.env.example

CODEXDB_DEFAULT_ENV=production
CODEXDB_REQUIRE_LIVE_CONNECTION=true
CODEXDB_LIVE_CONNECTION_TIMEOUT_MS=5000
CODEXDB_MIGRATION_SIGNING_KEY=replace-with-hmac-secret

# PostgreSQL / pgvector
CODEXDB_POSTGRES_CONNECTION_STRING=postgres://user:password@localhost:5432/analytics
CODEXDB_PGVECTOR_CONNECTION_STRING=postgres://user:password@localhost:5432/analytics

# SQL Server
CODEXDB_SQLSERVER_SERVER=localhost
CODEXDB_SQLSERVER_USER=sa
CODEXDB_SQLSERVER_PASSWORD=replace-with-password
CODEXDB_SQLSERVER_DATABASE=app_prod
CODEXDB_SQLSERVER_TRUST_SERVER_CERTIFICATE=true

# Optional Windows Integrated Authentication (requires msnodesqlv8 and ODBC 18)
# CODEXDB_SQLSERVER_AUTHENTICATION=windows
# CODEXDB_SQLSERVER_ODBC_DRIVER=ODBC Driver 18 for SQL Server

# Optional read-only diagnostic collectors. Keep real tokens outside the plugin.
# CODEXDB_DATAVERSE_URL=https://your-org.crm4.dynamics.com
# CODEXDB_DATAVERSE_SYSTEM_ID=crm-prod
# CODEXDB_DATAVERSE_ACCESS_TOKEN=your-oauth-access-token
# CODEXDB_SALESFORCE_URL=https://your-org.my.salesforce.com
# CODEXDB_SALESFORCE_SYSTEM_ID=salesforce-prod
# CODEXDB_SALESFORCE_ACCESS_TOKEN=your-oauth-access-token

# Set a private, local (not network share) state directory outside the plugin cache.
# CODEXDB_STATE_DIR=C:/private/codexdb-state

# Observability and graph exports
# Optional administrator-owned replay/trace/enterprise configuration, see FIRST_RUN.md.
# CODEXDB_REPLAY_REGISTRY_JSON=
# CODEXDB_PROCESS_TRACE_URL=
# CODEXDB_PROCESS_TRACE_TOKEN=
# CODEXDB_REQUIRE_ENTERPRISE_APPROVAL=true
# CODEXDB_ENTERPRISE_APPROVAL_URL=
# CODEXDB_ENTERPRISE_APPROVAL_TOKEN=
# CODEXDB_REQUIRE_AUDIT_WITNESS=true
# CODEXDB_AUDIT_WITNESS_URL=
# CODEXDB_AUDIT_WITNESS_TOKEN=
# Set true to require trusted single-use Ed25519 approval for lab migration apply.
# CODEXDB_REQUIRE_AUTHENTICATED_APPROVAL=true
# CODEXDB_APPROVAL_TRUST_JSON maps key IDs to publicKey, issuer, subjects, approvers.
# Provision trusted public keys outside source control. No private keys belong here.
# Configuring trust also requires receipts. Production apply remains blocked.
CODEXDB_PROMETHEUS_URL=http://localhost:9090
CODEXDB_GRAFANA_URL=http://localhost:3000
CODEXDB_GRAFANA_TOKEN=replace-with-token
CODEXDB_NEO4J_URI=bolt://localhost:7687
CODEXDB_NEO4J_USER=neo4j
CODEXDB_NEO4J_PASSWORD=replace-with-password