.env.production.example

# Copy to .env.production and replace every value. Do not commit that file.
# Passwords embedded in connection URLs must be URL-safe (or percent-encoded).
POSTGRES_DB=modelforge
POSTGRES_OWNER_PASSWORD=replace-with-a-long-url-safe-password
POSTGRES_RUNTIME_PASSWORD=replace-with-a-different-long-url-safe-password
REDIS_PASSWORD=replace-with-a-long-url-safe-password

OIDC_ISSUER=https://identity.example-hospital.org/realms/modelforge
OIDC_AUDIENCE=modelforge-api
OIDC_ADMIN_CLIENT_ID=modelforge-admin

# Generate with: openssl rand -base64 32
IMAGING_ENCRYPTION_KEY=
METRICS_TOKEN=replace-with-a-long-random-bearer-token

# Optional: S3 imaging storage instead of the local-filesystem volume above.
# Leave all of these blank to stay on local-filesystem storage. Provision
# the bucket/KMS key/CloudFront distribution with infra/imaging-cdk/ (see
# its README) rather than by hand — its stack outputs map directly onto
# these four. All three of IMAGING_S3_BUCKET/KMS_KEY_ID/REGION must be set
# together, or none at all; see docs/IMAGING.md's "Required AWS resources".
IMAGING_S3_BUCKET=
IMAGING_S3_KMS_KEY_ID=
IMAGING_S3_REGION=
IMAGING_S3_KEY_PREFIX=

# Optional, and only meaningful once IMAGING_S3_BUCKET is set above: fronts
# the bucket with signed CloudFront URLs instead of streaming pixel data
# through this server process. All three required together.
# IMAGING_CLOUDFRONT_KEY_PAIR_ID: from infra/imaging-cdk's
#   ImagingCloudFrontKeyPairId output.
# IMAGING_CLOUDFRONT_PRIVATE_KEY: base64 of the PEM private key generated
#   per infra/imaging-cdk/README.md step 1 — this value never comes from
#   CDK output; it's generated offline and never leaves this file.
IMAGING_CLOUDFRONT_DOMAIN=
IMAGING_CLOUDFRONT_KEY_PAIR_ID=
IMAGING_CLOUDFRONT_PRIVATE_KEY=

# Only needed when IMAGING_S3_BUCKET is set above (the AWS SDK's default
# credential chain picks these up automatically). On real AWS compute
# (ECS/EC2/EKS), prefer an attached IAM role instead — see
# infra/imaging-cdk/README.md's server task role output — and leave these
# three blank. Static keys are the fallback for a host with no AWS-native
# identity to inherit from.
AWS_ACCESS_KEY_ID=
AWS_SECRET_ACCESS_KEY=
AWS_SESSION_TOKEN=

# The included admin container is plain HTTP on this local port. Terminate
# TLS in a real ingress/reverse proxy before exposing it to users.
ADMIN_HTTPS_PROXY_PORT=8080

# Optional prebuilt image names. Compose builds local images by default.
MODELFORGE_SERVER_IMAGE=modelforge-server:local
MODELFORGE_ADMIN_IMAGE=modelforge-admin-console:local