env.example

# Security Automation Gateway Environment Configuration
# Production: set CORS_ORIGINS to exact origins (no *), ALLOWED_HOSTS to API/gateway hostnames,
# and supply all secrets (SECRET_KEY, ENCRYPTION_KEY, SIGNING_KEY, GATEWAY_SERVICE_TOKEN, SETUP_TOKEN) from a secret store (e.g. K8s External Secrets). See docs/SECRETS_MANAGEMENT.md and docs/operational-runbook.md.

# Application Settings
APP_NAME=Security Automation Gateway
APP_VERSION=0.1.0
DEBUG=false
ENVIRONMENT=production

# Database Configuration
DATABASE_URL=postgresql://sag:sag@localhost:5432/sag
DB_POOL_SIZE=10
DB_MAX_OVERFLOW=20
DB_POOL_TIMEOUT=30
DB_POOL_RECYCLE=3600
DB_ECHO=false

# Redis Configuration
REDIS_URL=redis://localhost:6379/0
REDIS_MAX_CONNECTIONS=20
REDIS_SOCKET_TIMEOUT=5
REDIS_SOCKET_CONNECT_TIMEOUT=5

# Security Configuration
SECRET_KEY=your-secret-key-here-must-be-at-least-32-characters-long
# Generate: python -c "from cryptography.fernet import Fernet; print(Fernet.generate_key().decode())"
ENCRYPTION_KEY=your-encryption-key-here
SIGNING_KEY=your-signing-key-here
# D11: Optional. SECURITY_HEADERS_HSTS_MAX_AGE=31536000 to enable HSTS; SECURITY_HEADERS_CSP for Content-Security-Policy.
JWT_ALGORITHM=HS256
ACCESS_TOKEN_EXPIRE_MINUTES=30
REFRESH_TOKEN_EXPIRE_DAYS=7
SESSION_TIMEOUT_MINUTES=30

# Authentication Configuration
MAX_FAILED_ATTEMPTS=5
LOCKOUT_DURATION_MINUTES=60
PASSWORD_MIN_LENGTH=12
PASSWORD_REQUIRE_UPPERCASE=true
PASSWORD_REQUIRE_LOWERCASE=true
PASSWORD_REQUIRE_NUMBERS=true
PASSWORD_REQUIRE_SYMBOLS=true

# MFA Configuration
MFA_ISSUER=Security Automation Gateway
MFA_WINDOW=1
MFA_BACKUP_CODES_COUNT=10

# API Configuration
API_HOST=0.0.0.0
API_PORT=8001
API_WORKERS=1
API_RELOAD=false
API_LOG_LEVEL=info

# CORS Configuration (Production: set to exact origins, e.g. https://console.example.com,https://api.example.com)
CORS_ORIGINS=*
CORS_ALLOW_CREDENTIALS=true
CORS_ALLOW_METHODS=*
CORS_ALLOW_HEADERS=*

# Trusted Hosts Configuration (JSON array or comma-separated). Production: set to API/gateway hostnames (e.g. api.example.com,console.example.com).
ALLOWED_HOSTS=

# Gateway proxy: token used by gateway when calling backends (service-to-service). Must be set in production.
GATEWAY_SERVICE_TOKEN=

# One-time setup: token required to call POST /auth/setup to create first admin. Set in new environments only; long random value.
SETUP_TOKEN=

# Rate Limiting Configuration
RATE_LIMIT_ENABLED=true
RATE_LIMIT_REQUESTS=100
RATE_LIMIT_WINDOW=60
RATE_LIMIT_PER_USER=1000

# Audit Configuration
AUDIT_ENABLED=true
AUDIT_RETENTION_DAYS=2555
AUDIT_ENCRYPTION_ENABLED=true
AUDIT_SIGNING_ENABLED=true

# SIEM Configuration
SIEM_ENABLED=true
SIEM_WEBHOOK_URL=
SIEM_KAFKA_BROKERS=
SIEM_KAFKA_TOPIC=sag-audit-events

# Monitoring Configuration
MONITORING_ENABLED=true
PROMETHEUS_PORT=9090
HEALTH_CHECK_INTERVAL=30

# Logging Configuration
LOG_LEVEL=INFO
LOG_FORMAT=json
LOG_FILE=
LOG_ROTATION=true
LOG_MAX_SIZE=10485760
LOG_BACKUP_COUNT=5

# External Services
VAULT_URL=
VAULT_TOKEN=your-vault-token-here
VAULT_MOUNT_POINT=kv

# OAuth2 Configuration
OAUTH2_CLIENT_ID=
OAUTH2_CLIENT_SECRET=
OAUTH2_AUTHORIZATION_URL=
OAUTH2_TOKEN_URL=
OAUTH2_USERINFO_URL=

# SAML Configuration
SAML_ENABLED=false
SAML_ENTITY_ID=
SAML_SSO_URL=
SAML_SLO_URL=
SAML_CERTIFICATE=