# Praxis — Operator-tier secrets template (v0.4, TASK-05-02).
# Copy to .ciagent/.env.secrets and fill in real values.
# .env.secrets is gitignored (verified in .gitignore: .env.secrets).
# This file (.env.secrets.example) is committed as documentation.

# ─── Operator tier (v0.4) ───────────────────────────────────────────────────
# Postgres password. Generate: openssl rand -base64 32
PRAXIS_PG_PASSWORD=

# Full Postgres DSN. host=postgres is the docker-compose service DNS name.
#   postgresql://praxis:${PRAXIS_PG_PASSWORD}@postgres:5432/praxis
PRAXIS_PG_DSN=

# Cookie signing secret (>=32 bytes). Generate: openssl rand -base64 48
PRAXIS_COOKIE_SECRET=

# Bootstrap operator credentials (scripts/create-operator.py).
PRAXIS_BOOTSTRAP_OPERATOR_USER=
PRAXIS_BOOTSTRAP_OPERATOR_PASS=

# VC issuer root key (nacl.SecretBox, 32 bytes). Generate:
#   python3 -c "import nacl.utils; print(nacl.utils.random(32).hex())"
PRAXIS_VC_ISSUER_KEY=

# Issuer URL (public base for VC identifiers).
PRAXIS_ISSUER_URL=https://praxis.example/issuers/v0.4

# Cookie Secure flag — set false ONLY for the HTTP pilot (R-AUTH-01, G-031).
PRAXIS_COOKIE_SECURE=true