# DataCenterIndex — DATA node (BHS128) secrets & settings.
# Copy to deploy/.env.data (gitignored) and fill every empty value; deploy/bin/deploy.sh data copies it to
# BHS128:/srv/dci/app/deploy/.env.data (mode 600). Generate secrets with: openssl rand -hex 24
# The crawl node must use the SAME POSTGRES/REDIS/CLICKHOUSE/S3 values (deploy/.env.crawl).

# ── network binds (do not change unless the WireGuard addressing changes)
DATA_WG_IP=10.67.0.60          # wg1 — the BHS64 gateway reaches edge :8300 here
DATA_PRIVATE_IP=10.68.0.1      # dci0 — stores/monitoring published here for the crawl node only
CRAWL_PRIVATE_IP=10.68.0.2
TZ=America/Toronto

# ── image tag / tsx version (TSX_VERSION is overridden from pnpm-lock.yaml by deploy/bin/lib.sh)
DCI_TAG=latest
TSX_VERSION=4.23.13

# ── Postgres (user dci, db dci)
POSTGRES_PASSWORD=
PG_POOL_MAX=16

# ── ClickHouse (users `default` = loopback only, `dci` = app; same password)
CLICKHOUSE_PASSWORD=
CLICKHOUSE_DB=dci

# ── Redis (requirepass)
REDIS_PASSWORD=

# ── MinIO: root credentials (console) + least-privilege app user created by minio-init
MINIO_ROOT_USER=dci-admin
MINIO_ROOT_PASSWORD=
S3_ACCESS_KEY=dci
S3_SECRET_KEY=
S3_BUCKET=dci-raw

# ── application
DCI_ADMIN_TOKEN=
DCI_USER_AGENT="DataCenterIndexBot/0.1 (+https://www.datacenterindex.io/bot; contact@spboucher.ai)"
NEXT_PUBLIC_API_URL=https://www.datacenterindex.io
NEXT_PUBLIC_SITE_URL=https://www.datacenterindex.io
DCI_LOG_LEVEL=info
DCI_API_CACHE_ENTRIES=5000
DCI_SCHEDULER_INTERVAL_MS=60000
DCI_MAINTENANCE_CONCURRENCY=2
# premium fetchers are normally only used by the crawl node; keep empty here unless `cli` runs need them
SCRAPFLY_API_KEY=
FIRECRAWL_API_KEY=
DCI_SCRAPFLY_DAILY_BUDGET=400
DCI_FIRECRAWL_DAILY_BUDGET=200

# ── Grafana (http://10.68.0.1:3000 via deploy/bin/tunnel-grafana.sh)
GRAFANA_ADMIN_USER=admin
GRAFANA_ADMIN_PASSWORD=