Logan CusanoandClaude Opus 5.5
bdbde359a1
- Cap one refresh's NWS zone fetches at 15 s wall clock. They run under the feed lock, so a hung zone endpoint could otherwise stall every /weather/alerts request for minutes; unfinished zones retry next refresh. - Prod c2-core.env.j2 never set NWS_USER_AGENT, so the VM would have sent the contact-less placeholder. Default it to the site URL (overridable via vault_nws_user_agent); warn on the .env.example example.com placeholder too. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
52 lines
2.6 KiB
Bash
52 lines
2.6 KiB
Bash
# drb-c2-core environment — Managed by Ansible. Do not edit manually.
|
|
|
|
MQTT_BROKER=mosquitto
|
|
MQTT_PORT=1883
|
|
MQTT_USER={{ vault_mqtt_c2_user }}
|
|
MQTT_PASS={{ vault_mqtt_c2_pass }}
|
|
|
|
# Same value as mosquitto's MOSQUITTO_DYNSEC_PASSWORD (root.env.j2) — lets
|
|
# c2-core log in as the dynsec plugin's built-in "admin" client to
|
|
# administer node credentials. See app/internal/dynsec.py.
|
|
MQTT_DYNSEC_ADMIN_PASS={{ vault_mqtt_dynsec_admin_pass }}
|
|
|
|
# No GCP_CREDENTIALS_PATH — the VM uses Application Default Credentials
|
|
# via the GCE metadata server. The Terraform IAM bindings grant the required roles.
|
|
# NOTE: because there is no service-account key file here, c2-core cannot mint
|
|
# GCS *signed* URLs. Call audio is therefore served through c2-core's own
|
|
# /media route (app/routers/media.py) rather than direct-from-bucket links.
|
|
FIRESTORE_DATABASE={{ vault_firestore_database }}
|
|
GCS_BUCKET={{ vault_gcs_bucket }}
|
|
|
|
# Absolute origin for call-audio playback links. The browser fetches <audio src>
|
|
# directly, so a relative path would resolve against the frontend origin
|
|
# (https://{{ domain }}) instead of the API's.
|
|
PUBLIC_API_URL=https://api.{{ domain }}
|
|
|
|
OPENAI_API_KEY={{ vault_openai_api_key }}
|
|
GOOGLE_MAPS_API_KEY={{ vault_google_maps_api_key }}
|
|
GEMINI_API_KEY={{ vault_gemini_api_key }}
|
|
|
|
SERVICE_KEY={{ vault_service_key }}
|
|
ENROLLMENT_TOKEN={{ vault_enrollment_token }}
|
|
|
|
# Agent/automation key for the unattended work session's headless routes
|
|
# (GET/PUT /admin/features). MUST NOT equal vault_service_key: that one is the
|
|
# Discord bot's, and one shared value would make the bot and the agent the same
|
|
# unattributable principal in audit_log (server-26#64). default('') so a vault
|
|
# that predates this key still templates instead of failing the play; blank
|
|
# just leaves the agent path closed.
|
|
AGENT_SERVICE_KEY={{ vault_agent_service_key | default('') }}
|
|
|
|
# Bare domain, not app.<domain>: the frontend is served on {{ domain }} itself
|
|
# (see Caddyfile.j2 — only api. and the bare name have DNS records). This said
|
|
# app.{{ domain }} while the browser origin was https://{{ domain }}, so every
|
|
# frontend call to the API would have failed CORS. If the frontend ever moves
|
|
# to app.{{ domain }}, change this at the same time.
|
|
CORS_ORIGINS=["https://{{ domain }}"]
|
|
|
|
# NWS weather alerts / METAR wind (server-26#237). api.weather.gov requires a
|
|
# User-Agent naming the app and a contact; default to the site URL so a vault
|
|
# that predates this key still sends an identifiable agent, not the placeholder.
|
|
NWS_USER_AGENT={{ vault_nws_user_agent | default('DRB scanner map (https://' ~ domain ~ ')', true) }}
|