# OSINT Dashboard — environment configuration
# Copy to `.env` and adjust. All values have safe defaults for local compose.

# ── PostgreSQL / TimescaleDB ───────────────────────────────────────────────
DB_USER=osint
DB_PASSWORD=osint
DB_HOST=db
DB_PORT=5432
DB_NAME=osint_data

# ── NATS JetStream (optional — only needed when profile `ingest` is used) ──
NATS_URL=nats://nats:4222

# ── MinIO (optional — document storage; endpoint used if wired later) ──────
MINIO_ENDPOINT=minio:9000
MINIO_ACCESS_KEY=
MINIO_SECRET_KEY=
# "true" for TLS endpoints (e.g. S3-compatible prod); "false" for local HTTP.
MINIO_SECURE=false

# ── Camera discovery scraper ───────────────────────────────────────────────
# Comma-separated public directory/list/API URLs (Insecam-style pages,
# plain-text lists, or the ALERTWest JSON API). Empty = built-in defaults
# (public-ip-cams README + ALERTCalifornia/ALERTWest official JPEGs +
# Live-Environment-Streams HLS/YouTube GeoJSON).
CAMERA_SOURCE_URLS=
CAMERA_SCRAPE_INTERVAL=3600
CAMERA_REQUEST_DELAY=2.0
CAMERA_MAX_PER_SOURCE=20000
NOMINATIM_URL=https://nominatim.openstreetmap.org
NOMINATIM_MIN_INTERVAL=1.1
SNAPSHOT_TTL_SECONDS=300

# ── masscan active camera discovery (host-level systemd service, NOT compose) ─
# Continuous rolling sweep for open RTSP port 554 across a range. Runs on the
# Pi host via deploy/osint-masscan.service (needs root + raw sockets). Results
# land in the same `cameras` table as the scraper (discovery_source=masscan).
# NOTE: 200 pps is the residential-safe default. 1k/10k pps saturated a home
# uplink. A full 0.0.0.0/0 sweep at 200 pps takes ~8 months (rolling).
MASSCAN_RANGE=0.0.0.0/0
MASSCAN_PORTS=554
MASSCAN_RATE=200
MASSCAN_RETRIES=1
MASSCAN_WAIT=0
MASSCAN_EXCLUDEFILE=/etc/osint-dashboard/masscan-excludes.txt
MASSCAN_FLUSH_EVERY=250

# ── NASA FIRMS (active fire / hotspot ingest) ──────────────────────────────
# MAP_KEY is FREE — get one at https://firms.modaps.eosdis.nasa.gov/api/map_key_info/
# (1-minute signup, no payment). Leave blank to keep fire ingest idle.
FIRMS_MAP_KEY=
# NRT VIIRS S-NPP 375m active fire detection (near-real-time).
FIRMS_DATASET=VIIRS_SNPP_NRT
# Area to poll as "minlon,minlat,maxlon,maxlat". Narrow it to reduce payload
# (e.g. CONUS "-125,24,-66,50"). Default covers most of the inhabited globe.
FIRMS_BBOX=-180,-60,180,75
# Poll cadence in seconds (~15 min). FIRMS NRT updates every ~5-10 min.
FIRMS_INTERVAL=900
# Set to 0 to disable the fire loop entirely.
INGEST_FIRES=1

# ── VesselAPI (commercial REST AIS — Hormuz, 5×/day, 150 calls/mo cap) ─────
# Independent of AISStream (open/shared live US-coast WebSocket). Both stay
# on when their keys are set; missing one never disables the other.
# Prefer pasting VESSELAPI_API_KEY on the dashboard Keys page.
# The poller idles when the key is unset. Never called from map pans
# (GET /api/vessels serves the shared last-known cache only).
VESSELAPI_API_KEY=
# Bounding box(es) as minlat,minlon,maxlat,maxlon (lat/lon order). Semicolon-
# separated for multiple boxes. Default = Strait of Hormuz (span 3.6 ≤ 4° cap).
VESSELAPI_BBOX=25.5,55.4,27.3,57.2
# Poll cadence in seconds (17280 = 4.8h → 5 polls/day = 150/mo).
VESSELAPI_INTERVAL=17280
# Local hard cap on successful 2xx calls per UTC day (persisted in Postgres).
VESSELAPI_MAX_CALLS_PER_DAY=5
# 1 = run the poller inside the dashboard process (default); ingester off.
VESSELAPI_IN_APP=1
VESSELAPI_IN_INGEST=0

# ── API keys (managed from the dashboard UI) ──────────────────────────────
# Keys such as NOUS_API_KEY and TELEGRAM_TOKEN are stored in the Postgres
# `api_keys` table and managed from the dashboard's "Keys" tab
# (GET/POST/DELETE /api/keys/{name}) — see app/keystore.py. The FIRMS ingestor
# currently reads FIRMS_MAP_KEY from .env (above); wiring the Keys-UI store as
# its lookup/fallback is a planned follow-up.

# ── News pipeline (scraper + summarizer, profile `ingest`) ────────────────
# Scraper crawls urls.txt continuously (default 10s between crawls).
# Summarizer runs Nous map-reduce every 15 min (NEWS_SUMMARIZE_INTERVAL_S=900).
# NOUS_API_KEY is also (preferably) set in the Keys UI; env is an override.
# Unset in both env and api_keys = summarizer logs and idles (never crashes).
NOUS_API_KEY=
NOUS_BASE_URL=https://inference-api.nousresearch.com/v1
# Optional LLM knobs
# SUMMARY_MODEL is an optional override. Leave unset so Settings
# (app_settings.SUMMARY_MODEL) can reach the summarizer. Code default
# Hermes-4.3-36B remains after a Postgres miss. Env wins when set.
# SUMMARY_MODEL=
NEWS_BATCH_SIZE=50
SUMMARY_WINDOW_MINUTES=15
# Futures/markets coupling from the upstream pipeline is OFF by default
# (irrelevant to OSINT). Set INCLUDE_FUTURES=1 + install yfinance to enable.
INCLUDE_FUTURES=0
NEWS_SCRAPE_INTERVAL_S=10
NEWS_SUMMARIZE_INTERVAL_S=900
NEWS_SCRAPE_RUN_ON_START=1
NEWS_SUMMARIZE_RUN_ON_START=1
# "1" ignores the interval idempotency skip (double-pins on recreate).
NEWS_SUMMARIZE_FORCE=0
NEWS_LOG_LEVEL=INFO
# Reserved for the (out-of-scope) Telegram delivery bot.
TELEGRAM_TOKEN=
TELEGRAM_CHAT_ID=

# =============================================================================
# Forgejo container registry (CI publishes here; NOT ghcr.io)
# =============================================================================
# forgejo.siriusdevops.com/sirius/osint-dashboard[:tag]
# forgejo.siriusdevops.com/sirius/osint-dashboard-pg[:tag]
# forgejo.siriusdevops.com/sirius/osint-news-scraper[:tag]
# forgejo.siriusdevops.com/sirius/osint-news-summarizer[:tag]
FORGEJO_REGISTRY=forgejo.siriusdevops.com
FORGEJO_OWNER=sirius