# Copy to .env and edit. Never commit .env.

# Required. At least 32 random characters.
# Generate: python -c "import secrets; print(secrets.token_urlsafe(64))"
SECRET_KEY=

# Required. Comma-separated host names the portal answers to.
ALLOWED_HOSTS=portal.example.test

# Required. Host name of the directory server; LDAPS (port 636) is always used.
# Must match a name in the server's certificate. Add :port to use another port.
LDAP_SERVER=

# Required. Distinguished name of the OU whose users the portal may read and change.
LDAP_USER_OU_DN=

# Required. The service account, as a distinguished name or user principal name.
LDAP_BIND_DN=
LDAP_BIND_PASSWORD=

# Required. Path inside the container of the PEM file with the CA chain that signed the
# directory server's certificate. Mount the file read-only, for example at /certs/ca.pem.
LDAP_CA_FILE=/certs/ca.pem

# Required for docker compose. Path on the Docker host of the CA chain file; compose mounts it
# read-only at /certs/ca.pem. (Only compose reads this; the portal does not.)
CA_FILE_HOST=

# Required. Distinguished names of the groups that grant the Publisher and Admin roles.
LDAP_PUBLISHER_GROUP_DN=
LDAP_ADMIN_GROUP_DN=

# Required. The OpenID provider's application: the issuer address from its OpenID
# configuration page (keep the trailing slash), client ID and client secret.
OIDC_ISSUER=
OIDC_CLIENT_ID=
OIDC_CLIENT_SECRET=

# Required. The address users reach the portal at (scheme and host only). The sign-in
# redirect address registered at the provider is this plus /auth/callback.
PUBLIC_BASE_URL=https://portal.example.test

# Optional. Directory for the database. Default /data (the container volume).
# DATA_DIR=/data

# Optional. true or false. Default false. Never true in production.
# DEBUG=false

# Optional. Comma-separated IP addresses or networks of reverse proxies. Default empty.
# The portal takes the client address from X-Forwarded-For only when the request comes from one of these.
# TRUSTED_PROXIES=

# Optional. DEBUG, INFO, WARNING, ERROR or CRITICAL. Default INFO.
# LOG_LEVEL=INFO

# Optional. IANA time zone used for display. Default Europe/Berlin.
# DEFAULT_TIMEZONE=Europe/Berlin