# Public control-plane endpoint. Do not use localhost, an IP address, or example.com.
CASAN_PUBLIC_FQDN=control.casan.company.internal
CASAN_CP_HTTPS_PORT=443

# Host paths. These are provisioned outside the repository with restrictive permissions.
CASAN_CP_TLS_DIR=/opt/casan-control-panel/tls
CASAN_CP_OAUTH_ENV=/opt/casan-control-panel/oauth2-proxy.env
CASAN_CP_RUNTIME_ENV=/opt/casan-control-panel/runtime.env
CASAN_CP_VAULT_ENV=/opt/casan-control-panel/vault.env
CASAN_CP_STATE_DIR=/srv/casan/state
CASAN_CP_OUTPUT_DIR=/srv/casan/output

# CI must publish immutable image references, not tags such as :latest.
CASAN_CP_API_IMAGE=registry.example.internal/casan/control-panel-api@sha256:replace-with-64-hex-digest
CASAN_CP_UI_IMAGE=registry.example.internal/casan/control-panel-ui@sha256:replace-with-64-hex-digest

# WORM anchor destination. The deploy identity needs only PutObject and
# GetObjectLockConfiguration for this bucket/prefix; use workload identity,
# never static credentials in this file.
CASAN_S3_BUCKET=casan-production-audit
CASAN_S3_PREFIX=audit-anchors
CASAN_S3_REGION=ap-northeast-1
CASAN_S3_RETENTION_DAYS=365
CASAN_S3_KMS_KEY_ID=alias/casan-audit