.env.example

# Personal config + secrets TEMPLATE. Copy to .env and edit:  cp .env.example .env
# Plain KEY=value scalars only, no logic, arrays or command substitution. Chart versions live in each chart's
# Chart.yaml, not here.
# The IPs, domains, emails and repo below are FAKE placeholders. Every SECRET is empty on purpose: leave one
# empty to skip the feature it enables, and NEVER put a real one in this committed template.

# ---- CONFIG: non-secret, per-deployment values ----

# ---- Cluster shape  (what this platform assumes about the machines underneath it) ----
# The cluster itself is NOT built here: nodes, networking and OS are whatever you already run. This repo
# starts from a kubectl context pointing at a cluster that already exists.
# The defaults below describe a Talos cluster, which is what this was developed against. Every one of them is
# a real assumption, and the README's "What this expects of your cluster" says what to change if yours differs.
KUBE_API_HOST="localhost"              # where Cilium reaches the API before pod networking exists. Talos KubePrism is localhost; elsewhere your API endpoint or a node-local proxy
KUBE_API_PORT="7445"                   # port for the above. Talos KubePrism is 7445, a plain apiserver is usually 6443
KUBELET_TLS_INSECURE="true"            # true = metrics-server skips kubelet cert verification (self-signed kubelet certs, no CSR approver). false if your kubelets carry signed certs
ETCD_METRICS_PORT="2381"               # etcd's metrics listener, scraped for control-plane dashboards. Empty-ish clusters may not expose it at all
LONGHORN_DATA_PATH="/var/mnt/storage"  # where Longhorn stores replica data on each node. Its own default is /var/lib/longhorn; any path works if it exists on every longhorn-node and is bind-mounted rshared into the kubelet

# ---- Target cluster  (the safety interlock; read this one) ----
# The ONE kubectl context every script here may touch. Your ~/.kube/config almost certainly holds work
# clusters too, and these scripts are not read-only: the DANGEROUS_ ones redeliver an entire platform and
# wipe S3 backups. So the target is pinned HERE, not taken from whatever context happens to be selected.
# Leave it empty and the first run lists your contexts, asks once, and writes the answer back into this file.
KUBE_CONTEXT=""                        # e.g. admin@my-cluster

# ---- GHCR registry  (private image pulls) ----
GHCR_USER="your-github-username"       # GitHub username the pull token belongs to (also your GHCR namespace)

# ---- GitOps / ArgoCD  (step 02a/02b) ----
# REPO_URL must equal the repoURL committed across argo_apps/ (https form, no trailing .git).
REPO_URL="https://github.com/yama6a/offgrid"
POLL_SYNC_ENABLED="false"               # ArgoCD git-poll cadence, patched into timeout.reconciliation by 02b: false=300s fallback / true=60s. The webhook is the fast path either way. The webhook secret is NOT here, 02b mints it into secrets/

# ---- Networking + domains  (step 01 Cilium LB-IPAM, step 04_values gateway/values) ----
LB_RANGE_START="192.168.100.200"       # CiliumLoadBalancerIPPool start (same L2 as nodes, outside DHCP)
LB_RANGE_STOP="192.168.100.250"        # ... pool end
INGRESS_LB_IP="192.168.100.200"        # the ONE IP every ingress answers on; must be inside [LB_RANGE_START, LB_RANGE_STOP]
BASE_DOMAIN="example.com"              # REQUIRED: registrable domain you own. Platform UIs land on *.ops.<base>, workloads on *.app.<base>
SSO_ALLOWLIST="you@example.com"        # space-separated Google accounts allowed through the SSO gate on every protected host
LE_EMAIL="you@example.com"             # ACME registration email for the Let's Encrypt ClusterIssuers
CLOUDFLARE_WILDCARD_DOMAINS=""          # space-separated host tiers OR whole domains to serve via Cloudflare DNS-01 wildcard certs, e.g. "ops.example.com app.example.com example.edu". Entries need NOT sit under BASE_DOMAIN. Cloudflare auto-detects the registrable zone. Empty = HTTP-01 per host

# ---- S3 backups: Terraform bucket + CNPG/Redis/Longhorn/VM-Logs backups  (steps 10a-10e) ----
AWS_REGION="eu-central-1"              # AWS region for the backup bucket (Terraform + the CNPG S3 endpoint)
S3_BACKUP_BUCKET="my-cluster-backups"  # globally-unique bucket for ALL backups (prefixes cnpg/, redis/, longhorn/, vm/)
S3_BACKUP_TRANSITION_DAYS="30"         # lifecycle: age at which objects move to Glacier Instant Retrieval
S3_BACKUP_RETENTION_DAYS="180"         # lifecycle: age at which objects are deleted (= the recovery window)
CNPG_BACKUP_RPO="15min"                # WAL archive_timeout => at most this much committed data lost on a primary failure (Postgres duration string)

# ---- SECRETS: never commit or share. Each empty value skips that feature. ----

GITHUB_GHCR_PULL_TOKEN_SECRET=""       # classic PAT, read:packages, for pulling PRIVATE ghcr.io images. Used here only as a docker login; cluster-wide pull auth is a node-level setting (empty = public images only)
ARGOCD_GITHUB_PAT_SECRET=""            # fine-grained, read-only, single-repo PAT, 02a seeds ArgoCD's repo-creds Secret (empty = anonymous clone, PUBLIC repo only)
GOOGLE_SSO_CLIENT_ID=""                # Google OAuth client id (*.apps.googleusercontent.com), 04_google_sso writes it into the google-sso values (REQUIRED for SSO)
GOOGLE_SSO_CLIENT_SECRET=""            # Google OAuth client secret (pairs with GOOGLE_SSO_CLIENT_ID), 04_google_sso seals it for Envoy Gateway OIDC (REQUIRED for SSO)
CLOUDFLARE_API_TOKEN_SECRET=""         # scoped Cloudflare API token (Zone:DNS:Edit + Zone:Read on EVERY parent Cloudflare zone of your CLOUDFLARE_WILDCARD_DOMAINS), 04_cloudflare_token seals it into cert-manager for DNS-01 wildcard issuance (empty = DNS-01 disabled -> HTTP-01 fallback everywhere)
NTFY_PHONE_PASSWORD_SECRET=""          # password for the ntfy 'phone' user (Android app login), 06_ntfy_auth seeds it (empty = disable ntfy alerting)
AWS_DEPLOY_ACCESS_KEY_ID=""            # AWS deployer access key id (pairs with the secret below), Terraform ONLY (s3:* on the bucket + iam:* on the writer; EXACT policy in docs/10_backups.md). Empty = skip backups (10a-10e no-op). NOT sealed into the cluster
AWS_DEPLOY_SECRET_ACCESS_KEY_SECRET="" # AWS deployer secret access key, Terraform only, never enters the cluster