.env.example

# SPDX-FileCopyrightText: Copyright (c) 2026, NVIDIA CORPORATION & AFFILIATES. All rights reserved.
# SPDX-License-Identifier: Apache-2.0
#
# Licensed under the Apache License, Version 2.0 (the "License");
# you may not use this file except in compliance with the License.
# You may obtain a copy of the License at
#
# http://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing, software
# distributed under the License is distributed on an "AS IS" BASIS,
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
# See the License for the specific language governing permissions and
# limitations under the License.

# Example environment for the vulnerability-analysis pipeline.
# Copy to `.env` (`cp .env.example .env`) and fill in the secrets. `.env` is gitignored;
# never commit real keys or client secrets.

# --- Core (required for `nat run` / `nat serve` / docker compose) ---------------------
NVIDIA_API_KEY=
NV_BASE_URL=https://integrate.api.nvidia.com/v1
TAVILY_API_KEY=
# `bash deploy/compose.sh` uses this value for every lifecycle and exec command.
DOCKER_COMPOSE_PROJECT_NAME=vuln_analysis

# Extracted image root filesystems are keyed by immutable digest and can consume tens of GiB.
# Run `uv run vuln-analysis cache info` to inspect both caches and review the README cleanup flow.
VULN_ANALYSIS_IMAGE_CACHE=.cache/vuln_analysis/images
# Successful agent reports are reused from this semantic cache regardless of output_dir.
# Existing report files are not imported; the first run after upgrading populates this cache.
VULN_ANALYSIS_STAGE_CACHE=.cache/vuln_analysis/stages

# --- Docker Compose analysis-service sizing (optional) --------------------------------
# Keep bind-mounted reports, caches, and temporary artifacts owned by the invoking host user.
# `bash deploy/configure-host-identity.sh` replaces these portable defaults with `id -u` and
# `id -g` for the current host before the stack starts.
VULN_ANALYSIS_HOST_UID=1000
VULN_ANALYSIS_HOST_GID=1000

# These values are passed to the `nat serve` command in deploy/docker-compose.yml.
# NAT creates one additional Dask worker intended for cleanup, so the defaults below create
# two workers total. The memory limit is per worker; 0.4 means 40% of detected
# system/container memory per worker (about 80% configured worker memory at the default
# worker count). Dask enforces its worker memory limits on a best-effort basis.
VULN_ANALYSIS_MAX_RUNNING_ASYNC_JOBS=1
VULN_ANALYSIS_DASK_WORKER_MEMORY_LIMIT=0.4
# JupyterLab has no token in this local stack and is therefore bound to loopback only.
VULN_ANALYSIS_JUPYTER_HOST_PORT=8000

# --- Container image extraction via crane (optional) ----------------------------------
# On automatic extraction the orchestrator pulls the image and materializes a flattened
# rootfs with `crane`. These knobs tune that path; all are optional (defaults shown).
#
# Max extractions allowed to run at once on a host, enforced by a cross-process file-slot
# lock so it holds across Dask process/thread workers. Must be a positive integer (>= 1);
# a zero/negative/non-integer value is rejected at startup.
VULN_ANALYSIS_MAX_CONCURRENT_EXTRACTIONS=1
# Node-local scratch dir. When set, crane streams to a local tarball first, then untars into
# the (possibly network) cache — avoids HTTP/2 stream resets when the cache is on slow EFS.
# Leave unset to stream `crane export | tar` straight into the cache (best on local disk).
# Use absolute cache/scratch paths when Dask workers may have different working directories.
# VULN_ANALYSIS_LOCAL_SCRATCH=/local/scratch/vuln-analysis
# Positive number of `crane export` attempts before giving up. The network-bound pull is
# retried with exponential backoff; invalid/non-positive values fail with a configuration error.
# VULN_ANALYSIS_CRANE_EXPORT_ATTEMPTS=4

# --- Inbound OAuth2 / JWT bearer-token auth for `nat serve` ---------------------------
# Off by default; the auth worker is inert unless ENABLED=true. See README
# "Serving as an authenticated service (OAuth2 / JWT bearer)". All vars are prefixed
# VULN_ANALYSIS_AUTH_. The values below are GENERIC placeholders — point them at whatever
# OAuth2 / OIDC provider issues your callers' tokens (Auth0, Keycloak, Okta, Azure AD, ...);
# nothing provider-specific is baked into the code.
#
# NOTE on AUDIENCE: set it to the exact value your provider puts in the token's `aud` claim
# for this service — providers differ (a resource URL, an API identifier, a service-id, ...),
# so copy it from a decoded token rather than guessing. If `aud` is a list, AUDIENCE must be
# one of its entries.
#
# To activate, set ENABLED=true and provide a scope your provider grants to caller clients.
VULN_ANALYSIS_AUTH_ENABLED=false
VULN_ANALYSIS_AUTH_ISSUER=https://your-oauth2-issuer.example.com
VULN_ANALYSIS_AUTH_AUDIENCE=your-service-audience
VULN_ANALYSIS_AUTH_REQUIRED_SCOPES=your-required-scope
# JWKS_URI defaults to <issuer>/.well-known/jwks.json (the conventional OIDC location) —
# leave unset unless your provider publishes its keyset elsewhere.
VULN_ANALYSIS_AUTH_JWKS_URI=
# Accepted signature algorithms default to ES256,RS256 (covers the common providers) —
# leave unset unless your provider signs with something else.
VULN_ANALYSIS_AUTH_ALGORITHMS=

# --- Outbound job-completion webhooks (optional) --------------------------------------
# Off by default; the dispatcher is inert unless ENABLED=true and URL is set. On terminal
# state, the server POSTs one canonical envelope per async job (see docs/webhook-schema.md
# and README "Pushing job completion to a consumer"). All vars are prefixed
# VULN_ANALYSIS_WEBHOOK_. Everything below is GENERIC — point AUTH_* at whatever OAuth2
# provider your consumer requires; no identity provider is baked into the code.
VULN_ANALYSIS_WEBHOOK_ENABLED=false
VULN_ANALYSIS_WEBHOOK_URL=https://your-consumer.example.com/callbacks/vuln-analysis
# Retry/backoff/timeout knobs (defaults shown) — leave unset to accept defaults.
# VULN_ANALYSIS_WEBHOOK_POLL_INTERVAL_SECONDS=5
# VULN_ANALYSIS_WEBHOOK_REQUEST_TIMEOUT_SECONDS=30
# VULN_ANALYSIS_WEBHOOK_MAX_ATTEMPTS=6
# VULN_ANALYSIS_WEBHOOK_MAX_ROUNDS=288
# VULN_ANALYSIS_WEBHOOK_BACKOFF_BASE_SECONDS=1
# VULN_ANALYSIS_WEBHOOK_BACKOFF_MAX_SECONDS=300
#
# Outbound auth (provider-neutral OAuth2 client-credentials). AUTH_MODE = none | oauth2.
#   none  -> no Authorization header (open / HMAC-only / network-restricted consumers)
#   oauth2 -> POST grant_type=client_credentials to AUTH_TOKEN_URL (HTTP Basic creds)
VULN_ANALYSIS_WEBHOOK_AUTH_MODE=none
VULN_ANALYSIS_WEBHOOK_AUTH_TOKEN_URL=
VULN_ANALYSIS_WEBHOOK_AUTH_CLIENT_ID=
VULN_ANALYSIS_WEBHOOK_AUTH_CLIENT_SECRET=
VULN_ANALYSIS_WEBHOOK_AUTH_SCOPE=
#
# Optional independent HMAC payload signature (X-Webhook-Signature). Empty -> off.
VULN_ANALYSIS_WEBHOOK_HMAC_SECRET=