.env.example

# TRAM Environment Variables
# Copy this to .env and fill in your values
#
# This file lists all supported TRAM environment variables.
# Most have sensible defaults; only uncomment and set values you need to override.

# ══════════════════════════════════════════════════════════════════════════════
# SERVER & NETWORKING
# ══════════════════════════════════════════════════════════════════════════════

# API server bind address (use 0.0.0.0 for all interfaces)
TRAM_HOST=0.0.0.0

# API server port
TRAM_PORT=8765

# Number of Uvicorn worker processes
# TRAM_WORKERS=1

# ══════════════════════════════════════════════════════════════════════════════
# PIPELINES & STATE
# ══════════════════════════════════════════════════════════════════════════════

# Directory scanned for pipeline YAMLs at startup
TRAM_PIPELINE_DIR=./pipelines

# Optional shared runtime state root (advanced; feature-specific directories
# such as DB, schemas, and MIB stores still take precedence)
# TRAM_STATE_DIR=

# SQLite database path (when TRAM_DB_URL is not set)
# Leave empty/commented to use ~/.tram/tram.db
# TRAM_DB_PATH=~/.tram/tram.db

# Auto-load pipelines from TRAM_PIPELINE_DIR at daemon startup
# TRAM_RELOAD_ON_START=true

# Watch TRAM_PIPELINE_DIR for YAML changes and auto-reload (requires tram[watch])
# TRAM_WATCH_PIPELINES=false

# ══════════════════════════════════════════════════════════════════════════════
# DATABASE
# ══════════════════════════════════════════════════════════════════════════════

# SQLAlchemy database URL (leave empty for default SQLite at ~/.tram/tram.db)
# Examples:
#   SQLite:     sqlite:////data/tram.db
#   PostgreSQL: postgresql+psycopg2://tram:secret@postgres:5432/tramdb
#   MySQL:      mysql+pymysql://tram:secret@mysql:3306/tramdb
# TRAM_DB_URL=

# ══════════════════════════════════════════════════════════════════════════════
# LOGGING
# ══════════════════════════════════════════════════════════════════════════════

# Log level: DEBUG | INFO | WARNING | ERROR
TRAM_LOG_LEVEL=INFO

# Log format: json | text
TRAM_LOG_FORMAT=json

# ══════════════════════════════════════════════════════════════════════════════
# CLI PROXY
# ══════════════════════════════════════════════════════════════════════════════

# Daemon URL used by CLI proxy commands (tram pipeline list, etc.)
TRAM_API_URL=http://localhost:8765

# ══════════════════════════════════════════════════════════════════════════════
# DEPLOYMENT MODE (v1.2.0)
# ══════════════════════════════════════════════════════════════════════════════

# Deployment mode: standalone (default) | manager | worker
# standalone — all-in-one daemon (scheduler + DB + UI). Default for single-pod installs.
# manager    — owns scheduling, DB, and UI; dispatches runs to worker pods.
# worker     — stateless executor; receives run requests from manager, no DB, no UI.
# TRAM_MODE=standalone

# Node identifier (defaults to hostname / pod name in Kubernetes)
# TRAM_NODE_ID=

# Advanced Kubernetes namespace override used for per-pipeline Service
# management when downward-API/service-account detection is unavailable
# TRAM_POD_NAMESPACE=default

# ── Manager → Worker routing (set on manager pod) ─────────────────────────
# Explicit worker agent URLs (optional; overrides replica-based DNS discovery)
# Example: TRAM_WORKER_URLS=http://w0:8766,http://w1:8766
# TRAM_WORKER_URLS=

# Number of worker replicas in the StatefulSet
# 0 disables replica-based discovery; set >0 to enable headless-DNS worker discovery
# TRAM_WORKER_REPLICAS=0

# Headless Service name for worker pods (used to build DNS: <name>-N.<svc>.<ns>.svc.cluster.local)
# TRAM_WORKER_SERVICE=tram-worker

# Kubernetes namespace where workers run
# TRAM_WORKER_NAMESPACE=default

# Port that worker pods listen on (default 8766)
# TRAM_WORKER_PORT=8766

# Public ingress port that worker pods listen on for /webhooks/* push traffic (default 8767)
# TRAM_WORKER_INGRESS_PORT=8767

# ── Worker → Manager callback (set on worker pod) ─────────────────────────
# Base URL of the manager service; workers POST run results here
# TRAM_MANAGER_URL=http://tram:8765

# Explicit worker identifier reported to the manager and /agent/* APIs
# (worker mode only; defaults to hostname / pod name)
# TRAM_WORKER_ID=

# Base directory for worker-synced schemas and custom MIBs (worker mode only).
# If you change this, keep TRAM_SCHEMA_DIR and TRAM_MIB_DIR under the same root.
# TRAM_DATA_DIR=/data

# Seconds between worker periodic stats reports (default 30)
# Also controls stale-slot detection and reconcile timing in manager mode
# TRAM_STATS_INTERVAL=30

# Seconds to wait for in-flight runs to complete before forced shutdown
# TRAM_SHUTDOWN_TIMEOUT_SECONDS=30

# ══════════════════════════════════════════════════════════════════════════════
# AUTHENTICATION & SECURITY
# ══════════════════════════════════════════════════════════════════════════════

# API key for /api/* endpoints (empty = auth disabled)
# Clients pass via X-API-Key header or ?api_key= query param
# Exempt: /api/health, /api/ready, /metrics, /webhooks/*, /ui/*, /
# TRAM_API_KEY=

# Browser UI authentication (v1.0.8)
# Comma-separated user:password pairs for bootstrap login
# After a password is changed with TRAM_DB_URL enabled, the DB-stored scrypt hash overrides this env value
# Example: TRAM_AUTH_USERS=admin:admin123,operator:operator123
# TRAM_AUTH_USERS=

# Shared HMAC secret for session token signing (REQUIRED in cluster mode)
# Generate with: openssl rand -base64 32
# TRAM_AUTH_SECRET=

# Rate limiting: max requests per minute per IP (0 = disabled)
# TRAM_RATE_LIMIT=0

# Rate limit sliding window in seconds
# TRAM_RATE_LIMIT_WINDOW=60

# ══════════════════════════════════════════════════════════════════════════════
# TLS / HTTPS (v1.0.0)
# ══════════════════════════════════════════════════════════════════════════════

# Path to TLS certificate file
# TRAM_TLS_CERTFILE=

# Path to TLS key file
# TRAM_TLS_KEYFILE=

# ══════════════════════════════════════════════════════════════════════════════
# SMTP (for email alert actions)
# ══════════════════════════════════════════════════════════════════════════════

# SMTP server hostname
# TRAM_SMTP_HOST=localhost

# SMTP server port (587 for STARTTLS, 465 for SSL, 25 for plain)
# TRAM_SMTP_PORT=587

# SMTP username (leave empty for anonymous)
# TRAM_SMTP_USER=

# SMTP password
# TRAM_SMTP_PASS=

# Use STARTTLS (true) or plain SMTP (false)
# TRAM_SMTP_TLS=true

# Sender address for alert emails
# TRAM_SMTP_FROM=tram@localhost

# ══════════════════════════════════════════════════════════════════════════════
# OPENTELEMETRY TRACING (v1.0.0)
# ══════════════════════════════════════════════════════════════════════════════

# OTLP gRPC endpoint for traces (requires tram[otel])
# Example: http://jaeger:4317
# TRAM_OTEL_ENDPOINT=

# Service name reported to OTel collector
# TRAM_OTEL_SERVICE=tram

# ══════════════════════════════════════════════════════════════════════════════
# SNMP MIB MANAGEMENT (v1.0.3)
# ══════════════════════════════════════════════════════════════════════════════

# Directory containing compiled pysnmp MIB .py files
# Standard compiled MIBs (IF-MIB, ENTITY-MIB, etc.) are baked into the Docker image
# TRAM_MIB_DIR=/mibs

# Directory containing persisted raw ASN.1 MIB source files uploaded/downloaded at runtime
# Defaults to a sibling "mib-sources" directory next to TRAM_MIB_DIR
# TRAM_MIB_SOURCE_DIR=/mib-sources

# Read-only bundled ASN.1 MIB source directories used during compile/dependency
# resolution. Separate multiple paths with ':' on Unix-like systems.
# TRAM_MIB_BUNDLED_SOURCE_DIR=/mib-sources

# ══════════════════════════════════════════════════════════════════════════════
# SCHEMA MANAGEMENT (v1.0.3)
# ══════════════════════════════════════════════════════════════════════════════

# Directory containing serialization schema files (.proto, .avsc, .asn, .xsd)
# Managed via POST /api/schemas/upload
# TRAM_SCHEMA_DIR=/schemas

# ══════════════════════════════════════════════════════════════════════════════
# SCHEMA REGISTRY (v1.0.4)
# ══════════════════════════════════════════════════════════════════════════════

# External Confluent-compatible schema registry base URL
# Enables /api/schemas/registry/* proxy and serves as default for Avro/Protobuf
# TRAM_SCHEMA_REGISTRY_URL=

# Schema registry basic auth username (used as default in pipelines)
# TRAM_SCHEMA_REGISTRY_USERNAME=

# Schema registry basic auth password (used as default in pipelines)
# TRAM_SCHEMA_REGISTRY_PASSWORD=

# ══════════════════════════════════════════════════════════════════════════════
# UI CONFIGURATION (v1.0.7)
# ══════════════════════════════════════════════════════════════════════════════

# Directory containing built tram-ui static assets
# Set to empty string to disable web UI without rebuilding image
# TRAM_UI_DIR=/ui

# Directory containing bundled pipeline templates
# TRAM_TEMPLATES_DIR=/tram-templates

# ══════════════════════════════════════════════════════════════════════════════
# AI ASSIST (v1.1.0)
# ══════════════════════════════════════════════════════════════════════════════

# AI provider: anthropic | openai | bedrock
# TRAM_AI_PROVIDER=anthropic

# API key for AI provider (leave empty to disable AI assist)
# TRAM_AI_API_KEY=

# Model name (provider defaults: claude-haiku-4-5-20251001, gpt-4o-mini,
# or us.anthropic.claude-sonnet-4-6)
# TRAM_AI_MODEL=

# Optional base URL override for the selected provider endpoint
# TRAM_AI_BASE_URL=

# ══════════════════════════════════════════════════════════════════════════════
# CONNECTOR-SPECIFIC CREDENTIALS
# ══════════════════════════════════════════════════════════════════════════════
# These are referenced in pipeline YAMLs via ${VAR} substitution.
# Add your connector credentials here.

# ── Source SFTP (Network Element) ─────────────────────────────────────────────
NE_SFTP_HOST=10.0.0.1
NE_SFTP_PORT=22
NE_SFTP_USER=pmuser
NE_SFTP_PASS=

# ── Sink SFTP (Mediation Server) ──────────────────────────────────────────────
MED_SFTP_HOST=10.0.0.2
MED_SFTP_PORT=22
MED_SFTP_USER=meduser
MED_SFTP_PASS=