.env.example

# Database
DATABASE_URL=postgresql://openshield:openshield@localhost:5432/openshield

# Auth - see docs/security/authentication.md
# shared_secret (default, local/CI) or oidc (enterprise identity provider)
OPENSHIELD_AUTH_MODE=shared_secret
JWT_SECRET=change-me-in-production
# Optional in shared_secret mode; validated when set
JWT_ISSUER=
JWT_AUDIENCE=
# Required when OPENSHIELD_AUTH_MODE=oidc
OIDC_ISSUER=
OIDC_AUDIENCE=
OIDC_JWKS_URL=
# Optional oidc settings
OIDC_ALLOWED_TENANTS=
OIDC_ROLE_CLAIM=roles
OIDC_ROLE_MAP=

# Optional - comma-separated subscription_id allowlist for POST /api/scans/trigger.
# Unset accepts any subscription_id (matches historical behavior); the API
# logs a startup warning when this is unset. See docs/api-reference.md.
OPENSHIELD_AUTHORIZED_SUBSCRIPTIONS=

# Optional - durable scan worker tuning. A claim is held for SCAN_LEASE_SECONDS
# and renewed every SCAN_HEARTBEAT_SECONDS; the heartbeat MUST be shorter than
# the lease or the worker loses its own claim mid-scan. A non-numeric or
# non-positive value logs a warning and uses the default; a heartbeat >= the
# lease logs a warning and uses one third of the lease. Defaults: 900 and 300.
SCAN_LEASE_SECONDS=900
SCAN_HEARTBEAT_SECONDS=300

# Optional - explicit per-subscription hourly admission quota. Unset or 0 keeps
# the historical no-time-window policy (a non-numeric value logs a warning and
# disables the quota); one active (pending/running) scan per subscription is
# always enforced regardless of this value.
OPENSHIELD_MAX_SCANS_PER_SUBSCRIPTION_PER_HOUR=0

# Optional - how long a retired worker's heartbeat row is kept before it is
# pruned. Worker identities are per-process, so this bounds worker_heartbeats
# across restarts. Must stay far above SCAN_HEARTBEAT_SECONDS so that a live
# worker is never pruned. Default: 604800 (7 days).
WORKER_HEARTBEAT_RETENTION_SECONDS=604800

# AI providers - add at least one
ANTHROPIC_API_KEY=
GROQ_API_KEY=
GEMINI_API_KEY=

# Optional
NVD_API_KEY=
SENTRY_DSN=

# Optional - enables AZ-SC-007/008 (Azure DevOps pipeline scanning)
AZURE_DEVOPS_ORG_URL=
AZURE_DEVOPS_PROJECT=