# SAFE TEMPLATE ONLY. Copy outside Git and replace every REPLACE_* value.
# This file contains references and ordinary configuration, never credentials.

# Operator-provided host paths and identity
UNRAID_HOST=REPLACE_WITH_UNRAID_LAN_HOST_OR_IP
APPDATA_ROOT=/srv/example/appdata/itworx-mcp-hub
SECRETS_DIR=/srv/example/appdata/itworx-mcp-hub/secrets
PROJECTS_READONLY_ROOT=/srv/example/appdata/itworx-mcp-hub/sources
KNOWLEDGE_SOURCES_JSON=[{"project":"REPLACE_PROJECT","sourceRef":"repository","path":"REPLACE_RELATIVE_SOURCE_PATH","sourceType":"documentation","revision":"REPLACE_WITH_IMMUTABLE_COMMIT"}]
BACKUP_ROOT=/srv/example/appdata/itworx-mcp-hub/backups
PUID=REPLACE_WITH_NUMERIC_UID
PGID=REPLACE_WITH_NUMERIC_GID
DOCKER_SOCKET_GID=REPLACE_WITH_DOCKER_SOCKET_NUMERIC_GID

# Operator-provided bind addresses and generated Compose ports
HUB_BIND_IP=REPLACE_WITH_UNRAID_LAN_IP
MCP_BIND_IP=REPLACE_WITH_UNRAID_LAN_IP
HUB_PORT=1100
MCP_PORT=18442
INSPECTOR_BIND_IP=REPLACE_ONLY_IF_INSPECTOR_IS_ENABLED
INSPECTOR_PORT=18443

# Registry references. REGISTRY_CREDENTIAL_REF names an external credential
# helper/login context; it is not a password.
REGISTRY_HOST=REPLACE_WITH_REGISTRY_HOST
REGISTRY_NAMESPACE=REPLACE_WITH_REGISTRY_NAMESPACE
REGISTRY_CREDENTIAL_REF=REPLACE_WITH_OPERATOR_CREDENTIAL_REFERENCE

# Immutable owned images: registry/path:tag@sha256:<64 lowercase hex>.
HUB_CONTROL_IMAGE=REPLACE_WITH_IMMUTABLE_IMAGE
HUB_WORKER_IMAGE=REPLACE_WITH_IMMUTABLE_IMAGE
HUB_DATAPLANE_IMAGE=REPLACE_WITH_IMMUTABLE_IMAGE
HUB_WEB_IMAGE=REPLACE_WITH_IMMUTABLE_IMAGE
CONNECTOR_KNOWLEDGE_IMAGE=REPLACE_WITH_IMMUTABLE_IMAGE
CONNECTOR_GITEA_IMAGE=REPLACE_WITH_IMMUTABLE_IMAGE
CONNECTOR_UNRAID_IMAGE=REPLACE_WITH_IMMUTABLE_IMAGE
CONNECTOR_PROJECTBRAIN_IMAGE=REPLACE_WITH_IMMUTABLE_IMAGE
CONNECTOR_APPOPS_IMAGE=REPLACE_WITH_IMMUTABLE_IMAGE
CONNECTOR_STITCH_IMAGE=REPLACE_WITH_IMMUTABLE_IMAGE
DOCKER_READ_BROKER_IMAGE=REPLACE_WITH_IMMUTABLE_IMAGE
OBSERVABILITY_COLLECTOR_IMAGE=REPLACE_WITH_IMMUTABLE_IMAGE

# Authentik/OIDC ordinary configuration. Secret values live only in
# $SECRETS_DIR/authentik_oidc_client_secret and hub_session_signing_key.
HUB_OIDC_ISSUER=https://REPLACE_WITH_AUTHENTIK_HOST/application/o/itworx/
HUB_OIDC_AUDIENCE=itworx-mcp-hub
HUB_OIDC_CLIENT_ID=REPLACE_WITH_AUTHENTIK_CLIENT_ID
HUB_OIDC_REDIRECT_URI=https://REPLACE_WITH_MCP_HOST/auth/callback
HUB_OIDC_ROLE_GROUP_MAP={"REPLACE_WITH_ADMIN_GROUP":"admin","REPLACE_WITH_OPERATOR_GROUP":"operator"}
HUB_MCP_ADDITIONAL_OIDC_ISSUER=https://REPLACE_WITH_AUTHENTIK_HOST/application/o/chatgpt-itworx-gitea/
HUB_MCP_ADDITIONAL_OIDC_AUDIENCE=chatgpt-itworx-gitea
HUB_MCP_ADDITIONAL_OIDC_CLIENT_ID=chatgpt-itworx-gitea
HUB_MCP_ADDITIONAL_OIDC_REDIRECT_URI=https://chatgpt.com/connector/oauth/REPLACE_WITH_CONNECTOR_ID
HUB_PUBLIC_MCP_URL=https://REPLACE_WITH_MCP_HOST
HUB_RATE_LIMIT_PER_MINUTE=600
HUB_UPSTREAM_MAX_CONCURRENCY=24
HUB_UPSTREAM_QUEUE_TIMEOUT_SECONDS=5
AUTHENTIK_PROVIDER_ID=REPLACE_WITH_PROVIDER_ID
AUTHENTIK_HUB_APPLICATION_ID=REPLACE_WITH_APPLICATION_ID
AUTHENTIK_SCOPES=openid,profile,email,groups,offline_access
AUTHENTIK_ALLOWED_GROUPS=REPLACE_WITH_COMMA_SEPARATED_GROUPS
AUTHENTIK_SERVICE_ACCOUNTS=["REPLACE_WITH_SCOPED_SERVICE_ACCOUNT"]
MCP_CLIENT_BINDINGS_JSON=[{"clientId":"REPLACE_WITH_UUID","subject":"REPLACE_WITH_OIDC_SUBJECT","project":"REPLACE_PROJECT","environment":"prod","enabled":true}]

# ContextForge internal endpoint/configuration. Credentials and key material
# live in the named files under SECRETS_DIR.
HUB_CONTEXTFORGE_URL=http://contextforge-control:4444
CONTEXTFORGE_DB_HOST=postgres
CONTEXTFORGE_DB_NAME=contextforge
CONTEXTFORGE_DB_USER=contextforge
REDIS_AUTH_ENABLED=true

# Existing Gitea; this deploys only the connector, never another Gitea server.
GITEA_ENDPOINT=https://REPLACE_WITH_GITEA_HOST
GITEA_REPOSITORIES_JSON=[{"project":"REPLACE_PROJECT","owner":"REPLACE_OWNER","name":"REPLACE_REPOSITORY"}]
GITEA_ADDITIONAL_PROJECTS=gitea-loop
GITEA_AUTO_DISCOVER_PROJECT=
GITEA_WRITE_OWNER=
GITEA_TOKEN_SCOPE=read:repository
GITEA_WRITE_TOKEN_SCOPE=write:repository,write:issue
GITEA_ENABLE_PR_WRITES=true

# Existing ProjectBrain; the Hub uses a dedicated server-to-server secret file.
PROJECTBRAIN_ENDPOINT=https://projectbrain.example.com
PROJECTBRAIN_PROJECTS=gitea-all

# Existing private AppOps MCP; the Hub reuses its dedicated MCP service token.
APPOPS_ENDPOINT=http://198.18.10.150:1216
APPOPS_PROJECTS=server-ops

# Google Stitch remote MCP. The API key lives only in $SECRETS_DIR/stitch_api_key.
STITCH_HUB_PROJECTS=stitch-design

# Existing NPM and DNS inputs. NETWORK_TARGETS_JSON is checked only with the
# explicit --verify-network-targets flag.
#
# Production uses a single public hostname (see
# infrastructure/nginx-proxy-manager/ROUTING.md): one NPM proxy host and one
# DNS record for REPLACE_WITH_MCP_HOST, routed by path (default location ->
# web:8080, "/mcp" custom location -> dataplane-router:8080). The *_HUB_*
# variables below are the management-surface half of that single-host
# routing config, not a second host -- set them to the exact same hostname
# value as the *_MCP_* variables. Never set a distinct hub.example.com value.
NPM_NETWORK_NAME=REPLACE_WITH_EXISTING_NPM_NETWORK
NPM_HUB_PROXY_HOST=REPLACE_WITH_MCP_HOST
NPM_MCP_PROXY_HOST=REPLACE_WITH_MCP_HOST
NPM_CERTIFICATE_REF=REPLACE_WITH_CERTIFICATE_REFERENCE
DNS_HUB_HOSTNAME=REPLACE_WITH_MCP_HOST
DNS_MCP_HOSTNAME=REPLACE_WITH_MCP_HOST
DNS_EXPECTED_ADDRESSES_JSON={"REPLACE_WITH_MCP_HOST":["REPLACE_WITH_INGRESS_IP"]}
NETWORK_TARGETS_JSON={"registry":"REPLACE_WITH_REGISTRY_HOST:443","gitea":"REPLACE_WITH_GITEA_HOST:443"}

# Generated during deployment; do not hand-edit into credentials.
UNRAID_REGISTRATIONS_FILE=/srv/example/appdata/itworx-mcp-hub/config/registered-targets.json