# Keywarden server URL (required on first boot if /etc/keywarden/agent.json does not exist)
KEYWARDEN_SERVER_URL=https://keywarden.example.com/api/v1

# Enrollment token used only for first enrollment / forced re-enrollment.
# Remove after successful enrollment.
KEYWARDEN_ENROLL_TOKEN=

# Optional path to a private CA PEM for verifying the Keywarden server TLS cert.
# KEYWARDEN_SERVER_CA_PATH=/etc/ssl/certs/keywarden-ca.pem

# Optional override for the persisted per-agent token in agent.json.
# Normally leave unset.
# KEYWARDEN_AGENT_API_TOKEN=