.env.example

# Non-secret local configuration for agent-lab.
# Copy to .env.local and edit there. Do not put real secrets in either file.

AGENT_LAB_AGENTS_SUBNET=172.30.0.0/24
AGENT_LAB_DNS_IP=172.30.0.10
AGENT_LAB_PROXY_IP=172.30.0.20
AGENT_LAB_PROXY_PORT=3128

HTTP_PROXY=http://172.30.0.20:3128
HTTPS_PROXY=http://172.30.0.20:3128
NO_PROXY=localhost,127.0.0.1,::1,172.30.0.0/24

AGENT_LAB_ALLOWED_TEST_DOMAIN=example.com
AGENT_LAB_DIRECT_TEST_IP=1.1.1.1
AGENT_LAB_EGRESS_ALLOWLIST=./policies/egress.allowlist.example

# If you change AGENT_LAB_AGENTS_SUBNET, AGENT_LAB_DNS_IP, or
# AGENT_LAB_PROXY_IP, also update dns/coredns/Corefile and
# gateway/squid/squid.conf. Those files intentionally stay explicit so the
# enforced boundary is easy to inspect.

# --- Bring-your-own agent (scripts/agent) ---
# Agent/dev image. Unset = build & use the local devbox (agent-lab/devbox:local).
#AGENT_LAB_AGENT_IMAGE=agent-lab/devbox:local
# Host dir mounted RW at /workspace (guarded). Unset = ephemeral named volume.
#AGENT_LAB_PROJECT_DIR=/abs/path/to/your/project
# Comma-separated egress recipes from policies/recipes/. Default deny-all.
#AGENT_LAB_ALLOWLIST_RECIPES=base
# 1 = map /home/agent to tmpfs (no token/cache persistence).
#AGENT_LAB_EPHEMERAL_HOME=0
# Read-only secrets dir (file-per-secret), mounted at /run/agent-secrets.
#AGENT_LAB_SECRETS_DIR=./secrets
# Agent UID/GID and resource caps.
#AGENT_LAB_AGENT_UID=1000
#AGENT_LAB_AGENT_GID=1000
#AGENT_LAB_AGENT_MEM=4g
#AGENT_LAB_AGENT_CPUS=2
# Leave UNSET when using recipes; scripts/agent generates & exports it.
#AGENT_LAB_EGRESS_ALLOWLIST=