.env.example

# QueryMesh environment (dev). Never commit real secrets.

PORT=8080
LOG_LEVEL=info

# Proxy hops to trust for X-Forwarded-For (Express `trust proxy`). Default 1
# (one reverse proxy in front). Use "false" if the app is directly exposed,
# a larger number for CDN+LB chains, or a subnet list like "10.0.0.0/8".
TRUST_PROXY=1

# --- QueryMesh service database (its OWN MySQL: config service + audit store) ---
QM_DB_HOST=127.0.0.1
QM_DB_PORT=3306
QM_DB_USER=querymesh
QM_DB_PASSWORD=changeme
QM_DB_NAME=querymesh

# Server-side pepper for API-key HMAC hashing. Required. Keep stable & secret.
QM_KEY_PEPPER=mcp-qmesh

# How often to re-read registry/keys from the config service (ms)
CONFIG_REFRESH_MS=30000

# --- OAuth 2.1 (for the Claude UI / connector flow) ---
# Public origin QueryMesh is reached at — used as the OAuth issuer. For the
# claude.ai UI this MUST be the public https tunnel/LB URL, e.g.
# https://querymesh.example.com or a cloudflared/ngrok URL. Defaults to the
# local origin for dev.
QM_PUBLIC_URL=http://localhost:8080
# Access-token lifetime in seconds (short; refreshed via the refresh token).
QM_OAUTH_TOKEN_TTL=3600
# Refresh-token lifetime in seconds (default 30 days). Rotated on every use.
QM_OAUTH_REFRESH_TTL=2592000

# Audit retention (days) — SPEC O4
AUDIT_RETENTION_DAYS=180

# --- Secret backend for AUDITED data sources: env (dev) | aws-sm | vault ---
SECRET_BACKEND=env
# Env-backed secrets are read as QM_SECRET_<UPPER_SNAKE_secretRef>.
# e.g. secretRef "edumix/api/api_cluster1" -> QM_SECRET_EDUMIX_API_API_CLUSTER1
# Value is a JSON blob: {"host":"...","port":3306,"user":"...","password":"...","database":"..."}
QM_SECRET_EDUMIX_API_API_CLUSTER1={"host":"127.0.0.1","port":3306,"user":"ro_user","password":"changeme","database":"api_cluster1"}