opensre/.env.deploy.example at main · Tracer-Cloud/opensre · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
# Minimal .env for EC2 gateway deployment.
# Copy to .env in repo root (or export vars) before running:
#   make bake-gateway
#   make deploy-gateway
#   make destroy-gateway
#
# Provisions one EC2 instance running the Telegram gateway as a systemd service.
# NEVER commit a file with real credentials.
# See also: .env.example for the full application env reference.

# ─── AWS SDK (EC2 / SSM provisioning) ────────────────────────────────────────
# Use static keys or a cross-account role (not both).

# Option A: static credentials
AWS_REGION=us-east-1
AWS_ACCESS_KEY_ID=your_access_key_id
AWS_SECRET_ACCESS_KEY=your_secret_access_key
# AWS_SESSION_TOKEN=optional_session_token

# Option B: cross-account role
# AWS_REGION=us-east-1
# AWS_ROLE_ARN=arn:aws:iam::123456789012:role/YourDeployRole
# AWS_EXTERNAL_ID=optional_external_id

# ─── Gateway deploy (make build-gateway-image / make deploy-gateway) ────────
# Optional: git ref (commit SHA, tag, or branch) to bake into the gateway AMI.
# Defaults to the local git HEAD commit SHA at bake time.
# The ref must exist on GitHub — push your branch/commit before baking.
# OPENSRE_GATEWAY_GIT_REF=main

# Optional: skip baking by providing an existing AMI id directly.
# OPENSRE_GATEWAY_AMI_ID=ami-0abc123456789def0

# Optional: set to 1 to also deregister the AMI when running make destroy-gateway.
# OPENSRE_GATEWAY_DESTROY_PURGE_AMI=1

# Optional: personal suffix to isolate your resources from teammates in a shared AWS account.
# Set to your username or initials (e.g. joe, alice). All AWS resources (EC2 instance,
# IAM role/profile) will be named with this suffix.
# Without this, all developers share the same resource names and will conflict.
# OPENSRE_STACK_SUFFIX=joe

# Optional: fail instead of auto-destroying when a prior deploy is still recorded.
# OPENSRE_DEPLOY_ABORT_IF_EXISTS=1

# Optional: override which key pair is attached to the instance for SSH debug access.
# Leave unset — SSM Run Command is used for gateway checks (no key pair required).
# EC2_KEY_NAME=your-key-pair-name

# ─── Telegram (gateway service) ───────────────────────────────────────────────
# The EC2 deploy is Telegram-only. Slack is deployed and operated separately,
# not from this repo — SLACK_* vars here are ignored.
TELEGRAM_BOT_TOKEN=your_bot_token_here

# Comma-separated Telegram user IDs permitted to DM the bot.
# Get your ID from @userinfobot.
TELEGRAM_ALLOWED_USERS=123456789

# ─── LLM provider ─────────────────────────────────────────────────────────────
# Set one of: openai | anthropic | bedrock
LLM_PROVIDER=openai

# OpenAI
OPENAI_API_KEY=sk-...

# Anthropic (alternative)
# LLM_PROVIDER=anthropic
# ANTHROPIC_API_KEY=sk-ant-...
# ANTHROPIC_REASONING_MODEL=claude-opus-4-7
# ANTHROPIC_TOOLCALL_MODEL=claude-haiku-4-5-20251001
# Legacy alias still accepted: ANTHROPIC_MODEL