.env.worker.example

# Runner worker env (Yggdrasil 2.0) — layered OVER .env for the runner-worker service.
#
# Only the dedicated runner worker (docker-compose 'runner-worker') reads this. The web
# container does NOT. Keep the SSH key and cluster config here so they never reach the
# web app. Object-storage creds are shared from .env (the worker signs data transfers,
# and injects those creds transiently into each cluster job — the cluster stores none).

# --- SSH into the cluster login node (worker is the only key holder) ---
SLURM_SSH_HOST=login.cluster.example
SLURM_SSH_PORT=22
SLURM_SSH_USER=yggdrasil
# Mounted read-only into the worker.
SLURM_SSH_KEY=/run/secrets/slurm_ssh_key
# SSH password used alongside the key.
SLURM_SSH_PASSWORD=change-me

# --- Cluster paths ---
# One subdir per algo, each holding its own run.sbatch (see /work/yggdrasil_workers/README.md).
ALGO_BASE_DIR=/work/yggdrasil_workers/algo
# Shared-FS per-job workdirs.
SLURM_STAGE_DIR=/work/yggdrasil_workers/run/stage

# --- Polling ---
SLURM_POLL_INTERVAL=15
SLURM_MAX_WALL_SECONDS=86400
# How long a job whose SLURM id sacct no longer knows is given before it is declared
# lost. sacct forgets very recent submissions briefly, so a short grace here turns that
# gap into spurious failures.
SLURM_UNKNOWN_GRACE_SECONDS=300

# --- Worker -> web runner API ---
# Use the public/routable URL even though the worker is on app-net: the app sets
# SECURE_SSL_REDIRECT, so plain http://web:8000 is redirected to https and fails
# against gunicorn. This must be a host listed in ALLOWED_HOSTS.
RUNNER_API_BASE_URL=https://yggdrasil.example.edu/api
# One of RUNNER_API_TOKENS from .env.
RUNNER_API_TOKEN=dev-runner-token
RUNNER_WORKER_ID=slurm-runner-1

# The worker runs on app-net, so reach Redis by compose service name. Do NOT point
# this at a public hostname: Redis is published on 127.0.0.1 only and is therefore
# unreachable from anywhere but the compose network.
# Percent-encode the password if it contains any of : / ? # [ ] @ or other reserved
# characters -- an unescaped '@' makes the URL parse against the wrong host.
CELERY_BROKER_URL=redis://:change-me-redis-password@redis:6379/2
CELERY_RESULT_BACKEND=redis://:change-me-redis-password@redis:6379/3

# Queues this worker consumes (all runner queues from .env; used by the compose command).
RUNNER_QUEUES=runner_dev,runner_ios_dev,runner_bite_dev,runner_cbct_dev

# In-flight cluster jobs. run_job blocks in ssh.poll() for the whole SLURM job, so
# this is the hard cap on concurrent submissions. The compose command runs a thread
# pool, so a slot costs a thread rather than a process; the limits to watch are
# concurrent SSH sessions on the login node and sacct load (one query per job per
# SLURM_POLL_INTERVAL).
# RUNNER_CONCURRENCY=32