ── Demo seeding + waitlist (optional) ──────────────────────────────────────────────────────────
# Seed demo data on boot (true/false). Never point at a real customer dataset.
OFFGRID_SEED_DEMO=
# Landing-page waitlist webhook (e.g. a form/CRM ingest URL).
WAITLIST_WEBHOOK_URL=

# Optional: map raw LAN IPs of fleet nodes to the mDNS hostnames shown in the UI, so a raw IP never
# surfaces. JSON object of { "<ip>": "<host>.local" }. Unset = empty (any private IP still displays
# as your control-plane host via the built-in fallback, so nothing leaks). Deployment-specific.
OFFGRID_FLEET_HOST_MAP={}