112 lines
5.6 KiB
Plaintext
112 lines
5.6 KiB
Plaintext
# .env.example — Copy to .env and fill in your values
|
|
# Usage: cp .env.example .env && source .env
|
|
# NEVER commit .env to version control
|
|
|
|
# ── Required ─────────────────────────────────────────────────
|
|
export PROJECT_ID="propane-will-491900-m5"
|
|
export REGION="us-central1"
|
|
export BILLING_ACCOUNT_ID="XXXXXX-XXXXXX-XXXXXX" # gcloud billing accounts list
|
|
export ALERT_EMAIL="chris.christiansen@vauco.no"
|
|
|
|
# ── Service Account ────────────────────────────────────────────
|
|
export AGENT_SA="osvauco-agent-sa@${PROJECT_ID}.iam.gserviceaccount.com"
|
|
|
|
# ── Cloud Run ────────────────────────────────────────────────
|
|
export CLOUD_RUN_SERVICE="osvauco-agent"
|
|
export ARTIFACT_REPO="agent-images"
|
|
|
|
# ── Vertex AI RAG Engine ────────────────────────────────────
|
|
export RAG_CORPUS_DISPLAY_NAME="osvauco-corpus"
|
|
# Populated by 07-rag-setup.sh — copy from script output:
|
|
export RAG_CORPUS_NAME="" # projects/PROJECT_NUM/locations/REGION/ragCorpora/ID
|
|
# Optional: override RAG region if us-central1 not allowlisted (OQ-02)
|
|
# export RAG_REGION="us-east1"
|
|
|
|
# ── Memory Bank (Agent Engine) ───────────────────────────────
|
|
export MEMORY_INSTANCE_DISPLAY_NAME="${PROJECT_ID}-memory-bank"
|
|
# Populated by 08-memorybank-setup.sh — copy from script output:
|
|
export MEMORY_ENGINE_NAME="" # projects/PROJECT_NUM/locations/REGION/reasoningEngines/ID
|
|
|
|
# ── Agent Models ─────────────────────────────────────────────
|
|
export ORCHESTRATOR_MODEL="gemini-2.0-flash-001"
|
|
export SUBAGENT_MODEL="gemini-2.0-flash-001"
|
|
|
|
# ── CI/CD — Cloud Build 2nd gen ──────────────────────────────
|
|
export GITHUB_OWNER="vauco-saas"
|
|
export GITHUB_REPO="OSVauco"
|
|
# GitHub PAT — lagres i Secret Manager, ikke her:
|
|
# gcloud secrets create github-token --data-file=<(echo -n "ghp_TOKEN")
|
|
# GitHub App Installation ID — finn på:
|
|
# https://github.com/settings/installations → klikk på Cloud Build-appen → URL-en inneholder ID
|
|
export GITHUB_APP_INSTALLATION_ID="" # eks: 12345678
|
|
|
|
# ── Observability ────────────────────────────────────────────
|
|
# OPAX-MCP authentication key from Secret Manager
|
|
# Mount in Cloud Run via --update-secrets=MCP_SECRET=mcp-server-key:latest
|
|
MCP_SECRET=<from-secret-manager>
|
|
|
|
# ALERT_EMAIL er allerede satt ovenfor
|
|
|
|
# ── Billing IAM Hardening (11-billing-iam-hardening.sh) ─────────────
|
|
# Kommaseparert liste — får roles/billing.viewer på billing-kontoen
|
|
# jason.vauger = agentens identitet (kan hente kostnadsdata autonomt)
|
|
# chris = eier med eksplisitt viewer i tillegg til admin
|
|
export BILLING_VIEWER_EMAILS="chris.christiansen@vauco.no,jason.vauger@vauco.no"
|
|
# Google Workspace / Cloud Identity domene:
|
|
# Sett kun hvis vauco.no er koblet som org i GCP — fjerner billing.creator fra domenet
|
|
# export ORG_DOMAIN="vauco.no"
|
|
#
|
|
# Fremtidig (Fase C): erstatt enkeltadresser med Google Group:
|
|
# export BILLING_VIEWER_EMAILS="billing@vauco.no"
|
|
|
|
# ── Webhook / Chat-notifikasjoner ────────────────────────────
|
|
# Lagres i Secret Manager, ikke her:
|
|
# gcloud secrets create webhook-url --data-file=<(echo -n "https://DIN-WEBHOOK-URL")
|
|
# Se: infrastructure/notifications/webhook-setup.md
|
|
|
|
# ── VPC / Security (valgfritt) ────────────────────────────────
|
|
export VPC_NETWORK="default"
|
|
# export CMEK_KEY_RING="agent-keyring"
|
|
# export CMEK_KEY_NAME="agent-key"
|
|
|
|
# ── IAP / Domene (Fase B) ─────────────────────────────────────
|
|
# export IAP_DOMAIN="opax.vauco.no"
|
|
# export IAP_CLIENT_ID=""
|
|
# export IAP_CLIENT_SECRET=""
|
|
|
|
# ── Terraform / Kunde-onboarding (Fase C) ─────────────────────
|
|
# export TF_VAR_customer_id="medioteq"
|
|
# export TF_VAR_customer_project_id=""
|
|
# export TF_VAR_customer_region="europe-north1"
|
|
# export TF_STATE_BUCKET="${PROJECT_ID}-tfstate"
|
|
|
|
# ── LiteLLM proxy (valgfritt) ─────────────────────────────────
|
|
# export LITELLM_BASE_URL=""
|
|
# export LITELLM_API_KEY=""
|
|
|
|
# ── CostGuard App (Fase B1-B10) ────────────────────────────────
|
|
# Generer en sterk secret med f.eks: openssl rand -hex 32
|
|
export SESSION_SECRET=""
|
|
|
|
# Google OAuth 2.0 Client Credentials (for web app)
|
|
# Opprett på https://console.cloud.google.com/apis/credentials
|
|
export GOOGLE_CLIENT_ID=""
|
|
export GOOGLE_CLIENT_SECRET=""
|
|
|
|
# Kommaseparert liste over e-poster som får logge inn
|
|
export ALLOWED_EMAILS="ditt.navn@example.com"
|
|
|
|
# Firebase Project ID (for Firestore)
|
|
# Dette er samme som din GCP PROJECT_ID
|
|
export FIREBASE_PROJECT_ID="${PROJECT_ID}"
|
|
|
|
# AWS Credentials for Cost Explorer
|
|
# Opprett en IAM-bruker med Cost Explorer-tilgang
|
|
export AWS_ACCESS_KEY_ID=""
|
|
export AWS_SECRET_ACCESS_KEY=""
|
|
export AWS_DEFAULT_REGION="us-east-1" # F.eks. us-east-1
|
|
|
|
# SendGrid API Key for e-postvarsler
|
|
# Hentes fra SendGrid-dashboardet
|
|
export SENDGRID_API_KEY=""
|