.env.example

# Ghost Agent Platform - .env reference.
#
# setup.sh writes the real .env with the three required values below;
# this file only documents the optional overrides an operator can add.
# The platform rewrites its managed lines (domain, worker count,
# connector tokens) when instance settings change in the UI - lines you
# add here by hand are preserved as long as they aren't managed keys.

# --- written by setup.sh (required) ---

# Release version to deploy; all exo-* images share this tag. The
# in-app upgrade flow rewrites it.
TAG=

# Docker Hub OAT with Read access on the exo-* repositories. Used by
# the in-stack updater to poll for releases and fetch stack bundles.
EXO_UPDATER_OCI_AUTH_TOKEN=

# One-time claim token that unlocks the in-product setup wizard.
# Inert after setup completes; rotate with exo-reissue-claim-token if
# lost before claiming.
EXO_CLAIM_TOKEN=

# --- optional overrides ---

# Alternate registry (mirror/local). Must mirror the exo-* repo layout.
# REGISTRY=docker.io/ghostsecurityhq

# Pin the updater's own image tag independently of TAG so upgrades
# don't recreate the updater container mid-upgrade. Empty falls back
# to TAG.
# UPDATER_TAG=

# Operator-managed credential-wrapping key. When unset (the default),
# the platform generates one on first boot and persists it on the tls
# volume. Setting a value here always wins and is never written to
# disk. Rotating it invalidates every stored credential.
# ENCRYPTION_KEY=

# Session-signing secret. When unset, the platform generates and
# persists one on the tls volume. A value here seeds that file once
# (existing sessions survive the migration) and is ignored afterwards.
# EXO_JWT_SECRET=

# Seed admin support (legacy / air-gapped installs): add a
# [[seed.users]] block to config.toml and set the password here; the
# setup wizard then skips its admin step.
# EXO_SEED_ADMIN_PASSWORD=

# --- managed by the platform (do not edit by hand) ---
#
# These lines are rendered from the instance settings configured in
# the UI and rewritten on every settings change:
#   EXO_UI_ORIGIN, EXO_CALLBACK_BASE_URL, WORKER_REPLICAS,
#   SLACK_APP_TOKEN, SLACK_BOT_TOKEN, SLACK_SIGNING_SECRET,
#   EXO_UPDATER_ALLOW_PRERELEASE_TARGET