# Django settings
KEYWARDEN_SECRET_KEY=supersecret
KEYWARDEN_DEBUG=True
KEYWARDEN_ALLOWED_HOSTS=*
KEYWARDEN_TRUSTED_ORIGINS=https://reverse.proxy.domain.xyz,https://127.0.0.1
KEYWARDEN_DOMAIN=https://example.domain.xyz
KEYWARDEN_SHELL_REMOTE_COMMAND=/bin/bash
# Set to 1 to include SSH probe/certificate diagnostics in shell failures.
KEYWARDEN_SHELL_DEBUG=0
KEYWARDEN_SHELL_PRESERVE_TMP=0
KEYWARDEN_SHELL_DIAG_TIMEOUT_SECONDS=10
# Optional legacy global fallback token for agents.
# Preferred model is per-agent token issued during /agent/enroll.
# KEYWARDEN_AGENT_API_TOKEN=

# Database
KEYWARDEN_POSTGRES_DB=keywarden
KEYWARDEN_POSTGRES_USER=keywarden
KEYWARDEN_POSTGRES_PASSWORD=postgres
KEYWARDEN_POSTGRES_HOST=keywarden-db
KEYWARDEN_POSTGRES_PORT=5432


# Admin
KEYWARDEN_ADMIN_USERNAME=admin
KEYWARDEN_ADMIN_EMAIL=admin@example.com
KEYWARDEN_ADMIN_PASSWORD=password

# Auth mode: native | oidc | hybrid
# native: Uses Keywarden username/password login only. OIDC/social options are hidden and disabled.
# oidc: Disables built-in login and uses OIDC only. Users can be auto-onboarded from IdP claims.
# hybrid: Supports OIDC + Keywarden native login; login screen prefers OIDC/social options first.

KEYWARDEN_AUTH_MODE=native


# OIDC (optional) Currently supports Authentik officially and tested. Other solutions such as Keycloak may work.
# KEYWARDEN_OIDC_CLIENT_ID=
# KEYWARDEN_OIDC_CLIENT_SECRET=
# KEYWARDEN_OIDC_DISCOVERY_ENDPOINT= # Not required with Authentik
# KEYWARDEN_OIDC_AUTHORIZATION_ENDPOINT=https://auth.example.com/application/o/authorize/
# KEYWARDEN_OIDC_TOKEN_ENDPOINT=https://auth.example.com/application/o/token/
# KEYWARDEN_OIDC_USER_ENDPOINT=https://auth.example.com/application/o/userinfo/
# KEYWARDEN_OIDC_JWKS_ENDPOINT=https://auth.example.com/application/o/keywarden/jwks/
# KEYWARDEN_OIDC_ISSUER=
# KEYWARDEN_OIDC_PROVIDER_ID=corporate-sso # Not required with Authentik
# KEYWARDEN_OIDC_SCOPES=openid email profile groups
# KEYWARDEN_OIDC_REQUIRE_VERIFIED_EMAIL=true # Set to false if emails are not verified on provider
# KEYWARDEN_OIDC_EMAIL_CLAIM=email
# KEYWARDEN_OIDC_EMAIL_VERIFIED_CLAIM=email_verified
# KEYWARDEN_OIDC_USERNAME_CLAIM=preferred_username
# KEYWARDEN_OIDC_ALLOW_AUTO_ONBOARDING=true
# KEYWARDEN_OIDC_GROUPS_CLAIM=groups
# KEYWARDEN_OIDC_SYNC_ADMIN_FROM_GROUPS=true # defaults to true when KEYWARDEN_AUTH_MODE=oidc
# KEYWARDEN_OIDC_ADMIN_GROUPS=authentik Admins
# KEYWARDEN_OIDC_ADMIN_DEMOTE_ON_MISS=false

# Social login (optional)
# KEYWARDEN_SITE_ID=1
# KEYWARDEN_SOCIAL_REQUIRE_VERIFIED_EMAIL=true
# KEYWARDEN_SOCIAL_ALLOW_AUTO_ONBOARDING=false
# KEYWARDEN_SOCIAL_GOOGLE_ENABLED=false
# KEYWARDEN_SOCIAL_GOOGLE_CLIENT_ID=
# KEYWARDEN_SOCIAL_GOOGLE_CLIENT_SECRET=
# KEYWARDEN_SOCIAL_GITHUB_ENABLED=false
# KEYWARDEN_SOCIAL_GITHUB_CLIENT_ID=
# KEYWARDEN_SOCIAL_GITHUB_CLIENT_SECRET=
# KEYWARDEN_SOCIAL_APPLE_ENABLED=false
# KEYWARDEN_SOCIAL_APPLE_CLIENT_ID=
# KEYWARDEN_SOCIAL_APPLE_CLIENT_SECRET=

# Authentik Secrets
AUTHENTIK_PG_PASS=
AUTHENTIK_SECRET_KEY=