# Production environment template for rn-platform-01's `provisioner` service.
# See platform.env.template for the secrets-handling convention.
#
# Docker-connectivity config (lab_hosts) and resource limits are NOT env vars — they're YAML
# files the Provisioner already loads from PROVISIONER_CONFIG_DIR (Phase 1 design, unchanged).
# Production overlays for both live at infra/environments/production/provisioner-config/ — see
# that directory's README before touching resource-policy.yaml numbers.

PLATFORM_DB_URL=postgres://rootnode_platform:__REPLACE_WITH_STRONG_PASSWORD__@localhost:5432/rootnode_platform
PROVISIONER_SHARED_SECRET=__REPLACE_same_value_as_platform.env__
PROVISIONER_PORT=4100
PROVISIONER_CONFIG_DIR=/etc/rootnode/provisioner-config

# Real Lab image, tagged (never :latest in production — see infra/docker/IMAGE_STRATEGY.md)
LAB_IMAGE_REF=registry.example.com/rootnode/lab:__GIT_SHA_OR_TAG__

# ── Egress proxy on rn-lab-host-01 ─────────────────────────────────────────────────────────
EGRESS_PROXY_PORT=3128
DNS_RESOLVER=127.0.0.11
NO_PROXY_CIDRS=10.42.0.0/16,10.43.0.0/16