reckon/.env.example at main · piyush-gambhir/reckon · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
# Folder-local credentials loaded by direnv when you enter this repo.
# This workspace is intended for PRODUCTION only.
# Copy this file to .env or .env.local and fill in real values.
#
# NOTE: .envrc loads this file by *sourcing* it as shell (set -a; . .env).
# Any value containing shell metacharacters (& ; $ space ` " ') MUST be
# single-quoted, or the shell will mangle or execute it. When in doubt, quote.

# Grafana
GRAFANA_URL=https://grafana.example.com
GRAFANA_TOKEN=replace_me

# Jenkins
JENKINS_URL=https://jenkins.example.com
JENKINS_USER=readonly-bot
JENKINS_TOKEN=replace_me

# CubeAPM
CUBEAPM_SERVER=cube.example.com
# Optional alias if you prefer storing a full URL instead of a bare host.
# CUBEAPM_HOST=https://cube.example.com
CUBEAPM_EMAIL=user@example.com
CUBEAPM_PASSWORD=replace_me

# Optional CubeAPM ports when your deployment differs from the defaults.
# CUBEAPM_QUERY_PORT=3140
# CUBEAPM_INGEST_PORT=3130
# CUBEAPM_ADMIN_PORT=3199

# AWS — read-only IAM user or SSO-assumed role recommended.
# Either drop credentials here or run `aws configure` and they'll land in
# .config/aws/ (because .envrc points AWS_CONFIG_FILE and
# AWS_SHARED_CREDENTIALS_FILE inside the workspace).
AWS_ACCESS_KEY_ID=replace_me
AWS_SECRET_ACCESS_KEY=replace_me
AWS_REGION=ap-south-1
# AWS_SESSION_TOKEN=replace_me           # only when using SSO / STS
# AWS_PROFILE=rca-readonly               # only if you use a named profile

# GitHub CLI — fine-grained PAT with repo:read + actions:read is enough.
# .config/gh/ is workspace-local because gh respects XDG_CONFIG_HOME.
GH_TOKEN=replace_me
# GITHUB_TOKEN=replace_me                # alias; .envrc maps it to GH_TOKEN
# GH_HOST=github.com                     # set for GitHub Enterprise

# Kafka — used by kcat (metadata + tail) and rpk (consumer-group lag).
# Neither binary reads KAFKA_* natively: kcat takes everything via -b/-X flags
# (the documented commands interpolate these vars), and rpk reads RPK_* vars —
# .envrc derives RPK_BROKERS / RPK_SASL_* from the KAFKA_* values below.
#
# SAFETY: kcat/rpk have no read-only mode, so this principal SHOULD be
# read-only at the broker — ACLs limited to Describe/Read (MSK IAM: Connect +
# Describe* + ReadData; no WriteData/Create*/Delete*/Alter*). And never consume
# with a group id (-G / -g): joining a production consumer group rebalances it.
KAFKA_BOOTSTRAP_SERVERS=broker1.example.com:9092,broker2.example.com:9092
KAFKA_SECURITY_PROTOCOL=SASL_SSL
KAFKA_SASL_MECHANISM=SCRAM-SHA-512
KAFKA_SASL_USERNAME=rca-readonly
KAFKA_SASL_PASSWORD=replace_me
# For MSK with IAM auth, swap the two lines above for:
# KAFKA_SECURITY_PROTOCOL=SASL_SSL
# KAFKA_SASL_MECHANISM=AWS_MSK_IAM
# (and ensure the AWS_* vars above resolve to a role with kafka-cluster:Describe*)

# Kubernetes — kubectl reads KUBECONFIG, which .envrc pins to .config/kube/config.
# Seed it once per cluster (uses the AWS_* credentials above for EKS):
#   aws eks update-kubeconfig --name <cluster-name> --region $AWS_REGION
# EKS_CLUSTER_NAME=prod-cluster                 # convenience for the command above

# Redis — redis-cli connects via -u "$REDIS_URL". Read-only usage by convention:
# stick to INFO / SLOWLOG GET / LATENCY / DBSIZE / SCAN; never FLUSH*/SET/DEL.
# REDIS_URL='rediss://:password@redis.example.com:6380/0'

# Elasticsearch / ELK (optional) — only if some services log to ES instead of
# CubeAPM. es-cli reads these natively. .envrc exports ES_READ_ONLY=true, which
# the CLI enforces client-side (mutating commands refused) — still pair it with
# a read-only ES role/API key.
# ES_URL=https://elasticsearch.example.com:9200
# ES_USERNAME=rca-readonly
# ES_PASSWORD=replace_me
# (or API-key auth instead of basic:)
# ES_API_KEY_ID=replace_me
# ES_API_KEY=replace_me

# ClickHouse — analytics/event tables and ClickHouse system tables; activates when CLICKHOUSE_HOST is set.
# Only wired when CLICKHOUSE_HOST is set. The user MUST have a server-side
# profile with readonly=1 (the real write barrier), and every client invocation
# must also include --readonly=1. CLICKHOUSE_PORT and CLICKHOUSE_SECURE default
# to 9440 (TLS native protocol) and 1 in .envrc / scripts/activate.ps1.
# CLICKHOUSE_HOST=clickhouse.example.com
# CLICKHOUSE_PORT=9440
# CLICKHOUSE_USER=rca-readonly
# CLICKHOUSE_PASSWORD=replace_me
# CLICKHOUSE_DATABASE=analytics              # optional
# CLICKHOUSE_SECURE=1

# ---------------------------------------------------------------------------
# LLM / agent runtime (optional — pick ONE billing path per runtime)
#
#   Claude Code:  subscription login (`claude` → /login) needs NO key here.
#                 API-key billing: set ANTHROPIC_API_KEY.
#   Codex CLI:    ChatGPT-subscription login (`codex login`) needs NO key here.
#                 API-key billing: set OPENAI_API_KEY.
#
# scripts/agent.sh launches whichever runtime you pass (or auto-detects).
# ---------------------------------------------------------------------------
# ANTHROPIC_API_KEY=replace_me
# OPENAI_API_KEY=replace_me

# ---------------------------------------------------------------------------
# Database read-only access — for *debugging* production state.
#
#   SAFETY CONTRACT (read this once):
#   1. Each DB user named below MUST be a true read-only role at the database.
#      The CLI is your *last* line of defence, not your first.
#   2. .envrc exports PGOPTIONS=-c default_transaction_read_only=on, which
#      libpq (psql) honours as the *session default* — it blocks accidental
#      writes but a session can still opt back in via BEGIN READ WRITE, so the
#      read-only role (item 1) remains the real guard. The mysql client has no
#      equivalent env var: .envrc writes a workspace option file and you invoke
#      mysql via `mysql --defaults-extra-file="$XDG_CONFIG_HOME/mysql/my.cnf"`
#      (or pass --init-command="SET SESSION TRANSACTION READ ONLY" explicitly).
#   3. Mongo's defence is the role + ?readPreference=secondary in the URI
#      (routing, not a write block — the role is what denies writes).
#   4. The agent's allowlist intentionally does NOT pre-approve psql/mysql/
#      mongosh — every query prompts for permission. That friction is the point.
# ---------------------------------------------------------------------------

# MongoDB (Atlas-style URI; user MUST be a read-only DB user).
# MUST be single-quoted: the URI contains '&', which the shell would otherwise
# treat as a background operator, silently dropping the variable.
MONGODB_URI=replace_me

# PostgreSQL (single primary cluster; multi-cluster setups can prefix vars).
PGHOST=db.example.com
PGPORT=5432
PGUSER=rca_readonly
PGPASSWORD=replace_me
PGDATABASE=app_production
PGSSLMODE=require
# PGOPTIONS is set in .envrc by default — override here only if you must.

# MySQL (single primary; same multi-cluster note as Postgres).
# The mysql client reads only MYSQL_HOST, MYSQL_TCP_PORT and MYSQL_PWD from the
# environment. MYSQL_USER and MYSQL_DATABASE are NOT client env vars — .envrc
# folds them (plus the read-only init-command) into a workspace option file at
# $XDG_CONFIG_HOME/mysql/my.cnf. Invoke the client with:
#   mysql --defaults-extra-file="$XDG_CONFIG_HOME/mysql/my.cnf"
MYSQL_HOST=db.example.com
MYSQL_TCP_PORT=3306
MYSQL_USER=rca_readonly
MYSQL_PWD=replace_me
MYSQL_DATABASE=app_production