-
Notifications
You must be signed in to change notification settings - Fork 4
Expand file tree
/
Copy path.env.example
More file actions
133 lines (116 loc) · 5.34 KB
/
Copy path.env.example
File metadata and controls
133 lines (116 loc) · 5.34 KB
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
DB_DRIVER=postgres
POSTGRES_USER=admin
POSTGRES_PASSWORD=password
POSTGRES_DB=ocotilloapi_dev
POSTGRES_HOST=localhost
POSTGRES_PORT=5432
# PYGEOAPI
PYGEOAPI_POSTGRES_PASSWORD=your_password
PYGEOAPI_POSTGRES_USER=your_username
# PYGEOAPI internal mount (/ogcapi-internal) -- authenticated, unfiltered
# (private/draft-inclusive) mirror of /ogcapi. Shares PYGEOAPI_POSTGRES_*
# above; only the mount path, runtime dir, and advertised server URL differ.
PYGEOAPI_INTERNAL_MOUNT_PATH=/ogcapi-internal
PYGEOAPI_INTERNAL_RUNTIME_DIR=/tmp/pygeoapi-internal
# Leave blank to derive from PYGEOAPI_SERVER_URL's application root. Only set
# this when the internal mount is served from a different host than /ogcapi.
PYGEOAPI_INTERNAL_SERVER_URL=
# Static API keys for /ogcapi-internal, for desktop GIS clients that cannot
# refresh an Authentik access token (ArcGIS Pro, QGIS). Comma- or
# whitespace-separated `label:sha256hex` entries; the label is bookkeeping
# only. Blank means bearer-JWT access only. Mint one with:
# python -c "import secrets,hashlib;k=secrets.token_urlsafe(32);print(k,hashlib.sha256(k.encode()).hexdigest())"
# Give the first value to the user, put `label:<second value>` here.
# Deployed environments source this from the Secret Manager secret
# `internal-ogc-api-keys`, not from a GitHub secret.
# See docs/internal-ogc-desktop-gis.md.
INTERNAL_OGC_API_KEYS=
# Connection pool configuration for parallel transfers
# pool_size: number of persistent connections to maintain
# max_overflow: additional connections allowed during peak usage
DB_POOL_SIZE=10
DB_MAX_OVERFLOW=20
# Transfer configuration
# Enable parallel transfers (default: true)
TRANSFER_PARALLEL=1
# Limit number of records per transfer type (for testing)
# TRANSFER_LIMIT=1000
TRANSFER_WELL_SCREENS=True
TRANSFER_SENSORS=True
TRANSFER_CONTACTS=True
TRANSFER_PERMISSIONS=True
TRANSFER_WATERLEVELS=True
TRANSFER_WATERLEVELS_PRESSURE=True
TRANSFER_WATERLEVELS_ACOUSTIC=True
TRANSFER_LINK_IDS=True
TRANSFER_GROUPS=True
TRANSFER_ASSETS=False
TRANSFER_SURFACE_WATER_DATA=True
TRANSFER_HYDRAULICS_DATA=True
TRANSFER_CHEMISTRY_SAMPLEINFO=True
TRANSFER_MAJOR_CHEMISTRY=True
TRANSFER_RADIONUCLIDES=True
TRANSFER_NGWMN_VIEWS=True
TRANSFER_WATERLEVELS_PRESSURE_DAILY=True
TRANSFER_WEATHER_DATA=True
TRANSFER_MINOR_TRACE_CHEMISTRY=True
# NM_Wells (geothermal) migration: run `python -m transfers.transfer_geothermal`
# (separate from the deprecated transfers/transfer.py NM_Aquifer driver).
TRANSFER_GEOTHERMAL_REFERENCE=True # load ref_* lookups into the lexicon
TRANSFER_NMW_MIRROR=True # load the NMW_* 1:1 staging mirror
# Optional: path to a NM_Wells SQL Server data-dump .sql file (INSERT statements).
# When set, the mirror parses it to a CSV per table (sqlparse) and bulk-loads via
# Postgres COPY; otherwise it falls back to CSV exports + row inserts.
# NMW_SQL_DUMP=/path/to/NMWells_data.sql
# Optional: dir for the per-table CSVs written from the dump (default: temp dir).
# NMW_CSV_DIR=/path/to/nmw_csv
# asset storage
GCS_BUCKET_NAME=
GOOGLE_APPLICATION_CREDENTIALS=/path/to/gcs_credentials.json
# chemistry ingestion: Google Drive folder an engineer ingests LIMS .xlsx
# workbooks from, on demand (no polling/scheduling; service account / ADC must
# have read access to this folder). The ingested-file manifest is stored in
# GCS_BUCKET_NAME at CHEMISTRY_INGEST_MANIFEST_PATH.
CHEMISTRY_DRIVE_FOLDER_ID=
CHEMISTRY_INGEST_MANIFEST_PATH=chemistry-ingest/manifest.json
# set to development for lexicon and parameter to be populated and enable the enums to work
MODE=development
# pg_cron nightly materialized-view refresh (PRODUCTION ONLY).
# Leave unset/0 in development, test, and CI: the dev Postgres image does not
# load pg_cron, and alembic migration x2y3z4a5b6c7 is a no-op when this is off.
# Set to 1 in production (DB server has shared_preload_libraries=pg_cron) to
# register the nightly refresh job. See docs/pg_cron-nightly-refresh.md.
# ENABLE_PG_CRON=0
# disable authentication (for development only)
#
# Honored ONLY when MODE=development. With any other MODE (including unset or
# "staging"), the app refuses to start -- core.permissions.assert_auth_configuration()
# raises AuthConfigurationError rather than serving every endpoint anonymously.
AUTHENTIK_DISABLE_AUTHENTICATION=1
# erase and rebuild the database for step tests
REBUILD_DB=1
# authentik
# AUTHENTIK_URL is both the JWKS base and the expected `iss` claim; trailing
# slash optional, both spellings are accepted.
AUTHENTIK_URL=
AUTHENTIK_CLIENT_ID=
AUTHENTIK_AUTHORIZE_URL=
AUTHENTIK_TOKEN_URL=
# How long a fetched JWKS document is trusted, in seconds (default 3600).
# An unrecognized `kid` forces one immediate refresh regardless, so this only
# bounds how long a revoked key stays usable.
# AUTHENTIK_JWKS_TTL_SECONDS=3600
# feedback endpoint (POST /feedback) — bug reports and feature requests
JIRA_BASE_URL=https://nmbgmr.atlassian.net
JIRA_EMAIL=your_jira_email
JIRA_API_TOKEN=your_jira_api_token
JIRA_DEFAULT_PROJECT=BDMS
# Optional — Slack notifications are skipped if this is blank
SLACK_FEEDBACK_WEBHOOK_URL=
# Edit notifications (Slack) — POST/PATCH/DELETE mutations and uploads
# Optional — notifications are skipped if this is blank
SLACK_EDITS_WEBHOOK_URL=
# Base URL for deep links in Slack messages (no trailing slash)
# Staging: https://ocotillo-staging.newmexicowaterdata.org
# Production: https://ocotillo.newmexicowaterdata.org
OCOTILLO_UI_BASE_URL=