env.template

# This is the .env file used to setup Rocketgraph xGT and Mission Control.  See
# https://github.com/Rocketgraphai/rocketgraph/blob/main/README.md for
# details about what the different environment variables do.  The sections
# below match the groups in the README's Environment Variables tables.
#
# Commented lines are optional overrides — uncomment to set.

COMPOSE_PROJECT_NAME=rocketgraph

# -----------------------------------------------------------------------------
# Container Images
# -----------------------------------------------------------------------------
# By default each image uses the version pinned in the docker-compose files.
# To override one, uncomment it and replace <tag> with a specific version.
# The FIPS overlay swaps its own defaults (-fips tags, Percona for MongoDB),
# so overrides set here must use FIPS-appropriate tags when running it.  The
# license manager is the exception: its overlay has no FIPS default, so set
# MC_LICENSE_MANAGER_IMAGE to the -fips tag for FIPS deployments.
#MC_FRONTEND_IMAGE=docker.io/rocketgraph/mission-control-frontend:<tag>
#MC_BACKEND_IMAGE=docker.io/rocketgraph/mission-control-backend:<tag>
#MC_MONGODB_IMAGE=docker.io/library/mongo:<tag>
#XGT_IMAGE=docker.io/rocketgraph/xgt:<tag>
#MC_LICENSE_MANAGER_IMAGE=docker.io/rocketgraph/xgt-license-manager:<tag>

# -----------------------------------------------------------------------------
# Web Server Ports and TLS
# -----------------------------------------------------------------------------
# Set MC_EXTERNAL_TLS when HTTPS is terminated by a proxy in front of
# Mission Control so session cookies are marked Secure.  Not needed when
# Mission Control serves HTTPS itself via the certs below.  Under rootless
# Podman the ports must be 1024 or higher — see Running Under Podman in the
# README.
#MC_PORT=80
#MC_SSL_PORT=443
#MC_EXTERNAL_TLS=true
#MC_SSL_PUBLIC_CERT=/path/to/certs/td-cert.pem
#MC_SSL_PRIVATE_KEY=/path/to/certs/td-private-key.pem
#MC_SSL_CERT_CHAIN=/path/to/certs/cert-chain.pem

# -----------------------------------------------------------------------------
# xGT Server
# -----------------------------------------------------------------------------
#XGT_PORT=4367
#XGT_CONF_PATH=/path/to/conf
#XGT_DATA_PATH=/path/to/data
#XGT_LOG_PATH=/path/to/log
# "[]" runs Mission Control in single-user mode (no login).  List types to
# require login, e.g. "['BasicAuth', 'PKIAuth']".  When unset entirely, all
# types are offered: BasicAuth, FilePKIAuth, and PKIAuth.
XGT_AUTH_TYPES="[]"
#MC_DEFAULT_XGT_HOST=localhost
#MC_DEFAULT_XGT_PORT=4367
# MC_XGT_ALLOWED_HOSTS — recommended when the xGT host is user-supplied
# (prevents SSRF); * wildcards supported.
#MC_XGT_ALLOWED_HOSTS=xgt:4367,xgt2:4367
#MC_XGT_ALLOWED_HOSTS=xgt-*.xgt.myns.svc.cluster.local:4367

# -----------------------------------------------------------------------------
# Backend-to-xGT TLS
# -----------------------------------------------------------------------------
#XGT_SSL_SERVER_CERT=/path/to/certs/xgt-chain.pem
#XGT_SERVER_CN=xgt.example.com
#MC_SSL_PROXY_PUBLIC_CERT=/path/to/certs/proxy-cert.pem
#MC_SSL_PROXY_PRIVATE_KEY=/path/to/certs/proxy-key.pem

# -----------------------------------------------------------------------------
# MongoDB
# -----------------------------------------------------------------------------
# Optional override; normally the backend builds the URI from the
# MC_MONGO_PASSWORD/TLS settings below.  Set it for an external MongoDB.
#MC_MONGO_URI=mongodb://localhost:27017
# Set a password to enable auth; the root user is always "rocketgraph".
# Leave unset for no auth.
#MC_MONGO_PASSWORD=
# TLS — provide a server cert+key PEM (concatenated) and CA cert.  Not
# needed for single-host installs (traffic stays internal) unless security
# policy requires it.
#MC_MONGO_TLS_ENABLED=true
#MC_MONGO_TLS_SERVER_PEM=/path/to/mongo-server.pem
#MC_MONGO_TLS_CA_PEM=/path/to/mongo-ca.pem
# Server mode: requireTLS (default), preferTLS, or allowTLS.
#MC_MONGO_TLS_MODE=preferTLS
# mTLS — require clients to present a cert.  Off by default (server-only
# TLS).  When TLS is on, set MC_MONGO_MTLS_ENABLED=true and point
# MC_MONGO_TLS_CLIENT_PEM at the client PEM (generate_mongo_certs.sh
# produces client.pem) to require mutual TLS.
#MC_MONGO_MTLS_ENABLED=true
#MC_MONGO_TLS_CLIENT_PEM=/path/to/mongo-client.pem
# Encryption at rest (FIPS overlay only — needs Percona).  Generate a key,
# set perms (mongod runs as uid 1001), and back it up — losing the key
# means losing the data:
#   openssl rand -base64 32 > /opt/rocketgraph/mongo-encryption.key
#   chmod 600 /opt/rocketgraph/mongo-encryption.key
#   sudo chown 1001:1001 /opt/rocketgraph/mongo-encryption.key
#MC_MONGO_ENCRYPTION_ENABLED=true
#MC_MONGO_ENCRYPTION_KEY_FILE=/opt/rocketgraph/mongo-encryption.key

# -----------------------------------------------------------------------------
# Licensing
# -----------------------------------------------------------------------------
#XGT_LICENSE_FILE=/path/to/license/xgt-license.lic
# xGT License Manager (opt-in via docker-compose.license-manager.yml)
# Runs a dedicated license-manager service that supplies xgt with one or
# more licenses on port 6200.  Use when XGT_LICENSE_FILE (single .lic)
# is not enough — multiple licenses, or you want license updates
# without restarting xgt.
#
# Storage uses host bind mounts, like the xgt service.  License files
# live under the conf directory at <conf>/licenses/.
#
# Setup:
#   mkdir -p ~/.rocketgraph/license-manager/conf/licenses
#   cp /path/to/*.lic ~/.rocketgraph/license-manager/conf/licenses/
# In your xgtd.conf (under XGT_CONF_PATH), add:
#   license.location: 6200@license-manager
# Run with:
#   docker compose -f docker-compose.yml -f docker-compose.license-manager.yml up -d
#
# CONF_PATH and LOG_PATH default to ~/.rocketgraph/license-manager/{conf,log}.
#MC_LICENSE_MANAGER_CONF_PATH=/home/you/.rocketgraph/license-manager/conf
#MC_LICENSE_MANAGER_LOG_PATH=/home/you/.rocketgraph/license-manager/log

# -----------------------------------------------------------------------------
# OIDC Authentication
# -----------------------------------------------------------------------------
#XGT_AUTH_TYPES="['OidcAuth']"
#MC_OIDC_ISSUER=https://idp.example.com/realms/xgt
#MC_OIDC_CLIENT_ID=xgtd-client
#MC_OIDC_CLIENT_SECRET=
#MC_OIDC_SCOPES=openid profile email
#MC_OIDC_FRONTEND_URL=https://mc.example.com
#MC_OIDC_REDIRECT_URI=https://mc.example.com/api/login/oidc/callback
#MC_OIDC_TLS_VERIFY=true
#MC_OIDC_CA_CERT=/path/to/ca-bundle.pem
# MC_OIDC_ALLOWED_ORIGINS — optional defense-in-depth; restricts which
# frontend origins may initiate OIDC login (not required to prevent token
# theft); * wildcards supported.
#MC_OIDC_ALLOWED_ORIGINS=https://mc.example.com,http://localhost:8081
#MC_OIDC_ALLOWED_ORIGINS=https://*.apps.cluster.example.com

# -----------------------------------------------------------------------------
# Database Connectivity (ODBC)
# -----------------------------------------------------------------------------
#MC_ODBC_PATH=/usr/local/lib/odbc
#MC_ODBC_LIBRARY_PATH=/opt/ibm/iaccess/lib64/
#MC_IBM_IACCESS_PATH=/opt/ibm/iaccess/

# -----------------------------------------------------------------------------
# Site and LLM Configuration
# -----------------------------------------------------------------------------
#MC_SITE_CONFIG_YML=/path/to/site_config.yml
#MC_SITE_CONFIG_PY=/path/to/site_config.py

# -----------------------------------------------------------------------------
# Sessions
# -----------------------------------------------------------------------------
#MC_SESSION_TTL=3600