# Single source of truth for the project's static defaults.
#
# Every key here is copied verbatim into the generated `.env` by
# `make dotenv` (which delegates to `python -m cli.meta.env`), together
# with the dynamic runtime-resolved values (distro, GHA flags,
# df/meminfo-derived sizes, sha256 secrets, repository owner, ...).
#
# Override at generation time by exporting the variable before running
# `make dotenv` -- already-set env vars take precedence over the
# defaults below.
#
# Convention: every key is preceded by a single-line `# ...` comment
# that explains what the value is for. The generator preserves the
# comments when materialising `.env`.

# Git repository holding the operator's terminal aliases (an `aliases` file at repo root); developers override this with their own repo.
INFINITO_ALIAS_REPOSITORY=https://github.com/kevinveenbirkenbach/alias

# Requirements file scripts/install/ansible.sh tries first, `galaxy` or `git`; the other one stays the fallback.
INFINITO_ANSIBLE_COLLECTIONS_SOURCE=git

# Anthropic API key the development inventory feeds into API.anthropic.api_key; empty leaves the anthropic routes unpublished.
INFINITO_API_ANTHROPIC_KEY=""

# OpenAI API key the development inventory feeds into API.openai.api_key; empty leaves the openai routes unpublished.
INFINITO_API_OPENAI_KEY=""

# OpenRouter API key the development inventory feeds into API.openrouter.api_key; empty leaves openrouter/auto unpublished.
INFINITO_API_OPENROUTER_KEY=""

# Where scripts/meta/resolve/apps.sh runs the meta-CLI: host | docker.
INFINITO_APP_DISCOVERY_RUNNER=docker

# Per-app variant index map for credential generation, set per round by the swarm matrix orchestrator; empty elsewhere.
INFINITO_APP_VARIANTS=

# Ubuntu mirrors in failover order for image apt; the package-cache takes the first as primary, the second as fallback.
INFINITO_APT_UBUNTU_MIRRORS="http://de.archive.ubuntu.com/ubuntu/ http://ftp.fau.de/ubuntu/ http://ftp.halifax.rwth-aachen.de/ubuntu/ http://archive.ubuntu.com/ubuntu/"

# Host interface(s) the compose stack binds published ports to.
INFINITO_BIND_IP=127.0.0.1

# Optional app-discovery exclusion filter consumed by scripts/meta/resolve/apps.sh and the GHA workflows.
INFINITO_BLACKLIST=

# `1` builds the local image; `0` skips the build and pulls the published image (CI overrides via -e INFINITO_BUILD=0).
INFINITO_BUILD=1

# `1` keeps BuildKit on (default); `0` forces the compose wrapper to use the legacy builder.
INFINITO_BUILDKIT_ENABLED=1

# External docker network carrying the shared cache stack; empty on the primary instance, which owns the stack itself.
INFINITO_CACHE_NETWORK=

# Host directory holding the package-cache frontend CA materials.
INFINITO_CACHE_PACKAGE_FRONTEND_CA_DIR=/var/cache/infinito/core/cache/package/frontend/ca

# CA certificate file produced under INFINITO_CACHE_PACKAGE_FRONTEND_CA_DIR.
INFINITO_CACHE_PACKAGE_FRONTEND_CA_FILE=/var/cache/infinito/core/cache/package/frontend/ca/ca.crt

# Host directory holding the package-cache frontend TLS certificates.
INFINITO_CACHE_PACKAGE_FRONTEND_CERTS_DIR=/var/cache/infinito/core/cache/package/frontend/certs

# Init image used by the package-cache frontend cert-gen wrapper to run cert-gen.sh.
INFINITO_CACHE_PACKAGE_FRONTEND_INIT_IMAGE=alpine:latest

# Static IPv4 address the package-cache frontend takes on the docker bridge.
INFINITO_CACHE_PACKAGE_FRONTEND_IP=172.30.0.4

# Host directory backing the Nexus 3 package-cache blobstore.
INFINITO_CACHE_PACKAGE_HOST_PATH=/var/cache/infinito/core/cache/package/data

# Static IPv4 address the Nexus package-cache takes on the docker bridge.
INFINITO_CACHE_PACKAGE_IP=172.30.0.5

# Content freshness window (minutes) for immutable cached artifacts (wheels, debs, rpms). 8640 = 6 days.
INFINITO_CACHE_PACKAGE_MAX_AGE_MIN=8640

# Metadata + negative-cache window (minutes) for indexes / not-found lookups. 0 = always revalidate so new versions show at once.
INFINITO_CACHE_PACKAGE_METADATA_MAX_AGE_MIN=0

# Bind-mounted .npmrc fragment for the package-cache frontend.
INFINITO_CACHE_PACKAGE_NPMRC=./compose/package-cache/npmrc

# Bind-mounted pip.conf fragment for the package-cache frontend.
INFINITO_CACHE_PACKAGE_PIP_CONF=./compose/package-cache/pip.conf

# Host port the Nexus 3 package cache binds to on BIND_IP.
INFINITO_CACHE_PACKAGE_PORT=8081

# Host directory holding the registry-cache CA materials.
INFINITO_CACHE_REGISTRY_CA_HOST_PATH=/var/cache/infinito/core/cache/registry/ca

# Host directory backing the docker registry-mirror cache (bind mount).
INFINITO_CACHE_REGISTRY_HOST_PATH=/var/cache/infinito/core/cache/registry/mirror

# Static IPv4 of the registry-cache; resolved via extra_hosts since coredns can't resolve the container name.
INFINITO_CACHE_REGISTRY_IP=172.30.0.6

# Bind-mounted registry-cache proxy configuration consumed by the cache container.
INFINITO_CACHE_REGISTRY_PROXY_CONF=./compose/registry-cache/proxy.conf

# True where a persistent pull-through cache stack pays off (local dev).
INFINITO_CACHE_STACK=true

# Index of the deploy chunk the discovery emits; each chunk block of call-orchestrator.yml passes its own.
INFINITO_CI_CHUNK=0

# Rows one deploy chunk holds, overriding the concurrency-times-waves derivation; 0 derives it.
INFINITO_CI_CHUNK_SIZE=0

# Runner slots a deploy chunk may assume are free; with the job timeout it sizes a chunk in cli.meta.ci.slots.
INFINITO_CI_CONCURRENCY=20

# Budget distros.sh spends before skipping the rest; stays under the 350-min step cap, which stays under the 355-min job cap.
INFINITO_CI_DISTRO_BUDGET_SECONDS=20400

# Job budget per workflow run cli.meta.ci.slots spends on the deploy chunks (GitHub matrix cap: 256).
INFINITO_CI_JOB_LIMIT=256

# Chunk job blocks call-orchestrator.yml declares; one above what the budget fills, so a short priority chunk strands no row.
INFINITO_CI_MAX_CHUNKS=4

# Regular rows a run skips before filling its chunks; a count or a selection token, 0 starts at the head of the ranking.
INFINITO_CI_OFFSET=0

# Hours a job may sit queued before GitHub cancels it; the ceiling a single chunk's waves must start within.
INFINITO_CI_QUEUE_HOURS=24

# Sweep number driving the deploy mode/tor rotation; CI passes the run number.
INFINITO_CI_SWEEP=0

# Compose service container name; generator overrides as infinito_nexus_${INFINITO_DISTRO}.
INFINITO_CONTAINER=infinito_nexus_debian

# `1` (default) keeps CA injection on in the container wrapper; `0` skips it.
INFINITO_CONTAINER_CA_ENABLED=1

# cpus cap applied to the infinito container; 0 means "unlimited".
INFINITO_CPUS=0

# Truthy enables debug behavior in the local deploy flows.
INFINITO_DEBUG=true

# Deploy mode the discovery matrix targets (compose|swarm) for per-mode services.yml skip; empty disables it.
INFINITO_DEPLOY_MODE=

# Seed the discovery sort's tie-breaker derives from; empty draws it per process, so the rendered plan can differ from the deploy.
INFINITO_DISCOVERY_SEED=

# Sort spec the CI app-discovery (scripts/meta/resolve/apps.sh) orders roles by; the order decides which rows a chunk takes first.
INFINITO_DISCOVERY_SORT="asc clone,asc covered_by,desc integrated,desc embeds,desc consumers,asc variant,asc random"

# Distro the build/test matrix is currently iterating over (generator may override).
INFINITO_DISTRO=debian

# Domain the host-side DNS-fallback / dnsmasq config wires up (consumed by scripts/system/network/dns/).
INFINITO_DNS_DOMAIN=infinito.test

# Path to the hosts file the DNS-fallback installer writes the BEGIN/END block into.
INFINITO_DNS_HOSTS_FILE=/etc/hosts

# IPv4 of the CoreDNS sidecar inside INFINITO_SUBNET; CI/dev default, overridden in real deploys.
INFINITO_DNS_IP=172.30.0.53

# Repo-relative path of the docker CLI install script.
INFINITO_DOCKER_CLI_INSTALL_SCRIPT=roles/sys-svc-container/files/shell/install-cli.sh

# Filesystem the docker data root runs on; empty until scripts/tests/deploy/utils/filesystem/resolve.sh settles the row's kind.
INFINITO_DOCKER_FILESYSTEM=

# Space-separated subset of ext4/btrfs/zfs the pick may use; empty draws from all three.
INFINITO_DOCKER_FILESYSTEM_ALLOWED=

# `true` when a human named the pick, so it binds: a host that cannot deliver it fails instead of falling back.
INFINITO_DOCKER_FILESYSTEM_ENFORCED=

# The filesystem the deploy matrix assigned one row; empty draws from INFINITO_DOCKER_FILESYSTEM_ALLOWED.
INFINITO_DOCKER_FILESYSTEM_PICK=

# `true` when the pick binds, because a human named it or nothing permitted is servable; the applying step then fails instead of declining.
INFINITO_DOCKER_FILESYSTEM_REQUIRED=

# Mount point inside the infinito container where INFINITO_DOCKER_VOLUME lands.
INFINITO_DOCKER_MOUNT=/var/lib/docker

# Docker volume backing /var/lib/docker; generator overrides to /mnt/docker on GHA.
INFINITO_DOCKER_VOLUME=docker

# Top-level project domain rendered into vhost/cert/test fixtures; CI/dev default, overridden in real deploys.
INFINITO_DOMAIN=infinito.test

# Repo-relative path of the filesystem userland install script (ext4, btrfs, zfs).
INFINITO_FILESYSTEM_INSTALL_SCRIPT=scripts/install/filesystem.sh

# Repository name of the operator's fork; composed into INFINITO_FORK_REPOSITORY_URL by utils/env/handlers/infinito/fork_repository_url.py.
INFINITO_FORK_REPOSITORY_NAME=infinito-nexus-core

# IPv4 of the bridge gateway inside INFINITO_SUBNET.
INFINITO_GATEWAY=172.30.0.1

# True where images come from the GHCR mirror instead of their upstream registry (real GitHub Actions).
INFINITO_GHCR_MIRROR=false

# Prefix path under which GHCR mirror lookups search for cached images.
INFINITO_GHCR_MIRROR_PREFIX=mirror

# Shared .git directory a worktree checkout points at; empty on the primary instance, which carries its own.
INFINITO_GIT_COMMON_DIR=

# Image tag used to address the published infinito image (CI publishes 'latest' on push).
INFINITO_IMAGE_TAG=latest

# Slot index isolating a parallel checkout: 0 owns the cache stack, 1..255 shift subnet, bind IP and container names.
INFINITO_INSTANCE=0

# Repo-relative path of the PHP/Ruby unit-suite toolchain install script.
INFINITO_INTERPRETERS_INSTALL_SCRIPT=scripts/install/interpreters.sh

# Optional JSON object merged into the generated dev-inventory vars.
INFINITO_INVENTORY_EXTRA_VARS=

# Repo-relative path to the Ansible vars file `infinito administration inventory provision --vars-file <...>` consumes.
INFINITO_INVENTORY_VARS_FILE=inventories/development/default.yml

# IPv4 of the infinito application container inside INFINITO_SUBNET; CI/dev default, overridden in real deploys.
INFINITO_IP4=172.30.0.10

# IPv6 loopback / public address the playbook's `internet` network defaults to when no host_var pin is set.
INFINITO_IP6=::1

# Dynamic IPAM pool: upper half of INFINITO_SUBNET, derived after custom.env; every static IP sits below it.
INFINITO_IP_RANGE=172.30.0.128/25

# True when /proc/version identifies the host as WSL2; generator overrides via runtime detection.
INFINITO_IS_WSL2=false

# Keep act-swarm test cluster alive after the workflow for post-mortem inspection.
INFINITO_KEEP_SWARM_NODES=false

# Lifecycle envelope the CI test-deploy discovery exercises (scripts/meta/resolve/apps.sh --lifecycles); comma/space-separated.
INFINITO_LIFECYCLES="alpha beta rc stable maintenance"

# Ansible limit pattern for local deploys.
INFINITO_LIMIT_HOST=localhost

# Where scripts/lint/wrapper.sh executes 'make lint*' / 'make autoformat': host | docker.
INFINITO_LINT_RUNNER=docker

# Public FQDN of a reachable mail server; when set, the provider asserts its live DNS/TLS/SMTP hard facts. Empty disables the check.
INFINITO_MAIL_PRODUCTION_HOST=

# Resolver the production mail-facts check queries (e.g. 1.1.1.1 for the public view); empty uses /etc/resolv.conf.
INFINITO_MAIL_PRODUCTION_RESOLVER=


# memswap_limit cap applied to the infinito container; 0 means "unlimited".
INFINITO_MEMSWAP_LIMIT=0

# mem_limit cap applied to the infinito container; 0 means "unlimited".
INFINITO_MEM_LIMIT=0

# Deploy modes CI rows may be drawn from: 'auto' for every mode a role offers, or a subset of 'host compose swarm'.
INFINITO_MODES=auto

# Repo checkout path on act-swarm DinD test nodes.
INFINITO_NODE_SRC_DIR=/opt/infinito-nexus

# MTU of the compose stack's bridge network; 1500 matches most hosts.
INFINITO_OUTER_NETWORK_MTU=1500

# Repo-relative path of the package build/install script.
INFINITO_PACKAGE_INSTALL_SCRIPT=scripts/install/package.sh

# GHCR owner of the pkgmgr base image. Composed into INFINITO_PARENT_IMAGE by utils/env/handlers/infinito/parent_image.py.
INFINITO_PARENT_IMAGE_OWNER=kevinveenbirkenbach

# Tag of the pkgmgr base image. Composed into INFINITO_PARENT_IMAGE by utils/env/handlers/infinito/parent_image.py.
INFINITO_PARENT_IMAGE_TAG=stable

# Variant of the pkgmgr base image. Currently only `full` is supported.
INFINITO_PARENT_IMAGE_VARIANT=full

# `true` keeps Playwright trace, screenshot, and video for every test; default `false` retains them only on failure.
INFINITO_PLAYWRIGHT_KEEP=false

# When `true`, the CI down-handler skips wiping the Docker volume so layer cache survives across jobs.
INFINITO_PRESERVE_DOCKER_CACHE=false

# App ids leading the CI deploy list; they get chunks of their own ahead of the regular rows.
INFINITO_PRIORITY=

# When `false`, the dev-stack container publishes no host ports (nested runner deploys share the outer daemon via DooD).
INFINITO_PUBLISH_PORTS=true

# Docker pull policy compose applies; generator overrides to `always` on GHA.
INFINITO_PULL_POLICY=never

# Repo-relative path of the system python install script.
INFINITO_PYTHON_INSTALL_SCRIPT=roles/dev-python/files/shell/install.sh

# The compose deploy runs the recover drill between PASS 1 and PASS 2 (backup/recover verification); set `false` to skip.
INFINITO_RECOVER_DRILL=true

# Absolute path of the repository root on the runner host; passed through to nested Ansible invocations.
INFINITO_REPO_ROOT=

# Per-runner CI storage budget; roles needing more are dropped from the matrix (scripts/meta/resolve/apps.sh).
INFINITO_REQUIRED_STORAGE=60GB

# Runner-side collection root for CI rescue diagnostics; uploaded as artifact (in-container snapshots use INFINITO_RESCUE_DIAGNOSTICS_DIR).
INFINITO_RESCUE_DIAGNOSTICS_BASE=/tmp/rescue-diagnostics

# Prefix applied to per-runner Docker Compose project names and container labels; empty in non-runner contexts.
INFINITO_RUNNER_PREFIX=infinito

# True when running under nektos/act locally; generator overrides via runtime detection.
INFINITO_RUNNING_ON_ACT=false

# True when running on real GitHub Actions; generator overrides via runtime detection.
INFINITO_RUNNING_ON_GITHUB=false

# Extra flags forwarded verbatim to 'docker run' by 'make run'.
INFINITO_RUN_FLAGS=

# Git repository holding the agent skills (skills-lock.json + make project target); developers override this with their own repo.
INFINITO_SKILLS_REPOSITORY=https://github.com/kevinveenbirkenbach/skills

# Skip the in-container entry.sh recompile during local deploys (venv prebuilt).
INFINITO_SKIP_COMPILE=false

# Absolute path to the bind-mounted repo root inside the dev container.
INFINITO_SRC_DIR=/opt/src/infinito

# CIDR of the internal docker bridge used by the compose stack.
INFINITO_SUBNET=172.30.0.0/24

# Fixed lab IP of the DR-drill backup host.
INFINITO_SWARM_BACKUP_IP=192.168.244.14

# Private-key path for the DR-drill backup user; write_extras generates the pair, the drill installs it on the backup host.
INFINITO_SWARM_BACKUP_KEY=/tmp/swarm-nfs-backup.key

# Pull-only backup-host base name in the act-swarm-test cluster; a non-swarm systemd node that mirrors the schema's arch-server2.
INFINITO_SWARM_BACKUP_NAME=swarm-bkp-01

# Lab bridge-network base name linking the act-swarm-test containers.
INFINITO_SWARM_LAB_NET_NAME=swarm-lab

# Lab bridge-network subnet of the act-swarm-test cluster; the node IPs must live inside it.
INFINITO_SWARM_LAB_SUBNET=192.168.244.0/24

# WireGuard layout a meshed swarm round bakes into the lab inventory.
INFINITO_SWARM_MESHES=inventories/development/wireguard.yml

# Fixed lab IP of the manager node (pinned via extra_hosts on every node so multi-network DNS stays deterministic).
INFINITO_SWARM_MGR_IP=192.168.244.10

# Manager-node base name in the act-swarm-test cluster (prefixed with the cluster id at runtime).
INFINITO_SWARM_MGR_NAME=swarm-mgr-01

# Fixed lab IP of the NFS-server sidecar.
INFINITO_SWARM_NFS_IP=192.168.244.13

# NFSv4 minor versions the swarm-lab ganesha offers; pin to "0" on hosts whose kernel NFS client breaks ganesha 4.1+ sessions.
INFINITO_SWARM_NFS_MINOR_VERSIONS="0, 1, 2"

# NFS-server sidecar base name in the act-swarm-test cluster.
INFINITO_SWARM_NFS_NAME=nfs-server

# Process ceiling per DinD node.
INFINITO_SWARM_NODE_PIDS_LIMIT=8192

# Ceiling in minutes for one distro's swarm matrix deploy in scripts/tests/deploy/swarm/routine/00_one.sh; swarm's step level.
INFINITO_SWARM_STEP_TIMEOUT_MINUTES=350

# Wall clock 00_one.sh leaves collect_and_teardown under the sweep budget; measured worst case 12m44s on the swarm moodle#1 rescue path.
INFINITO_SWARM_TEARDOWN_RESERVE_SECONDS=900

# Docker label stamped on every act-swarm-test container (DinD + NFS sidecar) so cleanup selects by label, not a guessed name.
INFINITO_SWARM_TEST_LABEL=infinito.swarm-test

# 'true' deploys the WireGuard mesh with the swarm cluster.
INFINITO_SWARM_VPN=

# Fixed lab IP of worker node 1.
INFINITO_SWARM_WRK1_IP=192.168.244.11

# Worker-node-1 base name in the act-swarm-test cluster.
INFINITO_SWARM_WRK1_NAME=swarm-wrk-01

# Fixed lab IP of worker node 2.
INFINITO_SWARM_WRK2_IP=192.168.244.12

# Worker-node-2 base name in the act-swarm-test cluster.
INFINITO_SWARM_WRK2_NAME=swarm-wrk-02

# Glob `unittest discover -p` applies when running the test suites.
INFINITO_TEST_PATTERN=test*.py

# Where scripts/tests/code/wrapper.sh executes the test run: docker | host.
INFINITO_TEST_RUNNER=docker

# Integer multiplier applied to Ansible retry/delay values on slow self-hosted hardware; 1 = no scaling.
INFINITO_TIMEOUT_MULTIPLIER=1

# Tor axis of the CI deploy matrix: auto | enforced | exclusive | disabled. exclusive also drops the variants that cannot take an onion.
INFINITO_TOR=auto

# Node Tor SOCKS port; set by the env handler from svc-net-tor services.tor.ports.local.socks (SPOT).
INFINITO_TOR_SOCKS_PORT=

# Variant overlay (applications.<app> services/credentials) baked per round by the swarm matrix orchestrator; empty elsewhere.
INFINITO_VARS_PAYLOAD=

# Absolute path of the project virtualenv inside the dev container (and on the host when /opt is writable).
INFINITO_VENV_DIR=/opt/venvs/infinito

# WireGuard axis of the CI deploy matrix: auto rotates the mesh over the swarm rows, enforced meshes all, disabled meshes none.
INFINITO_VPN=auto

# Seconds 'make up' waits for the infinito container healthcheck before failing.
INFINITO_WAIT_HEALTH_TIMEOUT_S=600

# Optional app-discovery filter consumed by scripts/meta/resolve/apps.sh and the GHA workflow.
INFINITO_WHITELIST=

# Master toggle for the worker SPOT chain (INFINITO_WORKER_CPU / _FETCH); falsy values: 0/false/no/off.
INFINITO_WORKER_ENABLED=true

# Track directories scripts/tests/workspace/00_orchestrator.sh runs, in the order given.
INFINITO_WORKSPACE_TRACKS=base compose swarm