4.2 Create the private environment file
From the pinned source checkout on the VM, create a private configuration file. Use a fresh file for a fresh deployment.
umask 077
cp -n deploy/postgres/.env.example deploy/postgres/.env
chmod 600 deploy/postgres/.env
nano deploy/postgres/.env| Setting | Value |
|---|---|
EPM_POSTGRES_PASSWORD | Independent password for fresh PostgreSQL initialization. |
EPM_PG_RUNTIME_PASSWORD, EPM_PG_ACCESS_PASSWORD, EPM_PG_WORKER_PASSWORD, EPM_PG_LIFECYCLE_PASSWORD, EPM_PG_PROVISION_PASSWORD, EPM_PG_SECURITY_PASSWORD | Independent values for the corresponding service login roles. Hexadecimal values generated locally avoid DSN quoting issues. |
EPM_PG_PREVIEW_SECRET_HEX | Exactly 64 lowercase hexadecimal characters generated with openssl rand -hex 32. |
EPM_AUTH_MODE, EPM_OIDC_ISSUER, EPM_OIDC_JWKS_URL, EPM_OIDC_AUD_MCP, EPM_OIDC_AUD_WEB | OIDC, with the exact verified issuer, HTTPS JWKS URL and distinct access-token audiences. |
EPM_PUBLIC_WEB_ORIGIN, EPM_PUBLIC_MCP_ORIGIN | Absolute HTTPS origins without paths. They describe the gateway's public endpoints. |
EPM_PLATFORM_OPERATOR_ISSUER, EPM_PLATFORM_OPERATOR_SUBJECT | The same verified issuer and the initial operator's immutable subject ID. |
EPM_PG_WORKSPACE_ID | Use __openepm_workspace_profile_disabled__ for the fresh core-only development configuration. Replace it with a real workspace ID before enabling the workspace profile. |
The pinned Compose file interpolates the workspace service before filtering inactive profiles. An empty workspace ID therefore fails even with the workspace profile disabled. The reserved placeholder is solely for this pinned revision with the workspace profile inactive. The start step checks the resolved service list. Remove the placeholder after adopting a revision whose core profile validates with an empty value.
sudo docker compose --env-file deploy/postgres/.env -f deploy/postgres/compose.yaml \
--profile v2 config --quietExpect exit status zero. Avoid publishing rendered Compose output or the environment file. Leave the reset endpoint declaration unset for this walkthrough. Python builds require the approved headless environment and host sandbox launcher.