# Django settings
KEYWARDEN_SECRET_KEY=supersecret
KEYWARDEN_DEBUG=True
KEYWARDEN_ALLOWED_HOSTS=*
KEYWARDEN_TRUSTED_ORIGINS=https://reverse.proxy.domain.xyz,https://127.0.0.1
KEYWARDEN_DOMAIN=https://example.domain.xyz
KEYWARDEN_IDP_ACCOUNT_PORTAL_URL=
KEYWARDEN_SHELL_REMOTE_COMMAND=/bin/bash
# Set to 1 to include SSH probe/certificate diagnostics in shell failures.
KEYWARDEN_SHELL_DEBUG=0
KEYWARDEN_SHELL_PRESERVE_TMP=0
KEYWARDEN_SHELL_DIAG_TIMEOUT_SECONDS=10
# Allowed values: accept-new (default), yes.
KEYWARDEN_SHELL_STRICT_HOST_KEY_CHECKING=accept-new
# Directory for CA private key files (stored as file:// refs in DB fields).
KEYWARDEN_CA_KEY_DIR=/var/lib/keywarden/ca-keys
# Optional legacy global fallback token for agents.
# Preferred model is per-agent token issued during /agent/enroll.
# KEYWARDEN_AGENT_API_TOKEN=
# Runtime compatibility switch:
# true  = allow bearer fallback when mTLS headers are absent (default)
# false = strict mTLS-only runtime auth
# KEYWARDEN_AGENT_RUNTIME_ALLOW_TOKEN_FALLBACK=true

# Database
KEYWARDEN_POSTGRES_DB=keywarden
KEYWARDEN_POSTGRES_USER=keywarden
KEYWARDEN_POSTGRES_PASSWORD=postgres
KEYWARDEN_POSTGRES_HOST=keywarden-db
KEYWARDEN_POSTGRES_PORT=5432


# Admin
KEYWARDEN_ADMIN_USERNAME=admin
KEYWARDEN_ADMIN_EMAIL=admin@example.com
KEYWARDEN_ADMIN_PASSWORD=password

# Auth mode: native | oidc | hybrid
# native: Uses Keywarden username/password login only. OIDC/social options are hidden and disabled.
# oidc: Disables built-in login and uses OIDC only. Users can be auto-onboarded from IdP claims.
# hybrid: Supports OIDC + Keywarden native login; login screen prefers OIDC/social options first.

KEYWARDEN_AUTH_MODE=native

# Email delivery (required for password reset + native email verification)
# KEYWARDEN_EMAIL_BACKEND=django.core.mail.backends.smtp.EmailBackend
# KEYWARDEN_EMAIL_HOST=smtp.example.com
# KEYWARDEN_EMAIL_PORT=587
# KEYWARDEN_EMAIL_HOST_USER=
# KEYWARDEN_EMAIL_HOST_PASSWORD=
# KEYWARDEN_EMAIL_USE_TLS=true
# KEYWARDEN_EMAIL_USE_SSL=false
# KEYWARDEN_DEFAULT_FROM_EMAIL=keywarden@example.com
# KEYWARDEN_SERVER_EMAIL=keywarden@example.com

# Native email verification
# KEYWARDEN_EMAIL_VERIFICATION_ENABLED=true
# KEYWARDEN_EMAIL_VERIFICATION_TOKEN_MAX_AGE_SECONDS=86400
# KEYWARDEN_EMAIL_VERIFICATION_RESEND_COOLDOWN_SECONDS=300


# OIDC (optional) Currently supports Authentik officially and tested. Other solutions such as Keycloak may work.
# KEYWARDEN_OIDC_CLIENT_ID=
# KEYWARDEN_OIDC_CLIENT_SECRET=
# KEYWARDEN_OIDC_DISCOVERY_ENDPOINT= # Not required with Authentik
# KEYWARDEN_OIDC_AUTHORIZATION_ENDPOINT=https://auth.example.com/application/o/authorize/
# KEYWARDEN_OIDC_TOKEN_ENDPOINT=https://auth.example.com/application/o/token/
# KEYWARDEN_OIDC_USER_ENDPOINT=https://auth.example.com/application/o/userinfo/
# KEYWARDEN_OIDC_JWKS_ENDPOINT=https://auth.example.com/application/o/keywarden/jwks/
# KEYWARDEN_OIDC_ISSUER=
# KEYWARDEN_OIDC_PROVIDER_ID=corporate-sso # Not required with Authentik
# KEYWARDEN_OIDC_SCOPES=openid email profile groups
# KEYWARDEN_OIDC_REQUIRE_VERIFIED_EMAIL=true # Set to false if emails are not verified on provider
# KEYWARDEN_OIDC_EMAIL_CLAIM=email
# KEYWARDEN_OIDC_EMAIL_VERIFIED_CLAIM=email_verified
# KEYWARDEN_OIDC_USERNAME_CLAIM=preferred_username
# KEYWARDEN_OIDC_ALLOW_AUTO_ONBOARDING=true
# KEYWARDEN_OIDC_GROUPS_CLAIM=groups
# KEYWARDEN_OIDC_SYNC_ADMIN_FROM_GROUPS=true # defaults to true when KEYWARDEN_AUTH_MODE=oidc
# KEYWARDEN_OIDC_ADMIN_GROUPS=authentik Admins
# KEYWARDEN_OIDC_ADMIN_DEMOTE_ON_MISS=false

# Social login (optional)
# KEYWARDEN_SITE_ID=1
# KEYWARDEN_SOCIAL_REQUIRE_VERIFIED_EMAIL=true
# KEYWARDEN_SOCIAL_GITHUB_ENABLED=false
# KEYWARDEN_SOCIAL_GITHUB_CLIENT_ID=
# KEYWARDEN_SOCIAL_GITHUB_CLIENT_SECRET=

# Authentik Secrets
AUTHENTIK_PG_PASS=
AUTHENTIK_SECRET_KEY=