# Non-secret VM2 deployment manifest. Never add DSNs, passwords, tokens or keys.
APP_ENV=production-like
RELEASE_VERSION=<immutable-release>
SECRETS_SOURCE=selectel
MESSAGE_SAFETY_IMAGE=<registry>/han-message-safety@sha256:<digest>
BITRIX_SYNC_IMAGE=<registry>/han-bitrix-sync@sha256:<digest>
NGINX_IMAGE=nginxinc/nginx-unprivileged@sha256:<reviewed-digest>
REDIS_IMAGE=redis@sha256:<reviewed-digest>
CLAMAV_IMAGE=clamav/clamav@sha256:<reviewed-digest>
OTEL_COLLECTOR_IMAGE=otel/opentelemetry-collector-contrib@sha256:<reviewed-digest>

PROCESSING_PUBLIC_HOST=<processing-public-host>
PROCESSING_PRIVATE_BIND_ADDRESS=<vm2-private-ip>
PG_CA_HOST_PATH=/etc/han/ca/managed-postgresql-ca.pem

MESSAGE_SAFETY_HOST=0.0.0.0
MESSAGE_SAFETY_PORT=8080
MESSAGE_SAFETY_WORKER_CONCURRENCY=5
MESSAGE_SAFETY_DNS_RESOLVERS=<vpc-resolver-ip>
MESSAGE_SAFETY_CLAMAV_HOST=clamd
MESSAGE_SAFETY_CLAMAV_PORT=3310
MESSAGE_SAFETY_ARTIFACTS_DIR=/app/app/artifacts
MESSAGE_SAFETY_MODE_FILE=/etc/han-chat/message-safety-mode.env

SELECTEL_S3_ENDPOINT_URL=https://s3.storage.selcloud.ru
SELECTEL_S3_BUCKET_QUARANTINE=<quarantine-bucket>

BITRIX_SYNC_ENABLED=false
BITRIX_SYNC_MODE=disabled
BITRIX_SYNC_CONTACT_USER_ID_FIELD=UF_CRM_<latin_letters_or_digits>
BITRIX_SYNC_CONTACT_REGISTERED_FIELD=UF_CRM_<latin_letters_or_digits>
BITRIX_SYNC_CONTACT_CITIZENSHIP_FIELD=UF_CRM_<latin_letters_or_digits>
BITRIX_SYNC_PORTAL_HOST=<approved-portal>.bitrix24.ru
BITRIX_SYNC_PORTAL_MEMBER_ID=<approved-member-id>
BITRIX_SYNC_PUBLIC_BASE_URL=https://<processing-public-host>
BITRIX_WEBHOOK_ALLOWED_CIDRS=<reviewed-comma-separated-cidrs>
BITRIX_SYNC_HTTP_TIMEOUT_SEC=10
BITRIX_SYNC_DB_POOL_SIZE=5

OTEL_EXPORTER_OTLP_ENDPOINT=http://otel-collector:4317
OTEL_REMOTE_ENDPOINT=<private-signoz-host>:4317
OTEL_REMOTE_TLS_INSECURE=true