# Non-secret runtime configuration. The service refuses to run without the
# companion Vault file and the production preflight validation.
CASAN_PROFILE=prod
CASAN_CP_STRICT=1
CASAN_CP_AUTH_MODE=jwt
CASAN_CP_JWT_ISSUER=https://id.example.internal/realms/casan
CASAN_CP_JWT_AUDIENCE=casan-control-plane
CASAN_CP_JWT_PUBLIC_KEY_FILE=/run/casan-idp/idp-public.pem
CASAN_CP_JWT_ROLE_CLAIM=groups
CASAN_CP_JWT_TENANT_CLAIM=casan_tenant
CASAN_CP_JWT_PROJECT_CLAIM=casan_project
CASAN_CP_JWT_CLOCK_SKEW_SECONDS=60
CP_BIND=0.0.0.0
CP_PORT=3010
CASAN_APP_ROOT=/app
CASAN_DASHBOARD_STALE_S=300
CASAN_PREFLIGHT=1
CASAN_CHAT_MODEL_MODE=deterministic
CASAN_SIGNING_PROVIDER=vault_kms
CASAN_IMMUTABLE_ANCHOR_PROVIDER=s3_object_lock