params.example.json

// scripts/azure/params.example.json -- Example params file for `azure:provision-infra`.
//
// Usage:
//   node scripts/azure/cli.mjs provision-infra --params-file scripts/azure/params.my-env.json
//
// Precedence: CLI flags > environment variables > this params file >
// detected defaults (scripts/azure/variables.mjs's DEFAULTS) > interactive
// prompt (TTY only). Copy this file, remove the comments if you want strict
// JSON, and fill in your own values -- JSONC (// and /* */ comments, trailing
// commas) is tolerated on a best-effort basis by lib/config.mjs's parseJsonc().
//
// NEVER commit a params file containing a real GITHUB_CLIENT_SECRET. Prefer
// the GITHUB_CLIENT_SECRET environment variable or the interactive secret
// prompt for that field; it is accepted here only for fully unattended CI use
// against disposable/test environments.
{
  // Azure resource names (all optional -- fall back to variables.mjs's DEFAULTS --
  // EXCEPT KEYVAULT_NAME, see below).
  "RESOURCE_GROUP": "agentweaver-rg",
  "CLUSTER_NAME": "agentweaver-aks",
  "ACR_NAME": "agentweaverregistry",
  "LOCATION": "westus2",
  // "MONITORING_LOCATION": "eastus2", // Preferred region for new Log Analytics and Application Insights resources. Defaults to LOCATION and auto-falls back when unsupported.
  "NODE_VM_SIZE": "Standard_D4s_v6",

  // Optional for `provision-infra` (defaults to a suggested name it will create if missing).
  // REQUIRED for deploy commands (deploy-from-local/deploy-from-release/deploy-from-commit/verify):
  // no default -- must be the name of the Key Vault ALREADY provisioned for this environment.
  // There is deliberately no generic fallback here: a wrong-but-plausible name silently redirects
  // the rendered ConfigMap/SecretProviderClass Key Vault references (and the GitHub OAuth secret
  // lookups that flow from them) at the wrong vault instead of failing loudly. Look yours up with
  // `az keyvault list --resource-group <RESOURCE_GROUP> --query "[].name" -o tsv`.
  "KEYVAULT_NAME": "REPLACE_WITH_YOUR_PROVISIONED_KEYVAULT_NAME",

  "NAMESPACE": "agentweaver",

  // Required for AKS deploy mode (no default; must come from a flag, env var,
  // this params file, or an interactive prompt).
  "GITHUB_CLIENT_ID": "your-github-oauth-app-client-id",
  "GITHUB_CLIENT_SECRET": "",
  // "GITHUB_ALLOWED_ORG": "microsoft", // Comma-separated GitHub org login(s) allowed to sign in.

  // Optional: switch sign-in mode. Valid values: "GitHubLegacy" (default) or "Entra" (Microsoft
  // Entra ID). When AUTH_MODE is "Entra", ENTRA_CLIENT_ID and ENTRA_TENANT_ID are required.
  // "AUTH_MODE": "Entra",
  // "ENTRA_CLIENT_ID": "your-entra-app-client-id",
  // "ENTRA_TENANT_ID": "your-entra-tenant-id",

  // Optional overrides.
  // "PG_SERVER_NAME": "agentweaver-pg-staging", // Override the globally-unique Azure Flexible Server name if "agentweaver-pg" is already reserved.
  // "PG_LOCATION": "eastus2", // Defaults to LOCATION. Set this only when Postgres must live in a different Azure region than AKS.
  // "PG_HA_MODE": "Disabled", // Valid values: ZoneRedundant, Disabled. Use this in regions/environments where zone-redundant HA is unavailable.
  // "PG_ACCESS_MODE": "public", // Valid values: private, public. Required when PG_LOCATION differs from LOCATION because delegated private access is single-region only.
  "IMAGE_TAG": "",
  // Optional custom-image mode (IMAGE_SOURCE=custom): all four refs are required together.
  // "IMAGE_API": "ghcr.io/your-org/agentweaver-api:v1.2.3",
  // "IMAGE_FRONTEND": "ghcr.io/your-org/agentweaver-frontend:v1.2.3",
  // "IMAGE_MCP": "ghcr.io/your-org/agentweaver-mcp:v1.2.3",
  // "IMAGE_AGENT_HOST": "ghcr.io/your-org/agentweaver-agent-host:v1.2.3",
  "SKIP_POSTGRES": false,
  "SKIP_OAUTH_KEY": false
}