89 lines
3.5 KiB
Bash
89 lines
3.5 KiB
Bash
# Django settings
|
|
KEYWARDEN_SECRET_KEY=supersecret
|
|
KEYWARDEN_DEBUG=True
|
|
KEYWARDEN_ALLOWED_HOSTS=*
|
|
KEYWARDEN_TRUSTED_ORIGINS=https://reverse.proxy.domain.xyz,https://127.0.0.1
|
|
KEYWARDEN_DOMAIN=https://example.domain.xyz
|
|
KEYWARDEN_IDP_ACCOUNT_PORTAL_URL=
|
|
KEYWARDEN_SHELL_REMOTE_COMMAND=/bin/bash
|
|
# Set to 1 to include SSH probe/certificate diagnostics in shell failures.
|
|
KEYWARDEN_SHELL_DEBUG=0
|
|
KEYWARDEN_SHELL_PRESERVE_TMP=0
|
|
KEYWARDEN_SHELL_DIAG_TIMEOUT_SECONDS=10
|
|
# Allowed values: accept-new (default), yes.
|
|
KEYWARDEN_SHELL_STRICT_HOST_KEY_CHECKING=accept-new
|
|
# Directory for CA private key files (stored as file:// refs in DB fields).
|
|
KEYWARDEN_CA_KEY_DIR=/var/lib/keywarden/ca-keys
|
|
# Optional legacy global fallback token for agents.
|
|
# Preferred model is per-agent token issued during /agent/enroll.
|
|
# KEYWARDEN_AGENT_API_TOKEN=
|
|
|
|
# Database
|
|
KEYWARDEN_POSTGRES_DB=keywarden
|
|
KEYWARDEN_POSTGRES_USER=keywarden
|
|
KEYWARDEN_POSTGRES_PASSWORD=postgres
|
|
KEYWARDEN_POSTGRES_HOST=keywarden-db
|
|
KEYWARDEN_POSTGRES_PORT=5432
|
|
|
|
|
|
# Admin
|
|
KEYWARDEN_ADMIN_USERNAME=admin
|
|
KEYWARDEN_ADMIN_EMAIL=admin@example.com
|
|
KEYWARDEN_ADMIN_PASSWORD=password
|
|
|
|
# Auth mode: native | oidc | hybrid
|
|
# native: Uses Keywarden username/password login only. OIDC/social options are hidden and disabled.
|
|
# oidc: Disables built-in login and uses OIDC only. Users can be auto-onboarded from IdP claims.
|
|
# hybrid: Supports OIDC + Keywarden native login; login screen prefers OIDC/social options first.
|
|
|
|
KEYWARDEN_AUTH_MODE=native
|
|
|
|
# Email delivery (required for password reset + native email verification)
|
|
# KEYWARDEN_EMAIL_BACKEND=django.core.mail.backends.smtp.EmailBackend
|
|
# KEYWARDEN_EMAIL_HOST=smtp.example.com
|
|
# KEYWARDEN_EMAIL_PORT=587
|
|
# KEYWARDEN_EMAIL_HOST_USER=
|
|
# KEYWARDEN_EMAIL_HOST_PASSWORD=
|
|
# KEYWARDEN_EMAIL_USE_TLS=true
|
|
# KEYWARDEN_EMAIL_USE_SSL=false
|
|
# KEYWARDEN_DEFAULT_FROM_EMAIL=keywarden@example.com
|
|
# KEYWARDEN_SERVER_EMAIL=keywarden@example.com
|
|
|
|
# Native email verification
|
|
# KEYWARDEN_EMAIL_VERIFICATION_ENABLED=true
|
|
# KEYWARDEN_EMAIL_VERIFICATION_TOKEN_MAX_AGE_SECONDS=86400
|
|
# KEYWARDEN_EMAIL_VERIFICATION_RESEND_COOLDOWN_SECONDS=300
|
|
|
|
|
|
# OIDC (optional) Currently supports Authentik officially and tested. Other solutions such as Keycloak may work.
|
|
# KEYWARDEN_OIDC_CLIENT_ID=
|
|
# KEYWARDEN_OIDC_CLIENT_SECRET=
|
|
# KEYWARDEN_OIDC_DISCOVERY_ENDPOINT= # Not required with Authentik
|
|
# KEYWARDEN_OIDC_AUTHORIZATION_ENDPOINT=https://auth.example.com/application/o/authorize/
|
|
# KEYWARDEN_OIDC_TOKEN_ENDPOINT=https://auth.example.com/application/o/token/
|
|
# KEYWARDEN_OIDC_USER_ENDPOINT=https://auth.example.com/application/o/userinfo/
|
|
# KEYWARDEN_OIDC_JWKS_ENDPOINT=https://auth.example.com/application/o/keywarden/jwks/
|
|
# KEYWARDEN_OIDC_ISSUER=
|
|
# KEYWARDEN_OIDC_PROVIDER_ID=corporate-sso # Not required with Authentik
|
|
# KEYWARDEN_OIDC_SCOPES=openid email profile groups
|
|
# KEYWARDEN_OIDC_REQUIRE_VERIFIED_EMAIL=true # Set to false if emails are not verified on provider
|
|
# KEYWARDEN_OIDC_EMAIL_CLAIM=email
|
|
# KEYWARDEN_OIDC_EMAIL_VERIFIED_CLAIM=email_verified
|
|
# KEYWARDEN_OIDC_USERNAME_CLAIM=preferred_username
|
|
# KEYWARDEN_OIDC_ALLOW_AUTO_ONBOARDING=true
|
|
# KEYWARDEN_OIDC_GROUPS_CLAIM=groups
|
|
# KEYWARDEN_OIDC_SYNC_ADMIN_FROM_GROUPS=true # defaults to true when KEYWARDEN_AUTH_MODE=oidc
|
|
# KEYWARDEN_OIDC_ADMIN_GROUPS=authentik Admins
|
|
# KEYWARDEN_OIDC_ADMIN_DEMOTE_ON_MISS=false
|
|
|
|
# Social login (optional)
|
|
# KEYWARDEN_SITE_ID=1
|
|
# KEYWARDEN_SOCIAL_REQUIRE_VERIFIED_EMAIL=true
|
|
# KEYWARDEN_SOCIAL_GITHUB_ENABLED=false
|
|
# KEYWARDEN_SOCIAL_GITHUB_CLIENT_ID=
|
|
# KEYWARDEN_SOCIAL_GITHUB_CLIENT_SECRET=
|
|
|
|
# Authentik Secrets
|
|
AUTHENTIK_PG_PASS=
|
|
AUTHENTIK_SECRET_KEY=
|