HOST=127.0.0.1
PORT=8000
# Configure the same trusted service secret used by internal HMAC clients.
HMAC_SECRET_KEY=replace-with-a-service-secret
JWKS_PUBLIC_KEY_URL=https://iam.example.com/.well-known/jwks.json
# Optional additional issuer/audience constraints.
# JWT_ISSUER=https://iam.example.com
# JWT_AUDIENCE=https://cac.example.com
RUST_LOG=info
# OTEL_EXPORTER_OTLP_ENDPOINT=http://127.0.0.1:4318
# OTEL_EXPORTER_OTLP_PROTOCOL=http/protobuf
# MCP shares PORT; set public hosts/origins explicitly behind a proxy.
MCP_ENABLED=true
MCP_PATH=/mcp
# MCP_ALLOWED_HOSTS=api.example.com
# MCP_ALLOWED_ORIGINS=https://app.example.com:443
# MCP uses the HTTP listener by default. For a separate listener:
# MCP_LISTENER=separate
# MCP_PORT=10000
# MCP_HOST=127.0.0.1
# Without MCP_PORT, separate mode uses the HTTP port + 2000.
# MCP_PATH=/mcp
# MCP_ENABLED=false