keep/.env.example at main · evalops/keep · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
# Database Configuration
POSTGRES_USER=postgres
POSTGRES_PASSWORD=your-secure-password-here
POSTGRES_DB=keep

# Google OAuth Configuration
GOOGLE_CLIENT_ID=your-google-client-id.apps.googleusercontent.com

# mTLS Configuration (optional - leave empty to disable mTLS)
# These paths are relative to the mounted /certs directory in containers
INVENTORY_TLS_CERT=/certs/inventory-server.crt
INVENTORY_TLS_KEY=/certs/inventory-server.key
INVENTORY_CLIENT_CA=/certs/ca.crt

AUTHZ_CLIENT_CERT=/certs/authz-client.crt
AUTHZ_CLIENT_KEY=/certs/authz-client.key
AUTHZ_CA_CERT=/certs/ca.crt

# Alternative: Use file paths for local development
# INVENTORY_TLS_CERT=./certs/inventory-server.crt
# INVENTORY_TLS_KEY=./certs/inventory-server.key
# INVENTORY_CLIENT_CA=./certs/ca.crt
# AUTHZ_CLIENT_CERT=./certs/authz-client.crt
# AUTHZ_CLIENT_KEY=./certs/authz-client.key
# AUTHZ_CA_CERT=./certs/ca.crt

# Production Secret Management (choose one)
# AWS Systems Manager Parameter Store
# SECRET_MANAGER_TYPE=ssm
# SECRET_MANAGER_REGION=us-west-2
# SECRET_MANAGER_PREFIX=/keep/production/

# HashiCorp Vault
# SECRET_MANAGER_TYPE=vault
# VAULT_ADDR=https://vault.company.com:8200
# VAULT_TOKEN_FILE=/var/secrets/vault-token
# VAULT_SECRET_PATH=secret/keep/production

# Azure Key Vault
# SECRET_MANAGER_TYPE=azure
# AZURE_KEYVAULT_URL=https://keep-vault.vault.azure.net/
# AZURE_CLIENT_ID=your-service-principal-id