# drb-c2-core environment — Managed by Ansible. Do not edit manually.

MQTT_BROKER=mosquitto
MQTT_PORT=1883
MQTT_USER={{ vault_mqtt_c2_user }}
MQTT_PASS={{ vault_mqtt_c2_pass }}

# Same value as mosquitto's MOSQUITTO_DYNSEC_PASSWORD (root.env.j2) — lets
# c2-core log in as the dynsec plugin's built-in "admin" client to
# administer node credentials. See app/internal/dynsec.py.
MQTT_DYNSEC_ADMIN_PASS={{ vault_mqtt_dynsec_admin_pass }}

# No GCP_CREDENTIALS_PATH — the VM uses Application Default Credentials
# via the GCE metadata server. The Terraform IAM bindings grant the required roles.
# NOTE: because there is no service-account key file here, c2-core cannot mint
# GCS *signed* URLs. Call audio is therefore served through c2-core's own
# /media route (app/routers/media.py) rather than direct-from-bucket links.
FIRESTORE_DATABASE={{ vault_firestore_database }}
GCS_BUCKET={{ vault_gcs_bucket }}

# Absolute origin for call-audio playback links. The browser fetches <audio src>
# directly, so a relative path would resolve against the frontend origin
# (https://{{ domain }}) instead of the API's.
PUBLIC_API_URL=https://api.{{ domain }}

OPENAI_API_KEY={{ vault_openai_api_key }}
GOOGLE_MAPS_API_KEY={{ vault_google_maps_api_key }}
GEMINI_API_KEY={{ vault_gemini_api_key }}

SERVICE_KEY={{ vault_service_key }}
ENROLLMENT_TOKEN={{ vault_enrollment_token }}

# Bare domain, not app.<domain>: the frontend is served on {{ domain }} itself
# (see Caddyfile.j2 — only api. and the bare name have DNS records). This said
# app.{{ domain }} while the browser origin was https://{{ domain }}, so every
# frontend call to the API would have failed CORS. If the frontend ever moves
# to app.{{ domain }}, change this at the same time.
CORS_ORIGINS=["https://{{ domain }}"]