.env.example

# AIPlat — local environment variables (optional)
#
# AIPlat is deployed with Terraform (per domain) and runs on AWS Lambda, so it
# needs no .env in production: configuration comes from the Environment Contract
# (SSM Parameter Store) and secrets from AWS Secrets Manager.
#
# This file only documents the variables used when running the gateway LOCALLY
# (the router binary exposes the same http.Handler outside Lambda).
#
# WARNING: never commit a real .env — it is already in .gitignore.

# ===================================
# AWS
# ===================================
AWS_REGION=us-west-2

# ===================================
# Local run of the Core gateway (optional)
# ===================================
# Set an address to serve the gateway locally instead of running in Lambda.
AIPLAT_SERVE_ADDR=:8080

# Tables/queues the gateway reads (names follow the project convention:
# <project>-<environment>-<domain>-<resource>). Empty = derived by convention.
CONFIG_TABLE=aiplat-poc-gov-config
CACHE_TABLE=aiplat-poc-inf-cache
LIMITS_TABLE=aiplat-poc-inf-limits
API_KEYS_TABLE=aiplat-poc-inf-api-keys
USAGE_QUEUE_URL=

# Comma-separated list of browser origins allowed to call the APIs (CORS).
# Empty = no CORS headers are emitted (safe default: the browser blocks it).
CONSOLE_ORIGIN=

# ===================================
# Deploy-time secrets (Terraform reads TF_VAR_*)
# ===================================
# Never commit real values; export them in your shell instead.
# TF_VAR_seed_user_password=change-me

# ===================================
# Security best practices
# ===================================
# 1. Generate strong values with: openssl rand -base64 32
# 2. Rotate credentials regularly
# 3. Keep production secrets in AWS Secrets Manager / SSM, not in files
# 4. Restrict file permissions: chmod 600 .env