# Communication Environment

Runtime credentials must be supplied through the deployment environment or a
secret manager. Passwords and private keys must not be committed to this
repository.

## Cloud service

```text
DB_HOST=192.168.0.111
DB_PORT=5432
DB_NAME=cygnus
DB_USER=postgres
DB_PASSWORD=<secret>
DB_SSL=false

REDIS_HOST=192.168.0.111
REDIS_PORT=7901
REDIS_PASSWORD=<secret>
REDIS_SSL=false

CYGNUS_SECURITY_ENABLED=false
CYGNUS_JWT_ISSUER_URI=https://auth.example.com
CYGNUS_JWT_AUDIENCE=cygnus-cloud-api
```

Set `CYGNUS_SECURITY_ENABLED=true` only after the authorization server/JWK
issuer is available. Production database, Redis, token, and API traffic should
use encrypted transport.

## On-premises application cache

```text
REDIS_HOST=192.168.0.111
REDIS_PORT=7901
REDIS_PASSWORD=<secret>
REDIS_SSL=false
CYGNUS_CACHE_PREFIX=cygnus:onprem
CYGNUS_CACHE_TTL_SECONDS=600
```

The on-premises cache connects lazily and treats Redis failures as cache misses,
so Redis downtime does not prevent the legacy application from starting.