NETX_DATABASE_URL=postgresql+psycopg://netx:netx@127.0.0.1:5432/netx
# Fernet key for managed NE passwords (python -c "from cryptography.fernet import Fernet; print(Fernet.generate_key().decode())")
NETX_CREDENTIAL_SECRET_KEY=
NETX_NE_CONNECT_MAX_WORKERS=5
NETX_NE_CONNECT_TIMEOUT_SEC=30
# Managed NE CLI: max commands per exec request (default 5, hard cap 50). Lab can set 10+.
NETX_NE_EXEC_MAX_COMMANDS=5
# Opt-in: show/allow per-NE exec_policy (linux_shell|unrestricted). Default false.
NETX_NE_EXEC_POLICY_ENABLED=false
NETX_HOST=127.0.0.1
NETX_PORT=8890
NETX_VENDOR=ZTE
NETX_SOURCE_TYPE=gateway_export_excel
NETX_PARSER_CONFIG=netx_api/config/parsers/zte_alarm_monitor_v1.yaml
NETX_OCLAW_ANALYZE_URL=http://127.0.0.1:8787/admin/api/ops-ai/analyze-sync
NETX_OCLAW_ANALYZE_TOKEN=
NETX_OCLAW_HEALTH_URL=http://127.0.0.1:8787/admin/api/ops-ai/health
NETX_UME_BASE_URL=https://10.227.157.143:18014
NETX_UME_USERNAME=
NETX_UME_PASSWORD=
NETX_UME_AUTH_HEADER=accessToken
NETX_UME_CONTENT_TYPE=application/yang-data+json;charset=UTF-8
NETX_UME_TOKEN_TTL_S=1800
NETX_UME_TOKEN_REFRESH_SKEW_S=60
NETX_UME_TOKEN_PATH=/restconf/operations/zte-security:oauth_token
NETX_UME_TOKEN_HANDSHAKE_PATH=/restconf/operations/zte-security:oauth_handshake
NETX_UME_TOKEN_LOGOUT_PATH=/restconf/operations/zte-security:oauth_token
NETX_UME_NE_PATH=/restconf/data/zte-resources-module:network-elements
NETX_UME_ALARMS_PATH=/restconf/data/zte-alarms:alarms/alarm-list
NETX_UME_TOPO_NODES_PATH=/restconf/data/zte-resources-module:TopoNodes
NETX_UME_TOPOLOGICAL_LINKS_PATH=/restconf/data/zte-resources-module:TopologicalLinks
NETX_UME_SYNC_TOPOLOGY_AUTO_ENABLED=true
NETX_UME_SYNC_TOPOLOGY_EVERY_HOURS=24
# Topology dump: 0 = no read timeout (wait while TCP stays up). Set e.g. 3600 to cap.
# NETX_UME_TOPOLOGY_TIMEOUT_S=0
# Reap stuck topology jobs only after this many seconds (default 24h).
# NETX_UME_SYNC_TOPOLOGY_STALE_RUNNING_SEC=86400
NETX_UME_SYNC_ALARMS_CURRENT_ENABLED=true
NETX_UME_SYNC_ALARMS_CURRENT_INTERVAL_S=18000
NETX_UME_SYNC_ALARMS_CURRENT_SKIP_WHEN_WS=true
NETX_UME_STARTUP_SYNC_ALARMS_BEFORE_WS=true
NETX_UME_ALARM_CLEARED_TOMBSTONE_S=300
NETX_UME_ALARM_WS_ENABLED=true
NETX_UME_NOTIFICATION_ESTABLISH_PATH=/restconf/operations/zte-notifications:establish-subscription
NETX_UME_NOTIFICATION_DELETE_PATH=/restconf/operations/zte-notifications:delete-subscription
NETX_UME_NOTIFICATION_TOPIC=ALARM
# TLS verify for UME (default false for lab self-signed). Production: set true or pin a CA.
# NETX_UME_VERIFY_TLS=false
# Auth (lab defaults: admin/admin123 + data/auth/mcp_token)
# NETX_AUTH_ENABLED=true
# Leave NETX_AUTH_SECRET empty to auto-create data/auth/jwt_secret on first boot.
# NETX_AUTH_SECRET=
# NETX_AUTH_SECRET_FILE=data/auth/jwt_secret
# NETX_BOOTSTRAP_ADMIN_USERNAME=admin
# NETX_BOOTSTRAP_ADMIN_PASSWORD=admin123
# NETX_API_TOKEN=  # MCP: leave empty to auto-read data/auth/mcp_token
# API docs (/docs, /redoc, /openapi.json); default false. Lab: set true.
# NETX_DOCS_ENABLED=true
# NETX_ALLOW_INSECURE_DEFAULTS=false
# Schema: Alembic auto-upgrades on API start (defaults on). Override only if needed:
# NETX_ALEMBIC_UPGRADE_ON_START=false
# NETX_SKIP_LEGACY_STARTUP_DDL=false
# NETX_SQL_READONLY_DATABASE_URL=postgresql+psycopg://netx_ro:xxx@127.0.0.1:5432/netx
# Device collectors run inline with the API by default (frontend+backend start is enough).
# Production split only: NETX_RUN_INLINE_SCHEDULERS=false and run `python -m netx_api.worker`
# (start_netx.ps1/.sh do this automatically). Worker writes heartbeat for API /metrics.
# NETX_RUN_INLINE_SCHEDULERS=false
# NETX_SCHEDULER_HEARTBEAT_PATH=data/runtime/scheduler_heartbeat.json
# Biz-state dedicated workers (default on with split start): claim queued batches via PG.
# Rule of thumb: NETX_BIZ_STATE_MAX_CONCURRENT_TASKS * 2 <= NETX_CLI_MAX_CONCURRENT
# NETX_BIZ_STATE_DEDICATED_WORKERS=true
# NETX_BIZ_STATE_MAX_CONCURRENT_TASKS=16
# NETX_BIZ_STATE_WORKER_COLLECT_THREADS=8
# NETX_BIZ_STATE_PERSIST_WORKERS=4
# NETX_BIZ_STATE_WORKER_REPLICAS=2
# NETX_BIZ_STATE_SPOOL_DIR=data/biz_state_spool
# NETX_BIZ_STATE_PERSIST_EVERY_CMDS=8
# Parse TextFSM off SSH threads (overlap with next CLI). Default on.
# NETX_BIZ_STATE_PARSE_ASYNC=true
# NETX_BIZ_STATE_PARSE_WORKERS=8
# Dual-lane CLI timeouts (light = shared SSH; heavy = interface/route/MAC etc.):
#   READ = per-command wait; RUN_TIMEOUT_CAP = whole-lane wall clock (often the ~40min abort).
# Light lane reuses NE collect defaults below (read 120s / cap 600s ≈ 10min).
# NETX_NE_COLLECT_READ_TIMEOUT_SEC=120
# NETX_NE_COLLECT_RUN_TIMEOUT_CAP_SEC=600
# Heavy lane defaults (raise CAP if batches end around 40min as partial/timeout):
# NETX_BIZ_STATE_HEAVY_READ_TIMEOUT_SEC=1500
# NETX_BIZ_STATE_HEAVY_RUN_TIMEOUT_CAP_SEC=2400
# NETX_BIZ_STATE_HEAVY_WORKERS=4
# --- Multi-user shared-server capacity (defaults in Settings already match these) ---
# NETX_DB_POOL_SIZE=40
# NETX_DB_MAX_OVERFLOW=40
# NETX_DB_POOL_RECYCLE_SEC=1800
# NETX_DB_POOL_TIMEOUT_SEC=30
# NETX_CLI_MAX_CONCURRENT=24
# NETX_CLI_FEATURE_HARD_CAP=32
# NETX_CLI_TIMEOUT_POOL_WORKERS=24
# NETX_PORT_TRAFFIC_DISPATCH_WORKERS=6
# NETX_NE_CONNECT_MAX_WORKERS=8
# NETX_NE_COLLECT_MAX_WORKERS=8
# NETX_NE_COLLECT_RUN_TIMEOUT_CAP_SEC=600
# NETX_NE_COLLECT_MAX_OUTPUT_BYTES=8388608
# NETX_WEBCRT_MAX_SESSIONS=40
# NETX_WEBCRT_KEEPALIVE_SEC=30
# NETX_WEBCRT_OUT_QUEUE_MAX=2000
# NETX_WEBCRT_SESSION_LOG_MAX_BYTES=4194304
# NETX_WEBCRT_SFTP_MAX_FILE_BYTES=536870912
# NETX_WEBCRT_SFTP_LIST_MAX_ENTRIES=5000
# NETX_AUDIT_ASYNC=true
# NETX_AUDIT_SAMPLE_N=5
# NETX_AUDIT_QUEUE_MAX=5000
# NETX_OCLAW_FORWARD_QUEUE_MAX=5000
# NETX_OCLAW_FORWARD_MAX_RETRIES=3
# NETX_UME_RAW_JSON_MAX_BYTES=65536
# NETX_NE_COLLECTION_KEEP_DAYS=14
# Heavier fleets: raise CLI/DB together; also ensure Postgres max_connections and bastion session limits.
# One-click start (recommended): .\scripts\start_netx.ps1 -Background -WithWeb
#   -> API + netx_api.worker + N× netx_api.biz_state_worker + optional Vite
# Legacy single-process: add -InlineSchedulers
# Stop all: .\scripts\stop_netx.ps1