env.secrets.example

# --- Option A: already enrolled (credentials.yaml written on a previous boot) ---
# Point the agent at a WebSocket URL; organization UUID and connection token load from
# /etc/fluid/debian/credentials.yaml by default, or set them here / in agent.yml.
# export FLUID_CONTROLPLANE_WEBSOCKET_URL="wss://dev.fluid.pub/v1/agents/websocket"
# export FLUID_CONTROLPLANE_ORGANIZATION_UUID=""
# export FLUID_CONTROLPLANE_TOKEN=""

# --- Option B: first boot enrollment (systemd EnvironmentFile = enrollment.env) ---
# export FLUID_ENROLLMENT_TOKEN="replace_with_provisioned_enrollment_secret"
# export FLUID_CONTROLPLANE_HTTP_BASE="https://dev.fluid.pub"
# export FLUID_CONTROLPLANE_WEBSOCKET_URL="wss://dev.fluid.pub/v1/agents/websocket"
# Optional: JSON object for POST /api/v1/enrollment/enroll extra_args (must match token extra_args_bind when set)
# export FLUID_ENROLLMENT_EXTRA_ARGS='{"use_case_run_id":"...","execution_role":"debian"}'
# Optional: keep enrollment.env after success so another agent on the same VM can reuse the same token (default: purge / true)
# export FLUID_ENROLL_PURGE_ENROLLMENT_SOURCES=false

# --- Option C: legacy single URL with org + token in query (still supported by agent.yml resolution) ---
# export FLUID_CONTROLPLANE_WEBSOCKET_URL="wss://dev.fluid.pub/v1/agents/websocket?organization_uuid=00000000-0000-0000-0000-000000000000&token=replace_me"