# Dev overrides for `make dev-config`.

#

# Copy this file to .env and uncomment any variable you want to

# override. .env is gitignored; this .env.example is the canonical

# list of overridable knobs.

#

# This is NOT a Docker-compose `.env` file. The Makefile sources it as

# a POSIX shell snippet (`. ./.env`), so:

# - `KEY=value` works and is auto-exported.

# - Quote values containing spaces: `KEY="foo bar"`.

# - `#` starts a comment, `export KEY=value` is accepted.

# - Malformed assignments (e.g. unquoted spaces) abort `make dev-config`.

#

# All probod-bootstrap inputs are prefixed with PROBOD_. See pkg/bootstrap/builder.go; the values

# set below in the Makefile's `cfg/dev.yaml` recipe are the dev defaults

# that this file can override.

# ── Base URL & ports ──────────────────────────────────────────────────

# PROBOD_BASE_URL=http://localhost:8080

# PROBOD_API_ADDR=:8080

# PROBOD_API_CORS_ALLOWED_ORIGINS=http://localhost:8080,http://localhost:5173,http://localhost:5174

# PROBOD_TRUST_CENTER_HTTP_ADDR=:10080

# PROBOD_TRUST_CENTER_HTTPS_ADDR=:443

# PROBOD_TRUST_CENTER_BASE_DOMAIN=probopage.localhost

# TLS mode: direct, or external when TLS is terminated by a trusted proxy.

# External mode disables Probo ACME issuance and renewal. Keep its listener

# private; preserve the requested Host and overwrite X-Forwarded-Proto at the

# proxy. Route {slug}.<base-domain> or a domain already stored in Probo.

# Creating custom domains is unsupported in external mode and leaves them pending.

# PROBOD_TRUST_CENTER_TLS_MODE=direct

# ── Observability ─────────────────────────────────────────────────────

# PROBOD_METRICS_ADDR=localhost:8081

# PROBOD_TRACING_ADDR=localhost:4317

# ── Secrets (rotate before prod) ──────────────────────────────────────

# PROBOD_ENCRYPTION_KEY=thisisnotasecretAAAAAAAAAAAAAAAAAAAAAAAAAAA=

# PROBOD_AUTH_COOKIE_SECRET=this-is-a-secure-secret-for-cookie-signing-at-least-32-bytes

# PROBOD_AUTH_PASSWORD_PEPPER=this-is-a-secure-pepper-for-password-hashing-at-least-32-bytes

#

# Optional: load secrets from AWS by setting env vars to awssm://, aws://, or awsps:// refs.

# awssm://<secret-id> or aws://<secret-id> — Secrets Manager

# (e.g. PROBOD_ENCRYPTION_KEY=awssm://probo/probod/encryption_key).

# The path after the prefix is the secret name or ARN; the plaintext SecretString is used directly.

# awsps://<parameter-name> — SSM Parameter Store (e.g. PROBOD_ENCRYPTION_KEY=awsps:///probo/probod/encryption_key).

# The path after awsps:// is the parameter name; String and SecureString values are supported.

# Plain env values are also supported. Requires AWS credentials (IAM role, AWS_ACCESS_KEY_ID,

# or AWS_PROFILE) and AWS_REGION via the standard AWS SDK default chain, not PROBOD_AWS_*.

# PROBOD_ENCRYPTION_KEY=aws://probo/probod/encryption_key

# PROBOD_ENCRYPTION_KEY=awssm://probo/probod/encryption_key

# PROBOD_ENCRYPTION_KEY=awsps:///probo/probod/encryption_key

# ── Cookie banner ─────────────────────────────────────────────────────

# IAB TCF CMP ID encoded in consent strings. 4095 is a placeholder until

# IAB Europe issues Probo a registered ID. Self-hosted instances that

# register their own CMP must set this to that ID (2–4095).

# PROBOD_COOKIE_BANNER_TCF_CMP_ID=4095

# ── Cookie ────────────────────────────────────────────────────────────

# PROBOD_AUTH_COOKIE_DOMAIN=localhost

# PROBOD_AUTH_COOKIE_SECURE=false

# PROBOD_AUTH_COOKIE_SAMESITE=lax

# PROBOD_AUTH_COOKIE_DURATION=24

# ── Postgres ──────────────────────────────────────────────────────────

# PROBOD_PG_ADDR=localhost:5432

# PROBOD_PG_USERNAME=postgres

# PROBOD_PG_PASSWORD=postgres

# PROBOD_PG_DATABASE=probod

# PROBOD_PG_POOL_SIZE=100

# PROBOD_PG_MIN_POOL_SIZE=10

# PROBOD_PG_MAX_CONN_IDLE_TIME_SECONDS=1800

# PROBOD_PG_MAX_CONN_LIFETIME_SECONDS=3600

# PROBOD_PG_DEBUG=false

# ── Object storage (SeaweedFS via compose) ────────────────────────────

# PROBOD_AWS_REGION=us-east-1

# PROBOD_AWS_BUCKET=probod

# PROBOD_AWS_ACCESS_KEY_ID=probod

# PROBOD_AWS_SECRET_ACCESS_KEY=thisisnotasecret

# PROBOD_AWS_ENDPOINT=http://127.0.0.1:8333

#

# Console / compliance-portal Vite CSP also derive the storage origin for file

# previews and logos (img-src/connect-src after 307) from PROBOD_AWS_* in each

# app's .env — same rules as production (including virtual-hosted

# https://{bucket}.{endpoint}).

# ── Mailer (Mailpit via compose) ──────────────────────────────────────

# PROBOD_SMTP_ADDR=localhost:1025

# PROBOD_SMTP_USER=

# PROBOD_SMTP_PASSWORD=

# PROBOD_SMTP_TLS_REQUIRED=false

# PROBOD_MAILER_SENDER_EMAIL=no-reply@notification.getprobo.com

# PROBOD_MAILER_SENDER_NAME=Probo

# ── Slack app (optional; all fields required when enabled) ───────────

# PROBOD_SLACKBOT_ENABLED=true

# Distinct from PROBOD_CONNECTOR_SLACK_SIGNING_SECRET when using a second Slack app.

# PROBOD_SLACKBOT_SIGNING_SECRET=

# PROBOD_SLACKBOT_CLIENT_ID=

# PROBOD_SLACKBOT_CLIENT_SECRET=

# PROBOD_SLACKBOT_REDIRECT_URI=http://localhost:8080/api/console/v1/slackbot/install/complete

# PROBOD_AGENT_SLACKBOT_PROVIDER=openai

# PROBOD_AGENT_SLACKBOT_MODEL_NAME=gpt-4o

# PROBOD_AGENT_SLACKBOT_TEMPERATURE=0.1

# PROBOD_AGENT_SLACKBOT_MAX_TOKENS=4096

# ── LLM providers ─────────────────────────────────────────────────────

# PROBOD_OPENAI_API_KEY=sk-...

# PROBOD_ANTHROPIC_API_KEY=sk-ant-...

# PROBOD_LLM_DEFAULT_PROVIDER=openai

# PROBOD_LLM_DEFAULT_MODEL_NAME=gpt-4o

# ── LLM-backed workers (inherit from LLM defaults when unset) ─────────

# PROBOD_PROBO_AGENT_PROVIDER=anthropic

# PROBOD_PROBO_AGENT_MODEL_NAME=claude-sonnet-4-6

# PROBOD_EVIDENCE_DESCRIBER_PROVIDER=openai

# PROBOD_EVIDENCE_DESCRIBER_MODEL_NAME=gpt-4o-mini

# PROBOD_AGENT_THIRD_PARTY_VETTER_PROVIDER=openai # inherits AGENT_DEFAULT_PROVIDER when unset

# PROBOD_AGENT_THIRD_PARTY_VETTER_MODEL_NAME=gpt-4o # inherits AGENT_DEFAULT_MODEL_NAME when unset

# PROBOD_THIRD_PARTY_VETTING_INTERVAL=10

# PROBOD_THIRD_PARTY_VETTING_STALE_AFTER=1500

# PROBOD_THIRD_PARTY_VETTING_MAX_CONCURRENCY=1

# ── Document signature/approval notifications (seconds) ───────────────

# PROBOD_DOCUMENT_NOTIFICATION_INTERVAL=300

# PROBOD_DOCUMENT_NOTIFICATION_DEBOUNCE_DELAY=900

# PROBOD_DOCUMENT_NOTIFICATION_REMINDER_INTERVAL=86400

# ── Outbound webhooks (seconds unless noted) ──────────────────────────

# PROBOD_WEBHOOK_SENDER_INTERVAL=5

# PROBOD_WEBHOOK_REQUEST_TIMEOUT=15

# PROBOD_WEBHOOK_CACHE_TTL=86400

# PROBOD_WEBHOOK_STALE_AFTER=300

# PROBOD_WEBHOOK_RETRY_BASE=30

# PROBOD_WEBHOOK_RETRY_MAX=14400

# PROBOD_WEBHOOK_MAX_CONCURRENCY=5

# ── OIDC sign-in providers ────────────────────────────────────────────

# PROBOD_AUTH_GOOGLE_CLIENT_ID=

# PROBOD_AUTH_GOOGLE_CLIENT_SECRET=

# PROBOD_AUTH_MICROSOFT_CLIENT_ID=

# PROBOD_AUTH_MICROSOFT_CLIENT_SECRET=

# ── Connectors (set _CLIENT_ID to enable; _CLIENT_SECRET is required) ─

# PROBOD_CONNECTOR_SLACK_CLIENT_ID=

# PROBOD_CONNECTOR_SLACK_CLIENT_SECRET=

# PROBOD_CONNECTOR_SLACK_SIGNING_SECRET=

# PROBOD_CONNECTOR_SLACK_ENDPOINT_AUTH=

# PROBOD_CONNECTOR_SLACK_ENDPOINT_TOKEN=

# PROBOD_CONNECTOR_SLACK_ENDPOINT_API_BASE=

# PROBOD_CONNECTOR_HUBSPOT_CLIENT_ID=

# PROBOD_CONNECTOR_HUBSPOT_CLIENT_SECRET=

# PROBOD_CONNECTOR_GITHUB_CLIENT_ID=

# PROBOD_CONNECTOR_GITHUB_CLIENT_SECRET=

# Enable "Request user authorization (OAuth) during installation" and configure

# the GitHub App callback URL as:

# ${PROBOD_BASE_URL}/api/console/v1/connectors/github-app/complete

# PROBOD_CONNECTOR_GITHUB_APP_ID=

# PROBOD_CONNECTOR_GITHUB_APP_CLIENT_ID=

# PROBOD_CONNECTOR_GITHUB_APP_CLIENT_SECRET=

# PROBOD_CONNECTOR_GITHUB_APP_SLUG=

# PROBOD_CONNECTOR_GITHUB_APP_PRIVATE_KEY=

# PROBOD_CONNECTOR_NOTION_CLIENT_ID=

# PROBOD_CONNECTOR_NOTION_CLIENT_SECRET=

# PROBOD_CONNECTOR_SENTRY_CLIENT_ID=

# PROBOD_CONNECTOR_SENTRY_CLIENT_SECRET=

# PROBOD_CONNECTOR_INTERCOM_CLIENT_ID=

# PROBOD_CONNECTOR_INTERCOM_CLIENT_SECRET=

# PROBOD_CONNECTOR_DOCUSIGN_CLIENT_ID=

# PROBOD_CONNECTOR_DOCUSIGN_CLIENT_SECRET=

# PROBOD_CONNECTOR_LINEAR_CLIENT_ID=

# PROBOD_CONNECTOR_LINEAR_CLIENT_SECRET=

# PROBOD_CONNECTOR_LINEAR_SYNC_CLIENT_ID=

# PROBOD_CONNECTOR_LINEAR_SYNC_CLIENT_SECRET=

# Signing secret for POST /api/linear/v1/webhooks (Linear Sync OAuth app webhook).

# PROBOD_CONNECTOR_LINEAR_SYNC_WEBHOOK_SECRET=

# Connector endpoint overrides. Each connector's endpoints are compiled in;

# these repoint one at different hosts, so a non-production deployment can

# exercise a connector against the vendor's sandbox. Available per provider as

# PROBOD_CONNECTOR_<PROVIDER>_ENDPOINT_{AUTH,TOKEN,PROBE,IDENTITY,API_BASE}; an

# unset one keeps the compiled default.

#

# Values must be absolute https URLs. probod refuses to start on an override

# naming an unknown provider, or naming a field the provider resolves per flow

# or per connection (a customer-supplied Okta domain, say) — that override

# would be silently ignored, so it fails loudly instead.

#

# Move every host a provider uses, not just some. probod rejects a partial

# move: DocuSign resolves each account's data host from IDENTITY, so overriding

# PROBE without IDENTITY would leave the connection check on the sandbox while

# every access review still read production. Set them together, as below.

#

# Sandbox credentials are separate from production ones, so set the matching

# CLIENT_ID/CLIENT_SECRET too.

# PROBOD_CONNECTOR_DOCUSIGN_ENDPOINT_AUTH=https://account-d.docusign.com/oauth/auth

# PROBOD_CONNECTOR_DOCUSIGN_ENDPOINT_TOKEN=https://account-d.docusign.com/oauth/token

# PROBOD_CONNECTOR_DOCUSIGN_ENDPOINT_PROBE=https://account-d.docusign.com/oauth/userinfo

# PROBOD_CONNECTOR_DOCUSIGN_ENDPOINT_IDENTITY=https://account-d.docusign.com/oauth/userinfo

# PROBOD_CONNECTOR_BREX_CLIENT_ID=

# PROBOD_CONNECTOR_BREX_CLIENT_SECRET=

# PROBOD_CONNECTOR_GITLAB_CLIENT_ID=

# PROBOD_CONNECTOR_GITLAB_CLIENT_SECRET=

# PROBOD_CONNECTOR_BITBUCKET_CLIENT_ID=

# PROBOD_CONNECTOR_BITBUCKET_CLIENT_SECRET=

# PROBOD_CONNECTOR_HEROKU_CLIENT_ID=

# PROBOD_CONNECTOR_HEROKU_CLIENT_SECRET=

# PROBOD_CONNECTOR_PAGERDUTY_CLIENT_ID=

# PROBOD_CONNECTOR_PAGERDUTY_CLIENT_SECRET=

# PROBOD_CONNECTOR_ASANA_CLIENT_ID=

# PROBOD_CONNECTOR_ASANA_CLIENT_SECRET=

# PROBOD_CONNECTOR_NETLIFY_CLIENT_ID=

# PROBOD_CONNECTOR_NETLIFY_CLIENT_SECRET=

# PROBOD_CONNECTOR_CLICKUP_CLIENT_ID=

# PROBOD_CONNECTOR_CLICKUP_CLIENT_SECRET=

# PROBOD_CONNECTOR_VERCEL_CLIENT_ID=

# PROBOD_CONNECTOR_VERCEL_CLIENT_SECRET=

# PROBOD_CONNECTOR_VERCEL_INTEGRATION_SLUG=

# PROBOD_CONNECTOR_MONDAY_CLIENT_ID=

# PROBOD_CONNECTOR_MONDAY_CLIENT_SECRET=

# PROBOD_CONNECTOR_DATADOG_CLIENT_ID=

# PROBOD_CONNECTOR_DATADOG_CLIENT_SECRET=

# Zendesk OAuth requires a Zendesk-approved global OAuth client (Marketplace).

# PROBOD_CONNECTOR_ZENDESK_CLIENT_ID=

# PROBOD_CONNECTOR_ZENDESK_CLIENT_SECRET=

# Google Analytics (GA4) OAuth (distinct from Google Workspace).

# PROBOD_CONNECTOR_GOOGLE_ANALYTICS_CLIENT_ID=

# PROBOD_CONNECTOR_GOOGLE_ANALYTICS_CLIENT_SECRET=

# Square OAuth (EMPLOYEES_READ); customers may also use a personal access token.

# PROBOD_CONNECTOR_SQUARE_CLIENT_ID=

# PROBOD_CONNECTOR_SQUARE_CLIENT_SECRET=

# Cal.com OAuth.

# PROBOD_CONNECTOR_CAL_COM_CLIENT_ID=

# PROBOD_CONNECTOR_CAL_COM_CLIENT_SECRET=

# Calendly OAuth.

# PROBOD_CONNECTOR_CALENDLY_CLIENT_ID=

# PROBOD_CONNECTOR_CALENDLY_CLIENT_SECRET=

# Attio OAuth (app registered at build.attio.com; grant it user_management:read).

# PROBOD_CONNECTOR_ATTIO_CLIENT_ID=

# PROBOD_CONNECTOR_ATTIO_CLIENT_SECRET=

# PostHog Cloud (US + EU) OAuth needs NO config: it uses the CIMD public-client

# flow (no app registration, no client_secret), auto-enabled when this

# deployment is publicly reachable at PROBOD_BASE_URL. Self-hosted PostHog uses

# the API-key path with an instance URL. No CONNECTOR_POSTHOG_* vars required.

# ── OAuth2 authorization server ───────────────────────────────────────

# Comma-separated HTTPS client metadata document URLs allowed for CIMD

# OAuth clients (e.g. MCP connectors). Leave unset to disable CIMD.

# PROBOD_OAUTH2_SERVER_CIMD_ALLOWED_CLIENT_IDS=https://chatgpt.com/oauth/client.json,https://claude.ai/oauth/client.json

# ── Cloud identity issuer (outbound OIDC) ───────────────────────────

# make dev-config enables this and writes a key to

# cfg/.dev-identity-federation-signing-key.pem, so nothing here is required locally.

# The issuer defaults to {PROBOD_BASE_URL}/federation. Override it only with a

# publicly reachable HTTPS apex: the value is immutable once a customer

# registers it with their cloud provider.

# PROBOD_IDENTITY_FEDERATION_ENABLED=true

# PROBOD_IDENTITY_FEDERATION_ISSUER_BASE_URL=https://proboidentity.com

# PROBOD_IDENTITY_FEDERATION_SIGNING_KEY="-----BEGIN RSA PRIVATE KEY-----\n...\n-----END RSA PRIVATE KEY-----"

# PROBOD_IDENTITY_FEDERATION_SIGNING_KEY_KID=default

# The previous key never signs, it only stays published in the JWKS so a cloud

# provider holding a cached key set can still verify a token minted before a

# rotation. Its kid is required and must differ from the active one. Rotate in

# three steps: publish the new key here while the old one still signs, then swap

# the two so the old key becomes the previous one, then unset these two once the

# token TTL (5 minutes) has elapsed.

# PROBOD_IDENTITY_FEDERATION_PREVIOUS_SIGNING_KEY="-----BEGIN RSA PRIVATE KEY-----\n...\n-----END RSA PRIVATE KEY-----"

# PROBOD_IDENTITY_FEDERATION_PREVIOUS_SIGNING_KEY_KID=previous

# Install artifacts for the AWS, GCP, and Azure audit roles. Defaults point at

# the public CloudFormation template and the Terraform Registry modules.

# PROBOD_IDENTITY_FEDERATION_CLOUDFORMATION_TEMPLATE_URL=https://probo-cloudformation-template.s3.us-east-2.amazonaws.com/aws-audit-role.yaml

# PROBOD_IDENTITY_FEDERATION_TERRAFORM_MODULE_SOURCE=getprobo/audit-role/aws

# PROBOD_IDENTITY_FEDERATION_GCP_TERRAFORM_MODULE_SOURCE=getprobo/audit-role/gcp

# PROBOD_IDENTITY_FEDERATION_AZURE_TERRAFORM_MODULE_SOURCE=getprobo/audit-role/azurerm

# ── Custom domains (step-ca ACME via compose, direct TLS mode only) ───

# PROBOD_CUSTOM_DOMAINS_CNAME_TARGET=custom.getprobo.com

# PROBOD_ACME_DIRECTORY=https://localhost:9000/acme/acme/directory

# PROBOD_ACME_EMAIL=admin@probo.com

# PROBOD_ACME_KEY_TYPE=EC256

# Persist an account key across restarts (make dev-config writes one to

# cfg/.dev-acme-account-key.pem). Ephemeral keys orphan in-flight orders

# with 401 unauthorized on poll.

# PROBOD_ACME_ACCOUNT_KEY="-----BEGIN EC PRIVATE KEY-----\n...\n-----END EC PRIVATE KEY-----"

# Install the local root once for browser/CIMD trust:

# step certificate install compose/step-ca/certs/root_ca.crt