.env.example

# ─────────────────────────────────────────────────────────────────────────────
# Ares environment template. Copy to .env and fill in the values:
#     cp .env.example .env
# .env is gitignored — never commit real secrets.
# ─────────────────────────────────────────────────────────────────────────────

# ── LLM API keys (required — drives red & blue agents) ──
ANTHROPIC_API_KEY=sk-ant-xxxxxxxx
OPENAI_API_KEY=sk-xxxxxxxx

# ── Observability stack (blue-team investigation + benchmark capture/replay) ──
GRAFANA_URL=https://<your-grafana-host>
GRAFANA_SERVICE_ACCOUNT_TOKEN=glsa_xxxxxxxx
LOKI_URL=https://<your-loki-host>
LOKI_AUTH_TOKEN=<loki-token-if-required>

# kubeconfig context alias for the observability cluster, used by `task
# obs:forward`. Must match the --alias you passed to `aws eks update-kubeconfig`.
OBS_CONTEXT=obs

# ── Box-context observability (EC2 ops) ──
# The URLs above are the laptop's view (usually localhost via `task obs:forward`).
# These are what gets baked into the launch script on the EC2 box, which needs
# endpoints it can reach itself. Leave empty to keep the URLs above verbatim.
EC2_GRAFANA_URL=https://<your-grafana-host-reachable-from-ec2>
EC2_LOKI_URL=https://<your-loki-host-reachable-from-ec2>

# ── Dreadnode platform (telemetry / reporting) ──
DREADNODE_API_KEY=<dreadnode-api-key>
DREADNODE_SERVER_URL=https://<dreadnode-server>

# ── EC2 deploy: S3 bucket that stages the cross-compiled binary (task ec2:deploy) ──
S3_BUCKET=<your-ares-staging-bucket>

# ── benchmark replay: provisioning the replay stack EC2 ──
# The SG must open 3000/3100/9090/3200 to the investigator; the instance
# profile must grant S3 read on the snapshot bucket; the subnet must be
# reachable from whichever box runs the investigation.
BENCHMARK_SECURITY_GROUP_ID=sg-XXXXXXXXXXXXXXXXX
BENCHMARK_INSTANCE_PROFILE=<your-benchmark-instance-profile>
BENCHMARK_SUBNET_ID=subnet-XXXXXXXXXXXXXXXXX
# Optional overrides:
# Snapshot storage. Required by `ares benchmark` — no bucket is compiled into
# the binary. These override the (empty) benchmark: section of config/ares.yaml.
BENCHMARK_S3_BUCKET=<your-benchmark-bucket>
BENCHMARK_AWS_PROFILE=<your-aws-profile>
BENCHMARK_AWS_REGION=<your-benchmark-region>
# Bucket Loki itself writes chunks to — often a different account and region.
LOKI_S3_BUCKET=<your-loki-chunk-bucket>
LOKI_S3_REGION=<your-loki-region>
LOKI_S3_PROFILE=<your-infra-aws-profile>
# BENCHMARK_INSTANCE_TYPE=t3.medium
# ARES_SECRETS_ID=ares/api-keys   # Secrets Manager id fetched during EC2 re-exec