# Safe defaults: nothing is written until DRY_RUN=false.
DRY_RUN=true
LOG_LEVEL=info
HTTP_ADDR=:8080
DATA_DIR=./data

# Dashboard auth (required unless WEB_ALLOW_ANONYMOUS=true)
WEB_USERNAME=admin
WEB_PASSWORD=CHANGE_ME_NOW
WEB_ALLOW_ANONYMOUS=false

# Optional GLPI webhook authentication.
# Configure GLPI to send the same secret as X-Webhook-Secret if your webhook supports custom headers.
WEBHOOK_SECRET=CHANGE_ME_WEBHOOK_SECRET

# GLPI 11 High-Level API / OAuth2 password grant
GLPI_URL=https://glpi.example.org
GLPI_API_VERSION=v2.3
GLPI_CLIENT_ID=CHANGE_ME
GLPI_CLIENT_SECRET=CHANGE_ME
GLPI_USERNAME=svc-ai-agent
GLPI_PASSWORD=CHANGE_ME
# Required before AUTO_REPLY=true; numeric GLPI user id of svc-ai-agent.
GLPI_AGENT_USER_ID=0
# Keep false in production. Only useful for local test GLPI instances over plain HTTP.
GLPI_ALLOW_INSECURE_HTTP=false
# Fail-closed processing whitelist. GLPI status 1 is "New"; add more IDs only deliberately.
GLPI_ALLOWED_STATUS_IDS=1
GLPI_POLL_INTERVAL=30s
GLPI_POLL_LIMIT=50
# Optional server-side optimization; the agent still enforces GLPI_ALLOWED_STATUS_IDS itself.
# Verify filter syntax against /api.php/doc on your instance when changing it.
GLPI_TICKET_FILTER=status.id==1
GLPI_TIMEOUT=20s

# Ollama
OLLAMA_URL=http://localhost:11434
OLLAMA_MODEL=qwen3:8b
OLLAMA_EMBEDDING_MODEL=embeddinggemma
OLLAMA_TIMEOUT=10m
OLLAMA_NUM_PREDICT=256
OLLAMA_KEEP_ALIVE=10m
OLLAMA_THINK=false
OLLAMA_MAX_CONCURRENT=1

# RAG / Knowledge
KNOWLEDGE_DIR=./knowledge
RAG_ENABLED=true
KNOWLEDGE_TOP_K=3
KNOWLEDGE_MIN_SCORE=0.88
CATEGORY_PROMPT_LIMIT=80
# Fail-closed source policy. Only documents carrying one of these source labels are indexed/searched.
KNOWLEDGE_ALLOWED_SOURCES=internal-kb
# Must be a subset of KNOWLEDGE_ALLOWED_SOURCES. Set to "none" to disable source-based auto-replies.
KNOWLEDGE_AUTO_REPLY_SOURCES=internal-kb

# Communication policy for end-user replies. Auto-reply KB documents must carry matching metadata.
COMMUNICATION_LANGUAGE=de-DE
COMMUNICATION_STYLE=formal
COMMUNICATION_SALUTATION=Guten Tag,
COMMUNICATION_CLOSING=Mit freundlichen Grüßen
COMMUNICATION_SIGNATURE=IT-Service


# Read-only operational context. These sources never receive write access.
CONTEXT_ENABLED=true
CONTEXT_TIMEOUT=12s
# Minimum deterministic token-overlap score for an incident/outage to be treated as relevant to a ticket.
CONTEXT_RELEVANCE_MIN_SCORE=0.20
# Safe defaults: missing context or a relevant central incident suppresses automatic end-user replies.
CONTEXT_BLOCK_AUTO_REPLY_ON_ERRORS=true
CONTEXT_BLOCK_AUTO_REPLY_ON_INCIDENT=true

# GLPI Change Calendar. The route is checked against /api.php/doc.json at startup.
CHANGE_CALENDAR_ENABLED=true
GLPI_CHANGE_PATH=/Assistance/Change
GLPI_CHANGE_FILTER=
GLPI_CHANGE_LIMIT=100
CHANGE_LOOKBACK=48h
CHANGE_LOOKAHEAD=24h

# Active Major Incidents are modeled as GLPI Tickets selected by YOUR explicit filter.
# Enable only after validating the filter against your GLPI /api.php/doc / getting-started docs.
MAJOR_INCIDENTS_ENABLED=false
GLPI_MAJOR_INCIDENT_FILTER=
GLPI_MAJOR_INCIDENT_LIMIT=20

# Requester -> device context. Direct ticket-linked items are always reused; this optional lookup
# additionally searches assigned assets for each requester extracted from the ticket response.
USER_DEVICE_CONTEXT_ENABLED=true
GLPI_USER_DEVICE_PATHS=/Assets/Computer
GLPI_USER_DEVICE_FILTER_TEMPLATE=user.id=={{user_id}}
GLPI_USER_DEVICE_LIMIT=20

# Uptime Kuma (read-only). Recommended for internal systems: authenticated Prometheus /metrics.
UPTIME_KUMA_ENABLED=false
UPTIME_KUMA_URL=https://uptime.example.org
# metrics | status_page
UPTIME_KUMA_MODE=metrics
# Required in metrics mode. Uptime Kuma uses the API key as the HTTP Basic Auth password.
UPTIME_KUMA_API_KEY=CHANGE_ME
# Required only in status_page mode; comma-separated published Status Page slugs.
UPTIME_KUMA_STATUS_PAGES=it-services
UPTIME_KUMA_TIMEOUT=10s
UPTIME_KUMA_MAX_ISSUES=20
UPTIME_KUMA_INCLUDE_MAINTENANCE=true

# Policy gates
AUTO_CATEGORY=true
AUTO_REPLY=false
CATEGORY_CONFIDENCE=0.90
REPLY_CONFIDENCE=0.97

QUEUE_SIZE=256
WORKERS=2