.env.example

# Copy to .env and fill in locally — never commit .env
#
# API
API_HOST=0.0.0.0
API_PORT=18000
LOG_LEVEL=INFO

# PostgreSQL (async URL for SQLAlchemy)
# Loaded from the repo-root `.env` (not the shell cwd). If edits seem ignored,
# check you have no DATABASE_URL set in the OS/shell — it overrides this file.
# For Supabase: copy URI from Project Settings → Database (pooler host recommended).
# PG_SSL_REQUIRED=true at Supabase; URL-encode @ # etc. inside the password.
# For Aiven Postgres: same TLS pattern. Bare `postgresql://...` becomes `+asyncpg` automatically.
# Local Docker (docker-compose.yml): default password is d2_dev_password — must match DB_PASSWORD below.
DATABASE_URL=postgresql+asyncpg://d2:d2_dev_password@localhost:5431/d2_vitals
PG_SSL_REQUIRED=false
# Optional: compose reads these for the postgres container (defaults match URL above).
DB_USER=d2
DB_PASSWORD=d2_dev_password
DB_NAME=d2_vitals

# InfluxDB 2.x (optional). Leave INFLUX_URL or INFLUX_TOKEN empty to skip Influx writes in the worker.
# Docker Compose: set INFLUX_ADMIN_TOKEN in .env to match compose defaults, or override all INFLUX_*.
# From your machine (uvicorn outside Docker): INFLUX_URL=http://127.0.0.1:8086
# Inside compose stack the default is http://influxdb:8086 (set in docker-compose.yml).
INFLUX_URL=
INFLUX_ORG=d2
INFLUX_BUCKET=vitals
INFLUX_TOKEN=
# Used only by the influxdb service for first-time setup (compose passes DOCKER_INFLUXDB_INIT_*).
INFLUX_ADMIN_USER=admin
INFLUX_ADMIN_PASSWORD=dev_influx_admin_change_me
INFLUX_ADMIN_TOKEN=dev-influx-token-change-me
INFLUX_PORT=8086

# Kafka — defaults match the Aiven cluster D1 already streams to.
KAFKA_BOOTSTRAP_SERVERS=kafka-3e53ee9e-dinura1ginige-1fd3.k.aivencloud.com:12672
KAFKA_TOPIC_VITALS_RAW=pulse-data
KAFKA_TOPIC_VITALS_SCORED=vitals.scored
KAFKA_TOPIC_ALERTS=alerts
KAFKA_CONSUMER_GROUP=d2-scoring-workers
KAFKA_SECURITY_PROTOCOL=SSL
# Copy Aiven CA + service cert/key into infra/certs/ (gitignored). Example source in repo:
#   Kafka stream and database/D2_Group_Consumer/remote_access/certs/
KAFKA_SSL_CAFILE=infra/certs/ca.pem
KAFKA_SSL_CERTFILE=infra/certs/service.cert
KAFKA_SSL_KEYFILE=infra/certs/service.key

# ML — paths relative to repo root (see checkpoints/ in repo)
MODEL_CHECKPOINT_PATH=./checkpoints/risk_level_mlp.pt
MODEL_LSTM_CHECKPOINT_PATH=./checkpoints/risk_level_lstm_vitaldb.pt
MODEL_VERSION=0.1.0
# Worker: Postgres model_predictions — insert on risk_level change, and at least every N seconds if unchanged (0 = change only).
MODEL_PREDICTION_SNAPSHOT_INTERVAL_SEC=3600

# Observability — port the worker exposes Prometheus metrics on. Set to 0 to disable.
WORKER_METRICS_PORT=8001

# Grafana (local observability UI)
GRAFANA_PORT=13000
GRAFANA_ADMIN_USER=admin
GRAFANA_ADMIN_PASSWORD=dev-grafana-change-me

# Kafka (local broker host port)
KAFKA_PORT=29093