.env.example

# A long random secret used to sign sessions and tokens (min 32 characters)
STACKABLE_COCKPIT_SESSION_SECRET=change-me-to-a-long-random-secret-min-32-chars

# The publicly accessible base URL of this application
STACKABLE_COCKPIT_BASE_URL=http://localhost:5173

# OIDC discovery URL (Keycloak, Entra ID, or any compliant OIDC provider)
STACKABLE_COCKPIT_OIDC_DISCOVERY_URL=https://your-idp.example.com/realms/your-realm/.well-known/openid-configuration

# The client ID and secret registered in your OIDC provider
STACKABLE_COCKPIT_OIDC_CLIENT_ID=stackable-cockpit
STACKABLE_COCKPIT_OIDC_CLIENT_SECRET=your-client-secret

# OIDC claim used as the Trino user for impersonation (default: preferred_username)
# STACKABLE_COCKPIT_TRINO_USER_CLAIM=preferred_username

# Extra OIDC scopes to request in addition to the defaults (openid profile email),
# space- or comma-separated. Use when the username/authorisation claim is only
# released by your IdP under a custom scope.
# STACKABLE_COCKPIT_OIDC_EXTRA_SCOPES=groups roles


# Logging
# LOG_LEVEL=debug    # Minimum log level (debug, info, warn, error). Default: debug in dev, info in prod.
# LOG_PRETTY=true    # Human-readable log output. Default: true in dev, false in prod.
# LOG_JSON_FILE=/var/log/stackable-cockpit/app.log  # Optional: also write JSON logs to this file (for Vector aggregation).

# Optional: Pre-configure the Trino connection for all users.
# When STACKABLE_COCKPIT_TRINO_URL is set, the connection form is hidden and
# the specified Trino endpoint is used automatically. By default the logged-in
# user is forwarded to Trino as X-Trino-User (impersonation via the OIDC username).
# STACKABLE_COCKPIT_TRINO_URL=https://trino.example.com:8443
# STACKABLE_COCKPIT_TRINO_AUTH_TYPE=basic       # "none" (default) or "basic"
# STACKABLE_COCKPIT_TRINO_AUTH_USERNAME=service-account
# STACKABLE_COCKPIT_TRINO_AUTH_PASSWORD=secret
# STACKABLE_COCKPIT_TRINO_USER_IMPERSONATION=false  # Disable impersonation: run all queries as the auth user (requires basic auth). Default: true
# STACKABLE_COCKPIT_TRINO_TLS_INSECURE=false    # Set to "true" to skip TLS certificate verification
# STACKABLE_COCKPIT_TRINO_TLS_CA_CERT=/path/to/ca.pem  # Custom CA certificate file

# Feature flags
# STACKABLE_COCKPIT_COMPLETION_ENABLED=false    # Disable SQL editor code completion (default: true)
# STACKABLE_COCKPIT_STORAGE_BROWSER_ENABLED=true  # Enable S3/HDFS file browser (default: false)
# PUBLIC_STACKABLE_COCKPIT_UPLOAD_CONCURRENCY=3  # Maximum number of concurrent file uploads (default: 3)