env.example

# Copyright 2026 Everpure, Inc.
# SPDX-License-Identifier: Apache-2.0
#
# Environment for run.sh and tests/e2e_*.sh. Copy it to
# $HOME/.flasharray-eda.env (or anywhere, with FAEDA_ENV pointing at it),
# fill in the values and chmod 600 it. env.sh sources it with `set -a`, so
# every assignment is exported. It is shell syntax: quote a value that
# contains spaces or shell metacharacters.

# --- arrays -------------------------------------------------------------------
# The names must match fa_url_env / api_token_env in the vars file and the
# lookup('env', ...) entries in the inventory; vars/example.yml and
# inventory/example.yml use these four. The polling token can hold a
# read-only role; the playbooks authenticate with the same credential.
ARRAY_A_URL=https://array-a.example.com
ARRAY_A_TOKEN=
ARRAY_B_URL=https://array-b.example.com
ARRAY_B_TOKEN=

# --- webhook secrets ------------------------------------------------------------
# run.sh forwards each of these to ansible-rulebook with --env-vars when it is
# set. Generate a value with: openssl rand -hex 32
# APPROVAL_TOKEN: bearer token the capacity approvals webhook (capacity.yml)
#   requires; approve with  -H "Authorization: Bearer $APPROVAL_TOKEN"
# GIT_WEBHOOK_SECRET: HMAC secret of the git push webhook (change_control.yml);
#   GitHub signs the body as  X-Hub-Signature-256: sha256=<hex hmac>
APPROVAL_TOKEN=
GIT_WEBHOOK_SECRET=

# --- automation orchestrator (optional, docs/ORCHESTRATOR.md) -----------------
# Client credentials of the orchestrator service account that is bound to the
# EDA triggers (client ids start with nx_sa_; the secret is shown once when the
# credential is created). playbooks/orchestrator_post.yml reads them with
# lookup('env') when orchestrator_enabled is true in the vars file; run.sh
# also forwards them with --env-vars when set. Tokens live 15 minutes and are
# never written to disk. Leave both empty when the orchestrator is not used.
AO_CLIENT_ID=
AO_CLIENT_SECRET=

# --- Slack (optional) --------------------------------------------------------
# Incoming webhook URL of the channel notifications go to. playbooks/notify.yml
# posts every notification there when this is set; the alert log stays the
# record. On the platform the "Slack webhook" credential carries it instead.
SLACK_WEBHOOK_URL=
# Lowest severity notify.yml posts to Slack: info, warning (the default) or
# critical. Every record reaches the alert log whatever this says.
SLACK_MIN_SEVERITY=

# --- optional overrides (defaults shown) ---------------------------------------
#FAEDA_VARS=vars/local-lab.yml
#FAEDA_INVENTORY=inventory/local-lab.yml
#FAEDA_VENV=/path/to/venv                    # default: <repo>/venv
#ANSIBLE_COLLECTIONS_PATH=$HOME/.ansible/collections