# PDT Environment Configuration Example
# Server Settings
PDT_HOST=0.0.0.0
PDT_PORT=8080
RUST_LOG=pdt=debug,tower_http=debug
# Root storage backend: "mongodb" (default) or "sqlite"
PDT_DB_BACKEND=mongodb
# SQLite root-backend settings (used when PDT_DB_BACKEND=sqlite)
SQLITE_PATH=./pdt.db
# Multi-instance tenancy: per-instance SQLite DBs are created under this dir
PDT_INSTANCES_DIR=./instances
# Database Settings (DocumentDB / MongoDB — used when PDT_DB_BACKEND=mongodb)
DOCUMENTDB_URL=mongodb://localhost:27017
DOCUMENTDB_USERNAME=admin
DOCUMENTDB_PASSWORD=change-me
DOCUMENTDB_DATABASE=pdt
DOCUMENTDB_TLS=false
DOCUMENTDB_TLS_ALLOW_INVALID=false
# Auth Configuration (PEP Integration)
# Enable/disable authentication enforcement
AUTH_ENABLED=true
# OIDC Issuer URL (e.g., Kanidm, Keycloak, Auth0)
AUTH_ISSUER_URL=https://auth.example.com
# Expected audience (client ID) in the JWT
AUTH_AUDIENCE=pdt-api
# Development mode: injects mock claims if token is missing or auth is disabled
# WARNING: Never enable in production. Set to 'true' for local development.
AUTH_DEV_MODE=false
# Cedar Authorization Configuration
# Enable/disable Cedar ABAC policy enforcement
CEDAR_ENABLED=false
# Path to Cedar policy files directory
CEDAR_POLICY_PATH=./policies
# Path to Cedar schema file
CEDAR_SCHEMA_PATH=./policies/schema.cedarschema
# Validate policies against schema on startup
CEDAR_VALIDATE_ON_LOAD=true
# Default decision when no policy matches: "deny" (secure) or "allow" (dev only)
CEDAR_DEFAULT_DECISION=deny