.env.example

# Copy this file to `.env` (same directory as docker-compose.yaml) and fill
# in what you need. Docker Compose loads `.env` automatically — nothing else
# to source or export. Every variable here is optional: docker-compose.yaml
# defines a safe local-dev default for each one (via `${VAR:-default}`), so
# `docker compose up -d` works with an empty/missing .env. Only override what
# a specific feature you're testing actually needs.

# ── AWS credentials ──────────────────────────────────────────────────────
# Used by backend/worker/feed-worker/ws-sfu/rtmp's AWS SDK clients. Defaults
# to the literal string "local", which is fine for everything that talks to
# the local emulators (DynamoDB-local, sqs-local) — DynamoDB-local/ElasticMQ
# don't validate credentials at all. Real credentials are only needed to
# exercise the pieces with no local emulator: S3 media uploads, Cognito auth
# (always the real hosted user pool — see docs/LOCAL_DEVELOPMENT.md), and any
# `cdk deploy` from infra/.
AWS_ACCESS_KEY_ID=
AWS_SECRET_ACCESS_KEY=
AWS_REGION=eu-central-1

# ── Media (S3 + CloudFront) ──────────────────────────────────────────────
# No local S3 emulator exists in docker-compose.yaml — leave these unset and
# media upload/live-HLS-to-S3 (rtmp/src/s3_sync.rs) just no-ops cleanly.
# Only set these if MediaStack has actually been deployed and you want local
# services to upload against the real bucket/distribution.
MEDIA_BUCKET_NAME=
MEDIA_BUCKET_REGION=eu-central-1
MEDIA_CLOUDFRONT_DOMAIN=

# ── Cognito ───────────────────────────────────────────────────────────────
# Every environment, including local dev, authenticates against the same
# real hosted Cognito user pool — there is no local Cognito emulator. Only
# override these if you're testing against a different user pool/app client
# than the one already baked in as docker-compose.yaml's default.
COGNITO_ISSUER_URI=
COGNITO_APP_CLIENT_ID=

# ── Warehouse: local Kafka + bq-sink smoke test ──────────────────────────
# Both empty/false by default — the backend/rtmp Kafka producers stay fully
# skipped, exactly like every environment with no MSK cluster configured.
# Set both together, only when deliberately exercising the warehouse profile
# (see docs/LOCAL_DEVELOPMENT.md and docker-compose.yaml's `kafka`/`bq-sink`
# services): after bringing the profile up, the single-broker cluster's 7
# topics must be pre-created manually with replication-factor 1 (see
# docker-compose.yaml's comment on the `kafka` service for why) — its own
# idempotent create-topics call will fail against a single broker otherwise.
#
#   KAFKA_ENABLED=true KAFKA_LOCAL_BOOTSTRAP_SERVERS=kafka:9092 \
#     docker compose --profile warehouse up -d
KAFKA_ENABLED=false
KAFKA_LOCAL_BOOTSTRAP_SERVERS=

# ── Warehouse: real BigQuery writes (bq-sink) ────────────────────────────
# docker-compose.yaml's `bq-sink` service does NOT read these — it always
# runs local-only, logging what it would insert instead of writing to
# BigQuery (see bq-sink/src/index.ts's LoggingWarehouse). These two only
# matter once bq-sink is actually deployed via infra/ and its GCP-side setup
# has been run (bq-sink/setup-gcp.sh, needs GCP_PROJECT_ID as a *shell* input
# to that script, not a var read by the running service). Once that script
# has written a real service-account key into the AWS Secrets Manager secret
# BqSinkServiceStack provisions, deploy with both of these passed as CDK
# context, not env vars:
#   cdk deploy EscldBqSinkServiceStack \
#     -c bigQueryProjectId=<your-gcp-project-id> \
#     -c bigQueryDataset=escld_events_raw
# Listed here only for reference — nothing local reads them.
BIGQUERY_PROJECT_ID=
BIGQUERY_DATASET=escld_events_raw

# ── Monitoring stack (opt-in profile) ────────────────────────────────────
# Only used when running `docker compose --profile monitoring up -d`.
# Defaults to admin/admin if left unset — fine for local dev, but override if
# you'd rather not use the default credentials.
GRAFANA_ADMIN_USER=admin
GRAFANA_ADMIN_PASSWORD=admin

# ── infra/ (cdk deploy) ───────────────────────────────────────────────────
# Not read from this .env file — docker-compose.yaml doesn't touch infra/,
# and the CDK app (infra/bin/infra.ts) reads these directly from the shell
# environment, not from dotenv. Listed here only as a reminder of what a
# `cdk deploy` needs set in your actual shell before running it:
#   CDK_DEFAULT_ACCOUNT   — your AWS account id
#   CDK_DEFAULT_REGION    — defaults to eu-central-1 if unset
# Real AWS credentials (via `aws configure`/environment/SSO) are also
# required for `cdk deploy` itself, separately from the AWS_* vars above.