.env.example

# INEC Platform Environment Variables
# Copy to .env for local deployment. Do not commit real credentials.

# PostgreSQL primary, replica, and Pgpool
PG_DB=replace_with_postgres_database_name
PG_USER=replace_with_postgres_user
PG_PASSWORD=replace_with_a_strong_postgres_password
REPLICATOR_PASSWORD=replace_with_a_strong_replication_password
PGPOOL_ADMIN_USER=replace_with_pgpool_admin_user
PGPOOL_ADMIN_PASSWORD=replace_with_a_strong_pgpool_password
DATABASE_URL=postgres://replace_with_postgres_user:replace_with_a_strong_postgres_password@localhost:5432/replace_with_postgres_database_name?sslmode=disable
DATABASE_REPLICA_URL=postgres://replace_with_postgres_user:replace_with_a_strong_postgres_password@localhost:5433/replace_with_postgres_database_name?sslmode=disable

# Platform security, API gateway, and tally decryption
JWT_SECRET=replace_with_a_secure_32_byte_secret_key
HSM_MASTER_KEY=replace_with_a_64_character_hex_256_bit_key
APISIX_ADMIN_KEY=replace_with_a_strong_apisix_admin_key
TALLY_DECRYPT_TOKEN=replace_with_a_strong_tally_decryption_token
CORS_ORIGINS=https://inec.local
ALLOWED_ORIGINS=https://inec.local

# Keycloak SSO / OIDC
KEYCLOAK_URL=http://keycloak:8080
KEYCLOAK_REALM=inec
KEYCLOAK_CLIENT_ID=inec-backend
KEYCLOAK_CLIENT_SECRET=replace_with_keycloak_client_secret
KEYCLOAK_ADMIN=replace_with_keycloak_bootstrap_admin
KEYCLOAK_ADMIN_PASSWORD=replace_with_a_strong_keycloak_bootstrap_password
INEC_ADMIN_PASSWORD=replace_with_a_strong_inec_admin_password
OFFICER_PASSWORD=replace_with_a_strong_presiding_officer_password
OBSERVER_PASSWORD=replace_with_a_strong_observer_password

# Permify relationship-based authorization
PERMIFY_URL=http://permify:3476
PERMIFY_TENANT_ID=inec

# TigerBeetle native ledger connection
TIGERBEETLE_URL=tigerbeetle:3001

# Redis
REDIS_URL=redis://redis:6379/0

# Kafka and Dapr pub/sub
KAFKA_BROKERS=kafka:29092
KAFKA_REST_URL=http://kafka-rest:8082
DAPR_HTTP_PORT=3500

# Temporal durable workflows
TEMPORAL_HOST_PORT=temporal:7233
TEMPORAL_NAMESPACE=default

# Fluvio streaming through the official Rust SDK bridge
FLUVIO_ENDPOINT=fluvio-sc:9003
FLUVIO_STREAM_URL=http://fluvio-stream:8100
FLUVIO_TOPIC_AUDIT=inec.audit.log
FLUVIO_TOPIC_RESULTS=inec.results.submitted

# Lakehouse, CPU inference, and biometric capture pipeline
LAKEHOUSE_URL=http://lakehouse:8090
RUST_INFERENCE_URL=http://inference-engine:8091
BIOMETRIC_PIPELINE_URL=http://biometric-go:8092
BIOMETRIC_PYTHON_URL=http://biometric-python:8090
BIOMETRIC_RUST_URL=http://biometric-rust:8091
MODELS_DIR=/app/models

# OpenAppSec APISIX attachment / standalone agent
APPSEC_VERSION=replace_with_verified_openappsec_version
OPENAPPSEC_DB_PASSWORD=replace_with_a_strong_openappsec_database_password
OPENAPPSEC_GATEWAY_ENFORCED=true

# Satellite imagery through a real STAC provider
SATELLITE_SERVICE_URL=http://satellite-change-detection:8204
STAC_API_URL=https://replace_with_your_stac_api.example/v1
STAC_COLLECTION=replace_with_stac_collection
STAC_PREVIEW_ASSET=replace_with_preview_asset_name
STAC_MAX_CLOUD_COVER=replace_with_maximum_cloud_cover_percent

# Standalone biometric service
INFERENCE_ENGINE_URL=http://inference-engine:8091
VAULT_KEY=replace_with_64_character_hex_256_bit_key

# Optional external integrations
OPENAI_API_KEY=replace_with_openai_api_key_if_campaign_planning_is_enabled
OPENAI_API_BASE=https://replace_with_openai_compatible_api_base

# Document AI and trained CPU model services
DOCUMENT_AI_URL=http://document-ai:8089
INFERENCE_ENGINE_URL=http://inference-engine:8091
BIOMETRIC_LIVENESS_URL=http://inference-engine-v2:8091/liveness/predict
VLM_ENDPOINT=https://replace_with_your_openai_compatible_vision_endpoint
VLM_MODEL=replace_with_your_vision_model_name
NIN_API_URL=https://replace_with_authorized_nimc_verification_endpoint
NIN_API_KEY=replace_with_authorized_nimc_api_key

# Digital twin and campaign planning AI
OPENAI_MODEL=replace_with_authorized_scenario_and_campaign_model
CAMPAIGN_PLANNING_URL=http://campaign-planning:8007
INEC_API_URL=http://go-backend:8088

# Predictive resource allocation trained from real historical results
MIN_TRAINING_SAMPLES=replace_with_minimum_real_historical_result_count
RESOURCE_BALLOT_BUFFER=replace_with_ballot_spoilage_buffer_fraction
RESOURCE_VOTERS_PER_CLERK=replace_with_authorised_voter_to_clerk_ratio
RESOURCE_MIN_POLL_CLERKS=replace_with_authorised_minimum_poll_clerks
RESOURCE_MIN_SECURITY_PERSONNEL=replace_with_authorised_minimum_security_personnel

# --- Added 2026-08-12: required-by-compose variables previously undocumented ---

# Application environment (go-backend and services fail closed without these)
APP_ENV=development
INEC_ENV=development
INTERNAL_SERVICE_SECRET=replace_with_a_strong_internal_service_secret

# Service-to-service API keys (each service rejects unauthenticated requests)
DOCUMENT_AI_API_KEY=replace_with_a_strong_document_ai_api_key
BIOMETRIC_API_KEY=replace_with_a_strong_biometric_api_key
BIOMETRIC_VAULT_API_KEY=replace_with_a_strong_biometric_vault_api_key
LAKEHOUSE_API_KEY=replace_with_a_strong_lakehouse_api_key
TALLY_SUBMIT_TOKEN=replace_with_a_strong_tally_submit_token
FEDERATED_SUBMIT_KEY=replace_with_a_strong_federated_submit_key
DIGITAL_TWIN_API_KEY=replace_with_a_strong_digital_twin_api_key
AI_ANOMALY_API_KEY=replace_with_a_strong_ai_anomaly_api_key
SATELLITE_API_KEY=replace_with_a_strong_satellite_api_key
PREDICTIVE_ALLOC_API_KEY=replace_with_a_strong_predictive_alloc_api_key
MODEL_SERVING_API_KEY=replace_with_a_strong_model_serving_api_key
FLUVIO_STREAM_API_KEY=replace_with_a_strong_fluvio_stream_api_key
INFERENCE_API_KEY=replace_with_a_strong_inference_api_key
GEOLIBRE_API_KEY=replace_with_a_strong_geolibre_api_key
CAMPAIGN_PLANNING_API_KEY=replace_with_a_strong_campaign_planning_api_key
GOTV_ANALYTICS_API_KEY=replace_with_a_strong_gotv_analytics_api_key

# Keycloak realm import: caddy-edge client secret (SEDONA_SERVICE_TOKEN below)
CADDY_CLIENT_SECRET=replace_with_a_strong_caddy_client_secret
SEDONA_SERVICE_TOKEN=replace_with_a_strong_sedona_service_token
DEVICE_GEOFENCE_METERS=replace_with_authorized_geofence_radius_meters

# Dapr sidecar token required by the lakehouse pub/sub client
DAPR_API_TOKEN=replace_with_a_strong_dapr_api_token

# APISIX device-gateway mTLS config directory (docker-compose.device-gateway.yml)
APISIX_DEVICE_CONFIG_DIR=replace_with_host_path_to_device_gateway_config

# Evidence integrity signer (Ed25519). Generate via the approved secret process.
INTEGRITY_SIGNING_REQUIRED=true
INTEGRITY_SERVICE_TOKEN=replace_with_a_strong_integrity_service_token
METRICS_BEARER_TOKEN=change-me-metrics-token
INTEGRITY_SIGNING_KEY=replace_with_64_character_hex_ed25519_signing_key
INTEGRITY_SIGNER_KEY_ID=replace_with_signer_key_id

# Document AI policy thresholds (document-ai fails closed without these)
OCR_MODEL_DIR=replace_with_paddleocr_model_dir
DOCLING_MODEL=replace_with_docling_model_name
SECONDARY_OCR_ENGINE=replace_with_secondary_ocr_engine
SECONDARY_OCR_REQUIRED=false
DOCUMENT_INTEGRITY_POLICY_VERSION=replace_with_integrity_policy_version
DOCUMENT_ANALYSIS_VERSION=replace_with_document_analysis_version
MAX_DOCUMENT_BYTES=20000000
MIN_OCR_CONFIDENCE=0.75
MIN_VLM_COMPLETENESS=0.80
MIN_DOCUMENT_EDGE=720

# Official external voter-service navigation (must be an HTTPS INEC URL)
INEC_CVR_URL=https://cvr.inecnigeria.org/

# Grafana admin password (observability/docker-compose.monitoring.yml)
GRAFANA_ADMIN_PASSWORD=replace_with_a_strong_grafana_admin_password

# Hyperledger Fabric anchoring (docker-compose.fabric.yml; keep disabled until approved)
FABRIC_ANCHORING_ENABLED=false
FABRIC_ANCHORING_REQUIRED=false
FABRIC_ANCHOR_RETRY_SECONDS=30
FABRIC_GATEWAY_ENDPOINT=replace_with_fabric_peer_gateway_endpoint
FABRIC_MSP_ID=replace_with_fabric_msp_id
FABRIC_CHANNEL=inec-evidence
FABRIC_CHAINCODE=evidence-anchor
FABRIC_ENDORSING_MSPS=replace_with_endorsing_msp_list
FABRIC_SECRETS_DIR=replace_with_host_path_to_fabric_crypto_material
FABRIC_DOCKER_NETWORK=replace_with_fabric_docker_network

# Mojaloop settlement secrets mount (docker-compose.operational-settlement.yml)
MOJALOOP_SECRETS_DIR=replace_with_host_path_to_mojaloop_tls_material

# Neo4j graph database password (docker-compose.ml.yml; rust-inference and neo4j
# both fail closed without it)
NEO4J_PASSWORD=replace_with_a_strong_neo4j_password

# Portable/hybrid overlay (deploy/portable/docker-compose.hybrid.yml)
# Pin the published immutable images and the source revision they were built from.
INEC_FRONTEND_IMAGE=replace_with_published_immutable_ghcr_frontend_image
INEC_BACKEND_IMAGE=replace_with_published_immutable_ghcr_backend_image
PORTABLE_SOURCE_SHA=replace_with_checked_out_source_revision
INEC_PUBLIC_HOST=replace_with_public_inec_hostname
CAMPAIGN_PUBLIC_HOST=replace_with_public_campaign_hostname

# Age private key used by infra/dr/restore.sh to decrypt off-site backup archives
BACKUP_AGE_IDENTITY=replace_with_age_private_key_for_backup_decryption

# JSON array of consortium MSP IDs used by fabric/deploy/deploy-evidence-anchor.sh
FABRIC_CONSORTIUM_MSPS_JSON=replace_with_json_array_of_consortium_msp_ids

# --- Added (R4 mop-up): variables introduced by remediation Waves A-E ---

# GOTV service (cmd/gotv-svc, internal/gotv)
# Internal bearer token for GOTV service-to-service endpoints. Accepted as an
# alternative to INTERNAL_SERVICE_SECRET; at least one must be set or the
# service refuses to start (fail closed).
GOTV_INTERNAL_TOKEN=replace_with_a_strong_gotv_internal_token
# Shared secret used to verify Africa's Talking webhook signatures. Webhook
# routes return 503 until this is set. (AT_WEBHOOK_SECRET is a legacy alias.)
AFRICASTALKING_WEBHOOK_SECRET=replace_with_africastalking_webhook_secret
# Africa's Talking application username; required when GOTV dispatch provider
# is "africastalking".
AFRICASTALKING_USERNAME=replace_with_africastalking_app_username
# Dev-only escape hatch: when true (and NOT in production), GOTV dispatch logs
# messages instead of sending them. Must stay false in production.
GOTV_ALLOW_LOG_ADAPTER=false

# Data-retention worker (inec-go-backend/data_retention.go). Defaults shown;
# worker runs daily and purges rows older than the configured windows.
RETENTION_WORKER_ENABLED=true
RETENTION_DRY_RUN=false
RETENTION_BIOMETRIC_DAYS=365
RETENTION_AUDIT_DAYS=2555
RETENTION_SESSION_DAYS=90
RETENTION_TRACKING_DAYS=180
RETENTION_GEO_EVENT_DAYS=365
RETENTION_NOTIFICATION_DAYS=90
RETENTION_JOB_LOG_DAYS=90
RETENTION_CROWD_ALERT_DAYS=180
RETENTION_INCIDENT_DAYS=2555

# Biometric vault service (services/biometric-rust). Comma-separated rotation
# list of API tokens; accepted as an alias for BIOMETRIC_VAULT_API_KEY.
# Service fails closed when neither is configured.
VAULT_API_TOKEN=replace_with_a_strong_vault_api_token

# GOTV analytics service (services/gotv-analytics). Canonical alias for
# GOTV_ANALYTICS_API_KEY.
GOTV_ANALYTICS_TOKEN=replace_with_a_strong_gotv_analytics_token

# Pipeline optimizer service (services/python-pipeline-optimizer).
# Comma-separated API tokens; service fails closed (503) when unset.
PIPELINE_OPTIMIZER_API_TOKEN=replace_with_a_strong_pipeline_optimizer_api_token
# Opt-in Kafka consumer for the pipeline optimizer. Default off.
KAFKA_ENABLED=false

# Fabric result chaincode (inec-go-backend/blockchain_production.go). Set true
# ONLY after result-validation-cc is deployed on the approved channel; the
# backend refuses phantom invocations while false.
FABRIC_RESULT_CC_ENABLED=false

# Frontend map glyphs (inec-frontend MapPage). Optional override URL for the
# MapLibre glyphs endpoint; the built-in default preserves prior behavior.
VITE_MAP_GLYPHS_URL=https://replace_with_approved_map_glyphs_endpoint/{fontstack}/{range}.pbf
GOTV_MOBILE_JWT_SECRET=replace_with_a_secure_32_byte_secret_key
GOTV_ENCRYPTION_KEY=replace_with_a_32_byte_hex_encryption_key