APIC-Vibe-Portal/.env.example at main · christopherhouse/APIC-Vibe-Portal · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
# ==============================================================================
# Environment Variables — APIC Vibe Portal
# ==============================================================================
# Copy this file to .env.local and fill in values for local development.
# NEVER commit .env.local or any file containing real secrets.
#
# In production, all secrets are managed via Azure Key Vault and Managed Identity.
# ==============================================================================

# --- Azure Entra ID (Authentication) ---
AZURE_TENANT_ID=your-tenant-id
AZURE_CLIENT_ID=your-client-id
# AZURE_CLIENT_SECRET is ONLY for local dev; production uses Managed Identity
AZURE_CLIENT_SECRET=your-client-secret

# --- Azure Key Vault ---
AZURE_KEYVAULT_URL=https://your-keyvault-name.vault.azure.net/

# --- Azure API Center ---
AZURE_APIC_ENDPOINT=https://your-apic-name.data.azure-apicenter.net
AZURE_APIC_SUBSCRIPTION_ID=your-subscription-id
AZURE_APIC_RESOURCE_GROUP=your-resource-group
AZURE_APIC_SERVICE_NAME=your-apic-name
AZURE_APIC_WORKSPACE_NAME=default

# --- Azure AI Search ---
AZURE_SEARCH_ENDPOINT=https://your-search-name.search.windows.net
AZURE_SEARCH_INDEX_NAME=api-catalog-index
# AZURE_SEARCH_API_KEY is ONLY for local dev; production uses Managed Identity
AZURE_SEARCH_API_KEY=your-search-api-key

# --- Azure OpenAI ---
AZURE_OPENAI_ENDPOINT=https://your-openai-name.openai.azure.com/
AZURE_OPENAI_DEPLOYMENT_NAME=gpt-4o
# Note: The BFF uses the v1 API (/openai/v1/) and does NOT require an api-version.
# The indexer still uses the dated API version for embeddings — see src/indexer/.env.example.
# AZURE_OPENAI_API_KEY is ONLY for local dev; production uses Managed Identity
AZURE_OPENAI_API_KEY=your-openai-api-key

# --- Azure Cosmos DB ---
AZURE_COSMOS_ENDPOINT=https://your-cosmos-name.documents.azure.com:443/
AZURE_COSMOS_DATABASE_NAME=apic-vibe-portal
# AZURE_COSMOS_KEY is ONLY for local dev; production uses Managed Identity
AZURE_COSMOS_KEY=your-cosmos-key

# --- Azure Application Insights ---
# Standard Azure Monitor env var name — used by both the BFF (OTel distro) and
# the frontend runtime config endpoint (/api/config/telemetry).
APPLICATIONINSIGHTS_CONNECTION_STRING=InstrumentationKey=your-key;IngestionEndpoint=https://your-region.in.applicationinsights.azure.com/
# Note: The frontend reads this via /api/config/telemetry at runtime (NOT via
# NEXT_PUBLIC_* which would bake it into the Docker image at build time).  Set
# APPLICATIONINSIGHTS_CONNECTION_STRING on the frontend Container App environment
# and the browser SDK will pick it up automatically.

# --- BFF Configuration ---
BFF_PORT=8000
BFF_LOG_LEVEL=debug
BFF_ENVIRONMENT=development

# --- BFF URL (used by frontend server-side proxy) ---
# In production, this is automatically set by the deployment script.
# For local dev, the default (http://localhost:8000) is used when unset.
# BFF_URL=http://localhost:8000

# --- Rate Limiting ---
RATE_LIMIT_REQUESTS_PER_MINUTE=100
RATE_LIMIT_REQUESTS_PER_MINUTE_PER_IP=1000

# --- Frontend MSAL (Entra ID) ---
# IMPORTANT: These are now SERVER-SIDE environment variables, NOT NEXT_PUBLIC_*.
# They are read at runtime by the /api/config/msal endpoint and served to the browser.
# This allows the same Docker image to be deployed across environments with different values.
#
# For local dev: Set these in .env.local
# For CI/CD: Configure as GitHub environment variables (MSAL_CLIENT_ID, MSAL_AUTHORITY, etc.)
#            and they will be injected as Container App environment variables at deployment time.
MSAL_CLIENT_ID=your-spa-client-id
MSAL_AUTHORITY=https://login.microsoftonline.com/your-tenant-id
MSAL_REDIRECT_URI=http://localhost:3000
BFF_API_SCOPE=api://your-bff-client-id/.default