# Nexus Environment Configuration
# Copy to .env and fill in values

# Server
HOST=0.0.0.0
PORT=5050

# Vault Configuration
VAULT_ADDR=http://vault.example.local:8200

# Vault AppRole - Nexus App (runtime: database/creds/nexus-app + secret/data/nexus/*)
VAULT_APP_ROLE_ID=
VAULT_APP_SECRET_ID=

# Vault AppRole - Nexus Migrate (migrations: database/creds/nexus-migrate only)
VAULT_MIGRATE_ROLE_ID=
VAULT_MIGRATE_SECRET_ID=

# Vault AppRole - Kratos App (runtime: database/creds/nexus-kratos-app + secret/data/nexus/kratos)
VAULT_KRATOS_APP_ROLE_ID=
VAULT_KRATOS_APP_SECRET_ID=

# Vault AppRole - Kratos Migrate (migrations: database/creds/nexus-kratos-migrate only)
VAULT_KRATOS_MIGRATE_ROLE_ID=
VAULT_KRATOS_MIGRATE_SECRET_ID=

# Vault AppRole - Oathkeeper (runtime: secret/data/nexus/oathkeeper only)
VAULT_OATHKEEPER_ROLE_ID=
VAULT_OATHKEEPER_SECRET_ID=

# Logging
RUST_LOG=nexus=debug,tower_http=debug

# Note: All secrets (DATABASE_URL, VALKEY_URL, S3_*, OATHKEEPER_SECRET, etc.)
# are fetched dynamically from Vault by the Vault Agent sidecars.