.env.example

# GitHub OAuth App credentials
# Create a GitHub App at https://github.com/settings/apps
GITHUB_CLIENT_ID=
GITHUB_CLIENT_SECRET=

# Dev mode settings (optional, defaults shown)
DEV_MODE=true
FRONTEND_URL=http://localhost:5174
# Skip the onboarding questionnaire for new users (default: false)
SKIP_ONBOARDING=false

# External API Configuration (optional)
# Geocoding API for weather card location search (default: Open-Meteo free API)
VITE_GEOCODING_API_URL=https://geocoding-api.open-meteo.com/v1/search

# Feature request / AI automation settings (optional)
# GitHub PAT for programmatic issue creation and screenshot uploads.
# Classic PAT: needs 'repo' scope (https://github.com/settings/tokens)
# Fine-grained PAT: needs 'Issues: Read and write' + 'Contents: Read and write'
#   (https://github.com/settings/personal-access-tokens/new)
# Without 'Contents' permission, issues are created but screenshots silently fail.
FEEDBACK_GITHUB_TOKEN=
# Repository where issues will be created
FEEDBACK_REPO_OWNER=kubestellar
FEEDBACK_REPO_NAME=console
# Optional: Secret for validating GitHub webhooks
# Generate with: openssl rand -hex 32
GITHUB_WEBHOOK_SECRET=

# Sidebar dashboard filter (comma-separated dashboard IDs, empty = show all)
# The order here controls the sidebar display order.
# Protected items (dashboard, clusters, deploy) cannot be removed by users.
#
# All available dashboard IDs:
#   dashboard, clusters, deploy, ai-ml, ai-agents, ci-cd, alerts,
#   arcade, compliance, compute, cost, data-compliance, deployments, events,
#   gitops, gpu-reservations, helm, llm-d-benchmarks, logs, network, nodes,
#   operators, pods, security, security-posture, services, storage, workloads
#
# Example (llm-d focused):
#   ENABLED_DASHBOARDS=dashboard,gpu-reservations,llm-d-benchmarks,ai-ml,arcade
ENABLED_DASHBOARDS=

# ===========================================
# AI Agent Configuration (at least one required for AI features)
# ===========================================

# Anthropic Claude API (https://console.anthropic.com/settings/keys)
ANTHROPIC_API_KEY=
# Model selection (optional - default: claude-sonnet-4-5-20250514)
CLAUDE_MODEL=

# OpenAI GPT API (https://platform.openai.com/api-keys)
OPENAI_API_KEY=
# Model selection (optional - default: gpt-4-turbo)
OPENAI_MODEL=

# Google Gemini API (https://makersuite.google.com/app/apikey)
GOOGLE_API_KEY=
# Model selection (optional - default: gemini-2.0-flash)
GEMINI_MODEL=

# OpenRouter API (https://openrouter.ai/keys)
# Unified OpenAI-compatible gateway to Anthropic, OpenAI, Google, Meta,
# Mistral, Qwen and other models via a single API key.
OPENROUTER_API_KEY=
# Model selection (optional - default: openai/gpt-4o-mini). See
# https://openrouter.ai/models for the full catalog.
OPENROUTER_MODEL=
# Optional base URL override for self-hosted OpenRouter proxies.
OPENROUTER_BASE_URL=

# Groq API (https://console.groq.com/keys)
# OpenAI-compatible chat completions backed by Groq's LPU inference hardware,
# yielding very low latency for Llama, Mixtral, Gemma and other open-weights
# models. See https://console.groq.com/docs/openai for wire-format details.
GROQ_API_KEY=
# Model selection (optional - default: llama-3.3-70b-versatile). See
# https://console.groq.com/docs/models for the full catalog.
GROQ_MODEL=
# Optional base URL override for self-hosted Groq proxies.
GROQ_BASE_URL=

# Default AI agent (optional - auto-detected based on available keys)
# Options: claude, openai, gemini, openrouter, groq
DEFAULT_AGENT=

# ===========================================
# ArgoCD Integration (optional)
# ===========================================
# Auth token for ArgoCD REST API sync (bypasses CLI and annotation fallback)
# Generate via: argocd account generate-token --account admin
# If not set, sync falls back to argocd CLI or annotation patching
ARGOCD_AUTH_TOKEN=
# WARNING: Setting this to "true" disables TLS certificate verification for
# ArgoCD API calls. Only use in dev/test environments with self-signed certs.
ARGOCD_TLS_INSECURE=

# ===========================================
# GA4 Analytics — Anti-spam proxy
# ===========================================
# The frontend uses a DECOY Measurement ID (visible in source code).
# The first-party proxy at /t/g/collect rewrites it to the real ID below.
# Spammers who scrape the source code send hits to a non-existent property.
GA4_REAL_MEASUREMENT_ID=

# ===========================================
# GPU Utilization Threshold Alerting (optional)
# ===========================================
# Alert when GPU utilization exceeds or falls below these percentages
# Default values: over-threshold 90%, under-threshold 20%
GPU_UTIL_OVER_THRESHOLD=90
GPU_UTIL_UNDER_THRESHOLD=20

# ===========================================
# WebSocket Configuration
# ===========================================
# WebSocket connection limit (default: 1000)
# Prevents resource exhaustion by capping concurrent WebSocket connections.
# Each connection consumes ~1 file descriptor, ~5KB memory, and 2 goroutines.
# Scale horizontally (add replicas) for higher total capacity.
WS_MAX_CONNECTIONS=

# ===========================================
# Server Configuration (optional — sensible defaults)
# ===========================================
# Backend listening port (default: 8080)
# PORT=8080
# Path to SQLite database file (default: ./console.db)
# DATABASE_PATH=./console.db
# Global HTTP request body size limit in bytes (default: 5242880 = 5 MB)
# MAX_BODY_BYTES=5242880

# ===========================================
# Kubernetes Configuration (optional)
# ===========================================
# Path to kubeconfig file (default: ~/.kube/config)
# KUBECONFIG=~/.kube/config
# Override cluster name (default: auto-detected from kubeconfig)
# CLUSTER_NAME=

# ===========================================
# kc-agent Authentication
# ===========================================
# Shared secret for authenticating with the co-located kc-agent.
# Auto-generated by startup-oauth.sh if not set.
# Generate with: openssl rand -hex 32
# KC_AGENT_TOKEN=

# ===========================================
# KAgent / KAgenti Service Discovery (optional, in-cluster only)
# ===========================================
# Direct controller URL overrides (skip service discovery):
# KAGENT_CONTROLLER_URL=
# KAGENTI_CONTROLLER_URL=
# KAGENTI_AGENT_URL=
# KAGENTI_AGENT_NAME=
#
# Service discovery components (used when controller URL is not set):
# KAGENT_NAMESPACE=
# KAGENT_SERVICE_NAME=
# KAGENT_SERVICE_PORT=
# KAGENT_SERVICE_PROTOCOL=http
# KAGENTI_NAMESPACE=
# KAGENTI_SERVICE_NAME=
# KAGENTI_SERVICE_PORT=
# KAGENTI_SERVICE_PROTOCOL=http

# ===========================================
# GPU DCGM Exporter (optional, requires NVIDIA GPU Operator)
# ===========================================
# Enable NVIDIA DCGM exporter scraping for real GPU memory/utilization metrics.
# Requires the NVIDIA GPU Operator to be installed in the cluster.
# GPU_METRICS_DCGM_ENABLED=false
# Kubernetes namespace where the GPU Operator DCGM exporter runs (default: gpu-operator)
# GPU_METRICS_DCGM_NAMESPACE=gpu-operator
# Service name of the DCGM exporter (default: dcgm-exporter)
# GPU_METRICS_DCGM_SERVICE=dcgm-exporter
# GPU metrics polling interval in milliseconds (default: 1200000 = 20 minutes)
# GPU_UTIL_POLL_INTERVAL_MS=1200000

# ===========================================
# GitHub Pipelines Integration (optional)
# ===========================================
# Comma-separated list of GitHub repos for CI/CD pipeline monitoring
# Format: owner/repo,owner/repo2
# PIPELINE_REPOS=
# GitHub PAT for mutation operations in pipelines (re-run, cancel)
# GITHUB_MUTATIONS_TOKEN=
# GitHub repository for update checks (default: kubestellar/console)
# GITHUB_REPO=kubestellar/console

# ===========================================
# TLS Configuration (optional)
# ===========================================
# Enable HTTPS with TLS certificates
# TLS_ENABLED=false
# TLS_CERT_FILE=/path/to/cert.pem
# TLS_KEY_FILE=/path/to/key.pem

# ===========================================
# In-Cluster Deployment (optional)
# ===========================================
# Suppress local kc-agent connections (for in-cluster deployments that use
# the backend directly without the local agent bridge)
# NO_LOCAL_AGENT=false
# Kubernetes namespace where the console pod runs (for self-upgrade feature)
# POD_NAMESPACE=

# ===========================================
# Frontend Build-Time Variables (optional)
# ===========================================
# These VITE_* variables are baked into the frontend at build time.
# They cannot be changed at runtime without rebuilding.
#
# API base URL for backend calls (default: empty = same origin)
# VITE_API_BASE_URL=
# Enable demo/Netlify preview mode (default: false)
# VITE_DEMO_MODE=false
# Suppress local kc-agent in frontend (default: false)
# VITE_NO_LOCAL_AGENT=false
# DRASI reactive graph integration (optional)
# VITE_DRASI_SERVER_URL=
# VITE_DRASI_PLATFORM_CLUSTER=