.env.example

# =============================================================================
# HotsTac(k)os Configuration
# =============================================================================
# Copy this file to .env and customize as needed
# Most defaults are fine for a single-node development environment
# =============================================================================

# -----------------------------------------------------------------------------
# Build Configuration
# -----------------------------------------------------------------------------
# Number of parallel container builds
#
# Phase 1 builds up to 4 images (base-builder, base-runtime, infra, ovn)
# Phase 2 builds up to 7 images (OpenStack services)
# Higher values speed up builds but increase memory/storage pressure.
# If you encounter storage layer corruption errors during build,
# try reducing to 1 for serial builds.
BUILD_PARALLEL=7

# Optional: Override which images to build (comma-separated)
# Uncomment to build only specific images (useful for development/testing)
# BUILD_INFRA_IMAGES=dnsmasq,haproxy,memcached,ovn,rabbitmq
# BUILD_OPENSTACK_IMAGES=keystone,glance,placement,nova,neutron,cinder,heat

# -----------------------------------------------------------------------------
# OpenStack Release
# -----------------------------------------------------------------------------
# stable/2025.2 = Flamingo (latest stable)
# master = development (not recommended for stability)
OPENSTACK_BRANCH=stable/2025.2

# -----------------------------------------------------------------------------
# Authentication & Passwords
# -----------------------------------------------------------------------------
# SECURITY: Change these passwords for production use!
# For development, simple passwords are fine

# Admin password for Keystone (user: admin)
KEYSTONE_ADMIN_PASSWORD=admin

# Root password for MariaDB
MYSQL_ROOT_PASSWORD=rootpass

# OpenStack services database password (user: openstack)
DB_PASSWORD=openstack

# Password for inter-service API authentication
SERVICE_PASSWORD=openstack

# RabbitMQ message broker credentials (required for OpenStack RPC)
RABBITMQ_DEFAULT_USER=openstack
RABBITMQ_DEFAULT_PASS=openstack

# -----------------------------------------------------------------------------
# Logging Configuration
# -----------------------------------------------------------------------------
# Enable debug logging for all OpenStack services
# When false: Only INFO, WARNING, and ERROR messages are logged
# When true: Verbose DEBUG messages are included (useful for troubleshooting)
# Default: false (debug logging disabled)
DEBUG_LOGGING=false

# -----------------------------------------------------------------------------
# Region & Networking
# -----------------------------------------------------------------------------
# OpenStack region name (affects service catalog endpoints)
REGION_NAME=RegionOne

# -----------------------------------------------------------------------------
# Network Configuration
# -----------------------------------------------------------------------------
# HotsTac(k)os uses a dedicated address space split into two subnets:
# 1. Container Network: For podman-managed OpenStack service containers
# 2. Provider Network: For OVS hot-ex bridge (VM external/floating IPs)
#
# REQUIRED: These must be set (defaults work for most users)
# Change ONLY if the default 172.31.0.0/24 range conflicts with existing networks
# If changed, ensure all IPs below are within the new CONTAINER_NETWORK range

# Container network subnet (podman bridge for service containers)
# Range: 172.31.0.0 - .127 (128 IPs)
CONTAINER_NETWORK=172.31.0.0/25

# Provider network subnet (hot-ex for VM external connectivity)
# Range: 172.31.0.128 - .255 (128 IPs)
PROVIDER_NETWORK=172.31.0.128/25

# IP address for hot-ex bridge (host connectivity to provider network)
# Must be within PROVIDER_NETWORK range
BREX_IP=172.31.0.129

# MTU Configuration for Tenant Networking
# MTU of the underlying physical network. Neutron uses this value to calculate
# MTU for all virtual network components. For overlay networks (VXLAN/GENEVE),
# Neutron automatically subtracts overlay protocol overhead from this value.
#
# With GLOBAL_PHYSNET_MTU=9216 and GENEVE overlay:
#   - Physical network MTU: 9216 (maximum jumbo frame size)
#   - GENEVE header overhead: 38 bytes
#   - Tenant network MTU: 9216 - 38 = 9178
#   - VM interfaces get MTU 9178, allowing 9000 MTU workloads with headroom
#
# Common MTU values:
#   - 1500: Standard Ethernet (yields ~1462 MTU for VMs)
#   - 9000: Common jumbo frame size (yields ~8962 MTU for VMs)
#   - 9216: Maximum jumbo frame size (yields ~9178 MTU for VMs) - default
#
# Default: 9216 (maximum jumbo frames for optimal tenant networking)
# Set to 1500 for standard Ethernet if jumbo frames are not supported
GLOBAL_PHYSNET_MTU=9216

# Path MTU for overlay/tunnel networks
# Maximum size of an IP packet that can traverse the underlying physical network
# without fragmentation when using overlay protocols (VXLAN/GENEVE).
# Should match GLOBAL_PHYSNET_MTU for most deployments.
#
# Default: 9216 (matches GLOBAL_PHYSNET_MTU)
# Set to 0 to use GLOBAL_PHYSNET_MTU value automatically
PATH_MTU=9216

# OVN chassis hostname (must match the compute node hostname for Neutron port binding)
# Auto-detected using 'hostname -f' (FQDN) with fallback to 'hostname' (short name)
# Override if: (1) no static hostname set (DHCP transient hostname), or
#             (2) seeing "Refusing to bind port due to no OVN chassis" errors
# Recommended: Set static hostname with 'sudo hostnamectl set-hostname <name>' instead
# CHASSIS_HOSTNAME=your-hostname.example.com

# Static IP addresses for OpenStack service containers
# All IPs must be within CONTAINER_NETWORK range (172.31.0.0/25 = .0 to .127)
# Organized by service group for clarity

# Infrastructure Services
MARIADB_IP=172.31.0.3
RABBITMQ_IP=172.31.0.4
MEMCACHED_IP=172.31.0.5
HAPROXY_IP=172.31.0.6

# Identity & Core Services
KEYSTONE_IP=172.31.0.11
GLANCE_IP=172.31.0.12
PLACEMENT_IP=172.31.0.13

# Compute Services (Nova)
NOVA_API_IP=172.31.0.21
NOVA_CONDUCTOR_IP=172.31.0.22
NOVA_SCHEDULER_IP=172.31.0.23
NOVA_COMPUTE_IP=172.31.0.24
NOVA_METADATA_IP=172.31.0.25
NOVA_NOVNCPROXY_IP=172.31.0.26

# Networking Services (OVN/Neutron)
OVN_NORTHD_IP=172.31.0.31
NEUTRON_SERVER_IP=172.31.0.32

# Block Storage Services (Cinder)
CINDER_API_IP=172.31.0.41
CINDER_SCHEDULER_IP=172.31.0.42
CINDER_VOLUME_IP=172.31.0.43

# Orchestration Services (Heat)
HEAT_API_IP=172.31.0.51
HEAT_ENGINE_IP=172.31.0.53

# -----------------------------------------------------------------------------
# Storage Paths
# -----------------------------------------------------------------------------
# Data directory for all persistent storage (databases, logs, images, volumes)
# Default: /var/lib/hotstack-os (system path, created with user ownership by setup)
# Override only if you need a custom location (use absolute paths)
# HOTSTACK_DATA_DIR=/custom/absolute/path

# Nova VM instances directory on host (requires libvirt access)
# Default: ${HOTSTACK_DATA_DIR}/nova-instances (isolated from system Nova)
# Maps to Nova's instances_path configuration option
# IMPORTANT: This path must be identical in both host and container for libvirt compatibility
# For custom paths, set correct SELinux context:
#   sudo semanage fcontext -a -t svirt_image_t "/custom/path(/.*)?"
#   sudo restorecon -Rv /custom/path
# NOVA_INSTANCES_PATH=${HOTSTACK_DATA_DIR}/nova-instances

# Nova volume mount directory on host (for Cinder volume attachments)
# Default: ${HOTSTACK_DATA_DIR}/nova-mnt (isolated from system Nova)
# Maps to Nova's libvirt.nfs_mount_point_base configuration option
# mount.nfs wrapper creates bind mounts here for direct filesystem access
# IMPORTANT: This path must be identical in both host and container for libvirt compatibility
# For custom paths, set correct SELinux context:
#   sudo semanage fcontext -a -t virt_var_lib_t "/custom/path(/.*)?"
#   sudo restorecon -Rv /custom/path
# NOVA_NFS_MOUNT_POINT_BASE=${HOTSTACK_DATA_DIR}/nova-mnt

# Cinder volumes storage directory
# Directory for Cinder volume storage on host
# mount.nfs wrapper uses this directory for bind mounts (no NFS server needed)
# Default: /var/lib/hotstack-os/cinder-nfs (created by setup)
# Override only if you need a custom location (use absolute paths)
# CINDER_NFS_EXPORT_DIR=/custom/path/cinder-nfs

# -----------------------------------------------------------------------------
# HotStack Project Quotas
# -----------------------------------------------------------------------------
# Quotas for the hotstack project created by 'make post-setup'
# Override these to adjust resource limits for HotStack development/testing
# Defaults are generous for development purposes
# HOTSTACK_QUOTA_COMPUTE_CORES=96
# HOTSTACK_QUOTA_COMPUTE_RAM=307200  # 300GB RAM in MB
# HOTSTACK_QUOTA_COMPUTE_INSTANCES=50
# HOTSTACK_QUOTA_COMPUTE_KEY_PAIRS=10
# HOTSTACK_QUOTA_COMPUTE_SERVER_GROUPS=10
# HOTSTACK_QUOTA_COMPUTE_SERVER_GROUP_MEMBERS=10
# HOTSTACK_QUOTA_NETWORK_NETWORKS=20
# HOTSTACK_QUOTA_NETWORK_SUBNETS=20
# HOTSTACK_QUOTA_NETWORK_PORTS=100
# HOTSTACK_QUOTA_NETWORK_ROUTERS=20
# HOTSTACK_QUOTA_NETWORK_FLOATINGIPS=20
# HOTSTACK_QUOTA_NETWORK_SECURITY_GROUPS=20
# HOTSTACK_QUOTA_NETWORK_SECURITY_GROUP_RULES=100
# HOTSTACK_QUOTA_VOLUME_VOLUMES=50
# HOTSTACK_QUOTA_VOLUME_SNAPSHOTS=20
# HOTSTACK_QUOTA_VOLUME_GIGABYTES=1000  # 1TB
# HOTSTACK_QUOTA_VOLUME_PER_VOLUME_GIGABYTES=500

# -----------------------------------------------------------------------------
# Post-Setup Network Configuration
# -----------------------------------------------------------------------------
# Network settings for 'make post-setup' (private and provider networks)
# Defaults match the HotsTac(k)os container network configuration
# HOTSTACK_PRIVATE_CIDR=192.168.100.0/24
# HOTSTACK_PROVIDER_CIDR=172.31.0.128/25
# HOTSTACK_PROVIDER_GATEWAY=172.31.0.129

# -----------------------------------------------------------------------------
# Post-Setup Image URLs
# -----------------------------------------------------------------------------
# Image URLs for 'make post-setup' - download and upload to Glance
# Defaults use GitHub releases (latest builds)
# Override to use custom HTTP/HTTPS mirrors (local files not supported)
# Downloaded images are cached in ~/.cache/hotstack-os/images/
# HOTSTACK_CIRROS_URL=http://download.cirros-cloud.net/0.6.2/cirros-0.6.2-x86_64-disk.img
# HOTSTACK_CENTOS_STREAM_9_URL=https://cloud.centos.org/centos/9-stream/x86_64/images/CentOS-Stream-GenericCloud-x86_64-9-latest.x86_64.qcow2
# HOTSTACK_UBUNTU_NOBLE_URL=https://cloud-images.ubuntu.com/noble/current/noble-server-cloudimg-amd64.img
# HOTSTACK_CONTROLLER_IMAGE_URL=https://github.com/openstack-k8s-operators/hotstack/releases/download/latest-controller/controller-latest.qcow2
# HOTSTACK_BLANK_IMAGE_URL=https://github.com/openstack-k8s-operators/hotstack/releases/download/latest-blank/blank-image-latest.qcow2
# HOTSTACK_UEFI_NETBOOT_URL=https://github.com/openstack-k8s-operators/hotstack/releases/download/latest-uefi-netboot/uefi-netboot-latest.img
# HOTSTACK_IPXE_BIOS_URL=https://github.com/openstack-k8s-operators/hotstack/releases/download/latest-ipxe/ipxe-bios-latest.img
# HOTSTACK_IPXE_EFI_URL=https://github.com/openstack-k8s-operators/hotstack/releases/download/latest-ipxe/ipxe-efi-latest.img
# HOTSTACK_NAT64_IMAGE_URL=https://github.com/openstack-k8s-operators/openstack-k8s-operators-ci/releases/download/latest/nat64-appliance-latest.qcow2