# Configuration reference

Environment variables (`.env` at repo root). Copy from `.env.example`.

## Database

| Variable | Description |
|----------|-------------|
| `SOVEREIGN_DB_CONNECTION` | ADO connection string to `SovereignRepository` |

## API

| Variable | Default | Description |
|----------|---------|-------------|
| `SOVEREIGN_API_PORT` | `3041` | REST API port |
| `SOVEREIGN_ENFORCE_LICENSE` | `true` | Block API when license invalid |
| `SOVEREIGN_REQUIRE_AUTH` | env-specific | Require JWT on protected routes |

## SQL security

| Variable | Default | Description |
|----------|---------|-------------|
| `SOVEREIGN_SQL_ENCRYPT` | off | Set `true` for production TLS |
| `SOVEREIGN_SQL_TRUST_SERVER_CERT` | on (integrated dev) | Set `false` with CA-signed certs |

## Credentials (v28)

| Variable | Description |
|----------|-------------|
| `SOVEREIGN_CRED_<REF>_USER` | SQL auth user for catalog ref |
| `SOVEREIGN_CRED_<REF>_PASSWORD` | SQL auth password (never in SQL) |

## License

| Variable | Description |
|----------|-------------|
| `SOVEREIGN_LICENSE_PATH` | Path to signed `.license` file |
| `SOVEREIGN_LICENSE_PUBLIC_KEY_PATH` | Ed25519 public key PEM |
| `SOVEREIGN_REQUIRE_LICENSE_SIGNATURE` | Require valid signature |

See `docs/SECURITY-PERMISSIONS.md` and `docs/ENTERPRISE-INSTALL.md`.
