portal/config/runtime.exs

import Config

# Runtime secrets — each release only requires its own secret key
if config_env() == :prod do
  # RELEASE_NAME is set by the Elixir release scripts at startup.
  # Each release only requires its own secret key.
  release = System.get_env("RELEASE_NAME", "")

  if release != "centralcloud_staff" do
    config :centralcloud_my, CentralcloudMy.Endpoint,
      secret_key_base: System.fetch_env!("MY_SECRET_KEY_BASE")
  end

  if release != "centralcloud_my" do
    config :centralcloud_staff, CentralcloudStaff.Endpoint,
      secret_key_base: System.fetch_env!("OPS_SECRET_KEY_BASE")
  end
end

config :centralcloud_core, :hostbill,
  base_url: System.get_env("HOSTBILL_URL", "https://portal.centralcloud.com"),
  api_id:   System.get_env("HOSTBILL_API_ID"),
  api_key:  System.get_env("HOSTBILL_API_KEY")

config :centralcloud_core, :dr_portal,
  base_url: System.get_env("DR_PORTAL_URL", "https://dr.centralcloud.com"),
  api_key:  System.get_env("DR_PORTAL_API_KEY")

config :centralcloud_core, :oncall,
  base_url: System.get_env("ONCALL_URL", "https://oncall.centralcloud.com"),
  token:    System.get_env("ONCALL_API_TOKEN")

config :centralcloud_core, :oidc,
  issuer:        System.get_env("AUTHENTIK_ISSUER", "https://sso.centralcloud.com/application/o/centralcloud/"),
  client_id:     System.get_env("OIDC_CLIENT_ID"),
  client_secret: System.get_env("OIDC_CLIENT_SECRET")

config :centralcloud_staff, :router_agent,
  url:     System.get_env("ROUTER_AGENT_URL", "http://router-agent.router-agent.svc:8642"),
  api_key: System.get_env("ROUTER_AGENT_API_KEY", "")

config :centralcloud_staff, :ops_engine,
  url: System.get_env("OPS_ENGINE_URL", "http://centralcloud-ops.centralcloud-ops.svc.cluster.local")

# Security monitoring — only available in centralcloud_my release
if config_env() == :prod and System.get_env("SECURITY_URL") do
  config :centralcloud_core, :security,
    url:        System.get_env("SECURITY_URL"),
    username:   System.get_env("SECURITY_USERNAME"),
    password:   System.get_env("SECURITY_PASSWORD"),
    verify_ssl: System.get_env("SECURITY_VERIFY_SSL", "true") != "false"
end