# Copy to .env and adjust. The example server loads .env at startup.
DATABASE_URL=postgres://localhost/architect
# Schema where _sys_* config tables live (default: architect). Must be a valid PostgreSQL identifier.
# ARCHITECT_SCHEMA=architect
# Optional: package directory containing manifest.json + config JSONs. If unset, config is loaded from DB (insert via config APIs or POST /api/v1/config/package).
# PACKAGE_PATH=sample
# Optional: max items allowed in a single bulk create/update/delete request (default: 100).
# Applies to POST/PATCH/DELETE on /api/v1/:entity/bulk. Empty, non-numeric, or 0 falls back to 100.
# ARCHITECT_BULK_LIMIT=100
# Reports (read-only reporting queries via POST /api/v1/reports/:id/run).
# Statement timeout applied to each report query, in milliseconds (default: 30000).
# ARCHITECT_REPORT_TIMEOUT_MS=30000
# SDK-enforced maximum rows returned by a report (default: 10000).
# ARCHITECT_REPORT_MAX_ROWS=10000
# Optional dedicated read-only DB role. When set, report queries run under SET LOCAL ROLE <role>
# for defense-in-depth (grant it SELECT only, and omit SELECT on sensitive columns).
# ARCHITECT_REPORT_ROLE=architect_readonly
# Optional result caching. Off by default; set to 1/true to cache report results in _sys_kv_data
# (reserved namespace __report_cache__). Cache key is auto-built from report id + tenant + params.
# ARCHITECT_REPORT_CACHE=false
# Default cache TTL in seconds when a report does not set its own cache_ttl_secs (default: 300).
# ARCHITECT_REPORT_CACHE_TTL_SECS=300
# Optional: force the WHOLE app to one tenant-isolation strategy, ignoring each tenant's
# _sys_tenants.strategy. Unset (default) = per-tenant strategy from the DB.
# ARCHITECT_TENANT_STRATEGY=rls - every tenant shares the central DB with RLS policies
# (per-tenant database_url is ignored). Required model for
# `global` shared tables. Intended for greenfield deploys.
# ARCHITECT_TENANT_STRATEGY=database - every tenant uses its own DB (each must have a database_url;
# tenants without one are skipped at load).
# Deployment-time knob: it does NOT migrate existing data between the RLS and Database layouts.
# ARCHITECT_TENANT_STRATEGY=rls
# Optional: tenant id treated as Platform Admin — the only principal allowed to write `global`
# (cross-tenant shared) tables. Default: _platform. Must match across processes sharing a DB.
# The Platform Admin can also act as any RLS tenant for full CRUD by sending request header
# X-Act-As-Tenant: <tenant-id> (alongside X-Tenant-ID: _platform)
# The request then runs scoped to that tenant. Non-admin callers using the header get 403.
# ARCHITECT_PLATFORM_TENANT=_platform
# Log levels (default: architect_sdk=info). Set to see logs and SQL:
# RUST_LOG=architect_sdk=info - normal
# RUST_LOG=architect_sdk=debug - includes all SQL queries
# RUST_LOG=debug - verbose
# RUST_LOG=architect_sdk=info
# ── Storage provider ────────────────────────────────────────────────────────
# Set STORAGE_PROVIDER to enable asset upload/presign/delete.
# Also enable the matching Cargo feature when building the SDK.
# STORAGE_PROVIDER=s3 # requires feature: storage-s3
# STORAGE_PROVIDER=rustfs # requires feature: storage-s3
# STORAGE_PROVIDER=azure # requires feature: storage-azure
# STORAGE_PROVIDER=gcs # requires feature: storage-gcs
# AWS S3 / RustFS (storage-s3 feature)
# STORAGE_BUCKET=my-bucket
# AWS_ACCESS_KEY_ID=AKIA...
# AWS_SECRET_ACCESS_KEY=...
# AWS_REGION=us-east-1
# STORAGE_ENDPOINT=http://localhost:9000 # RustFS / MinIO only
# Azure Blob Storage (storage-azure feature)
# AZURE_STORAGE_CONTAINER=my-container
# Option A — connection string (includes account name + key):
# AZURE_STORAGE_CONNECTION_STRING=DefaultEndpointsProtocol=https;AccountName=...;AccountKey=...
# Option B — account + key (SharedKey):
# AZURE_STORAGE_ACCOUNT=myaccount
# AZURE_STORAGE_ACCESS_KEY=base64key==
# Option C — Managed Identity (no key needed; presign uses User Delegation SAS):
# AZURE_STORAGE_ACCOUNT=myaccount
# Local dev: set AZURE_STORAGE_CONNECTION_STRING=UseDevelopmentStorage=true (Azurite)
# Google Cloud Storage (storage-gcs feature)
# GCS_BUCKET=my-bucket
# Option A — inline service account JSON:
# GCS_SERVICE_ACCOUNT_JSON={"type":"service_account","project_id":...}
# Option B — path to service account key file:
# GOOGLE_APPLICATION_CREDENTIALS=/path/to/key.json
# Option C — ADC / Workload Identity (no key needed; presign uses IAM signBlob API):
# Set neither of the above; ADC is used automatically on GCP (Cloud Run, GKE, Compute Engine)