env.sample

# Zamboni environment. Copy to `.env` next to your zamboni.yml:
#
#   cp env.sample .env && chmod 600 .env
#
# `zamboni` reads `./.env` automatically; `--env path/to/.env` points elsewhere.
# A real environment variable always beats the file, so a container or systemd
# unit that injects secrets properly needs no .env at all -- this file exists
# because cron gives a job almost no environment, and putting credentials in the
# crontab puts them in `crontab -l`, in every backup of /var/spool/cron, and in
# the process table.
#
# **Secrets live here. Everything else belongs in zamboni.yml** -- see
# docs/devops.md §2. Keep this file out of version control; `.env` is gitignored.
#
# Every variable Zamboni reads is listed, including the ones you will not need,
# so there is one place to look rather than a grep through the source.

# --- catalog ---------------------------------------------------------------
# The REST catalog and the warehouse within it. Not secret, and usually better
# placed in zamboni.yml; here because a fleet may prefer to inject them.
#ZAMBONI_URI=https://lakekeeper.internal/catalog
#ZAMBONI_WAREHOUSE=acme

# OAuth2 client credentials for the catalog, as `id:secret`. **Secret.**
#ZAMBONI_CREDENTIAL=zamboni-svc:s3cr3t

# A bearer token, if you mint them yourself instead. **Secret.**
#ZAMBONI_TOKEN=

# Non-default OAuth2 endpoint and scope, when the catalog does not host its own.
#ZAMBONI_OAUTH_SERVER_URI=https://idp.internal/oauth2/token
#ZAMBONI_SCOPE=lakekeeper

# A local directory instead of a REST catalog. Development and tests only.
#ZAMBONI_LOCAL_WAREHOUSE=/tmp/warehouse

# --- object storage --------------------------------------------------------
# Leave these unset against a credential-vending catalog. Lakekeeper with
# `sts-enabled: true` hands out per-table credentials, which is both safer and
# the configuration that lets storage be reclaimed at all -- a remote-signing
# warehouse refuses the listing that orphan removal needs. See
# docs/live-verification.md.
#ZAMBONI_S3_ENDPOINT=https://minio.internal:9000
#ZAMBONI_S3_REGION=us-east-1

# Direct S3 credentials, only when the catalog does not vend them. **Secret.**
#ZAMBONI_S3_ACCESS_KEY_ID=
#ZAMBONI_S3_SECRET_ACCESS_KEY=

# --- engines ---------------------------------------------------------------
# None of the settings below is a secret -- a host, a port, a user name and a
# catalog name are all publishable -- so they belong in zamboni.yml, under
# `trino:` and `spark:` blocks. They are listed here because the environment
# still overrides that file, which is what you want for a one-off or a
# container. Prefer the profile for anything committed.

# Only for `--engine trino`. `zamboni engines` reports what it supports.
#ZAMBONI_TRINO_HOST=trino.internal
#ZAMBONI_TRINO_PORT=8080
#ZAMBONI_TRINO_USER=zamboni
#ZAMBONI_TRINO_CATALOG=iceberg
# Server version, e.g. 483. Gates arguments only newer Trino accepts; when unset
# the tool assumes the older behaviour rather than emitting a rejected argument.
#ZAMBONI_TRINO_VERSION=483

# Only for `--engine spark`. A Spark Connect endpoint needs no JVM here: install
# zamboni[spark-connect] (~1.5MB) rather than zamboni[spark] (~434MB and Java).
#ZAMBONI_SPARK_REMOTE=sc://spark.internal:15002
# A local driver instead of Connect. Mutually exclusive with the above, and it
# does start a JVM in this process.
#ZAMBONI_SPARK_MASTER=local[*]
#ZAMBONI_SPARK_CATALOG=iceberg
# Note: Spark's `remove-orphans` lists through Hadoop S3A and needs its own
# credentials **on the Spark server** -- `spark.hadoop.fs.s3a.*`. Zamboni cannot
# supply them; see docs/user_guide.md#secrets.

# --- layout ----------------------------------------------------------------
# Where per-warehouse configuration lives:
#   $ZAMBONI_ROOT/configs/{warehouse}/table-config.json
# Defaults to ~/.zamboni. See docs/devops.md §5.
#ZAMBONI_ROOT=/srv/zamboni