# Safe defaults: nothing is written until DRY_RUN=false.
DRY_RUN=false
LOG_LEVEL=info
HTTP_ADDR=:7080
DATA_DIR=/app/data

# Dashboard auth (required unless WEB_ALLOW_ANONYMOUS=true)
WEB_USERNAME=admin
WEB_PASSWORD=adminadminadmin
WEB_ALLOW_ANONYMOUS=false
KNOWLEDGE_WEB_EDIT_ENABLED=true

# Optional GLPI webhook authentication.
# Configure GLPI to send the same secret as X-Webhook-Secret if your webhook supports custom headers.
WEBHOOK_SECRET=662fbeeff3fff7d204c75ef1ffd53704d5312be8169a13484c2fd4af169d729c

# GLPI 11 High-Level API / OAuth2 password grant
GLPI_URL=https://glpi-test.hilden.de
GLPI_API_VERSION=v2.3
GLPI_CLIENT_ID=662fbeeff3fff7d204c75ef1ffd53704d5312be8169a13484c2fd4af169d729c
GLPI_CLIENT_SECRET=8e380c592ce13527606f1fa81e01169d06b43be5ae975cb5e3b7de02e401932b
GLPI_USERNAME=ai
GLPI_PASSWORD=adminadminadmin
# Required before AUTO_REPLY=true; numeric GLPI user id of svc-ai-agent.
GLPI_AGENT_USER_ID=26
# Keep false in production. Only useful for local test GLPI instances over plain HTTP.
GLPI_ALLOW_INSECURE_HTTP=false
# Fail-closed processing whitelist. GLPI status 1 is "New"; add more IDs only deliberately.
GLPI_ALLOWED_STATUS_IDS=1
GLPI_POLL_INTERVAL=30s
GLPI_POLL_LIMIT=50
# Optional server-side optimization; the agent still enforces GLPI_ALLOWED_STATUS_IDS itself.
# Verify filter syntax against /api.php/doc on your instance when changing it.
GLPI_TICKET_FILTER=status.id==1
GLPI_TIMEOUT=20s

# Ollama
#OLLAMA_URL=http://ollama:11434
OLLAMA_URL=http://10.10.11.123:11434
OLLAMA_MODEL=qwen3:8b
OLLAMA_EMBEDDING_MODEL=embeddinggemma
OLLAMA_TIMEOUT=10m
OLLAMA_NUM_PREDICT=768
OLLAMA_JSON_RETRIES=1
OLLAMA_KEEP_ALIVE=10m
OLLAMA_THINK=false
OLLAMA_MAX_CONCURRENT=1

# RAG / Knowledge
KNOWLEDGE_DIR=/app/knowledge
RAG_ENABLED=true
KNOWLEDGE_TOP_K=3
KNOWLEDGE_MIN_SCORE=0.88
CATEGORY_PROMPT_LIMIT=80
# Sources for normal retrieval and possible reply candidates. The index also includes category sources.
KNOWLEDGE_ALLOWED_SOURCES=internal-kb,glpi-kb,runbook,vendor-docs,resolved-tickets
# Sources used only as classification evidence; they are never reply candidates.
KNOWLEDGE_CATEGORY_SOURCES=internal-category
# Must be a subset of KNOWLEDGE_ALLOWED_SOURCES. Set to "none" to disable source-based auto-replies.
KNOWLEDGE_AUTO_REPLY_SOURCES=internal-kb,glpi-kb,runbook

# Communication policy for end-user replies. Auto-reply KB documents must carry matching metadata.
COMMUNICATION_LANGUAGE=de-DE
COMMUNICATION_STYLE=formal
COMMUNICATION_SALUTATION=Guten Tag,
COMMUNICATION_CLOSING=Mit freundlichen Grüßen
COMMUNICATION_SIGNATURE=IT-Service


# Read-only operational context. These sources never receive write access.
CONTEXT_ENABLED=true
CONTEXT_TIMEOUT=12s
# Minimum deterministic token-overlap score for an incident/outage to be treated as relevant to a ticket.
CONTEXT_RELEVANCE_MIN_SCORE=0.20
# Safe defaults: missing context or a relevant central incident suppresses automatic end-user replies.
CONTEXT_BLOCK_AUTO_REPLY_ON_ERRORS=true
CONTEXT_BLOCK_AUTO_REPLY_ON_INCIDENT=true

# GLPI Change Calendar. The route is checked against /api.php/doc.json at startup.
CHANGE_CALENDAR_ENABLED=true
GLPI_CHANGE_PATH=/Assistance/Change
GLPI_CHANGE_FILTER=
GLPI_CHANGE_LIMIT=100
CHANGE_LOOKBACK=72h
CHANGE_LOOKAHEAD=24h

# Active Major Incidents are modeled as GLPI Tickets selected by YOUR explicit filter.
# Enable only after validating the filter against your GLPI /api.php/doc / getting-started docs.
MAJOR_INCIDENTS_ENABLED=false
GLPI_MAJOR_INCIDENT_FILTER=
GLPI_MAJOR_INCIDENT_LIMIT=20

# Requester -> device context. Direct ticket-linked items are always reused; this optional lookup
# additionally searches assigned assets for each requester extracted from the ticket response.
USER_DEVICE_CONTEXT_ENABLED=true
GLPI_USER_DEVICE_PATHS=/Assets/Computer
GLPI_USER_DEVICE_FILTER_TEMPLATE=user.id=={{user_id}}
GLPI_USER_DEVICE_LIMIT=20

# Uptime Kuma (read-only). Recommended for internal systems: authenticated Prometheus /metrics.
UPTIME_KUMA_ENABLED=false
UPTIME_KUMA_URL=https://uptime.example.org
# metrics | status_page
UPTIME_KUMA_MODE=metrics
# Required in metrics mode. Uptime Kuma uses the API key as the HTTP Basic Auth password.
UPTIME_KUMA_API_KEY=CHANGE_ME
# Required only in status_page mode; comma-separated published Status Page slugs.
UPTIME_KUMA_STATUS_PAGES=it-services
UPTIME_KUMA_TIMEOUT=10s
UPTIME_KUMA_MAX_ISSUES=20
UPTIME_KUMA_INCLUDE_MAINTENANCE=true

# Optional: bei eindeutig passender Uptime-Kuma-Störung oder Wartung einen
# ausschließlich vom Betreiber vorgegebenen Text senden. Die KI erzeugt keinen
# Antworttext; sie wählt nur einen aktiven Kandidaten und liefert eine Confidence.
CONTEXT_STATUS_REPLY_ENABLED=false
CONTEXT_STATUS_REPLY_MIN_RELEVANCE=0.50
CONTEXT_STATUS_REPLY_MIN_AI_CONFIDENCE=0.80
# Finaler Score = Relevanz × KI-Confidence.
CONTEXT_STATUS_REPLY_MIN_FINAL_SCORE=0.45
# Literal \n wird als Zeilenumbruch interpretiert. Verfügbare Platzhalter:
# {{service_name}}, {{status}}, {{status_page}}, {{message}},
# {{incident_title}}, {{incident_content}}, {{last_heartbeat}}
CONTEXT_INCIDENT_REPLY_TEXT=Zu Ihrer Meldung liegt derzeit wahrscheinlich eine zentrale Störung bei {{service_name}} vor. Die Einschränkung kann damit zusammenhängen. Wir beobachten den Status.
CONTEXT_MAINTENANCE_REPLY_TEXT=Für {{service_name}} läuft derzeit eine Wartung. Die von Ihnen beschriebene Einschränkung kann damit zusammenhängen. Bitte testen Sie den Dienst nach Abschluss der Wartung erneut.

# Policy gates
AUTO_CATEGORY=true
AUTO_REPLY=true
CATEGORY_CONFIDENCE=0.90
REPLY_CONFIDENCE=0.97

QUEUE_SIZE=256
WORKERS=2
