.env.example

# ===== Passive Recon - environment variables example =====
# Copy to .env and fill in real values, or set them as Windows system
# environment variables directly.
# Precedence: environment variables > .env file > config.json

# --- Data source API keys (JSON format; overrides values in config.json) ---
# PASSIVE_API_KEYS={"hunter":["key1","key2"],"qichacha":{"app_key":"xxx","secret_key":"xxx"}}

# --- API auth tokens (protect the REST API endpoints) ---
# PASSIVE_API_TOKENS=token1,token2,token3
# PASSIVE_API_KEY=single_key_fallback
# --- RBAC admin tokens (enterprise: approval/sensitive routes require admin) ---
# PASSIVE_ADMIN_TOKENS=admin-token-1,admin-token-2
# (Alternatively, suffix a normal token with ":admin" to grant admin role)

# --- Database path (default: data/agent.db) ---
# PASSIVE_DB_PATH=data/agent.db

# --- Log path (default: data/audit.jsonl) ---
# PASSIVE_LOG_PATH=data/audit.jsonl

# --- Outbound approval ---
# PASSIVE_OUTBOUND_REQUIRE_APPROVAL=false

# --- PII protection ---
# PASSIVE_PII_SALT=your_salt_here
# PASSIVE_PII_KEY=your_key_here

# --- Webhook notification (scheduled task report push) ---
# Push collection summary to WeCom / DingTalk / generic webhook after each scheduled run.
# NOTIFY_WECHAT_WEBHOOK=https://qyapi.weixin.qq.com/cgi-bin/webhook/send?key=your_key
# NOTIFY_DINGTALK_WEBHOOK=https://oapi.dingtalk.com/robot/send?access_token=your_token
# NOTIFY_WEBHOOK=https://example.com/hook

# --- Scheduler (optional) ---
# PASSIVE_SCHEDULE_CRON=0 3 * * *
# PASSIVE_SCHEDULE_TZ=Asia/Shanghai

# --- Compliance guardrail (optional) ---
# PASSIVE_FAIL_CLOSED=true
# PASSIVE_MAX_CONCURRENT=10