# Launch-time env for a cascade trainer-worker pod.
#
# Pass these at pod launch (Shadeform / Targon / Lium env config). NONE of this
# is baked into the image. The wallet is never here — signing stays on the
# orchestrator.

# The orchestrator's SSH PUBLIC key (the wallet-holding CPU box that dispatches
# in). Only this key can reach the worker.
SSH_PUBKEY="ssh-ed25519 AAAA...replace-me... trainer-orchestrator"

# Hippius registry (checkpoints/generators) + S3 (logs). Read/write as the
# worker needs to fetch the generator and push the checkpoint back.
#
# Recommended: DON'T set these at launch. List them under `forward_env` in
# hosts.toml so the orchestrator forwards them inline per-dispatch and they
# never land on the pod's disk or persistent env. Kept here for reference.
HIPPIUS_HUB_TOKEN=
HIPPIUS_S3_ACCESS_KEY=
HIPPIUS_S3_SECRET_KEY=

# Optional: Cloudflare R2 (or any S3-compatible) BACKUP of the manifest/receipt
# bucket. Only needed when `[storage] backup_s3_endpoint` is set in chain.toml —
# then every manifest/receipt is dual-written to R2 as an off-Hippius backup.
# An R2 API token, distinct from the Hippius keys above. Same guidance: prefer
# forwarding via hosts.toml over baking onto the pod.
BACKUP_S3_ACCESS_KEY=
BACKUP_S3_SECRET_KEY=