75 lines
2.9 KiB
Bash
75 lines
2.9 KiB
Bash
# Django settings
|
|
KEYWARDEN_SECRET_KEY=supersecret
|
|
KEYWARDEN_DEBUG=True
|
|
KEYWARDEN_ALLOWED_HOSTS=*
|
|
KEYWARDEN_TRUSTED_ORIGINS=https://reverse.proxy.domain.xyz,https://127.0.0.1
|
|
KEYWARDEN_DOMAIN=https://example.domain.xyz
|
|
KEYWARDEN_SHELL_REMOTE_COMMAND=/bin/bash
|
|
# Set to 1 to include SSH probe/certificate diagnostics in shell failures.
|
|
KEYWARDEN_SHELL_DEBUG=0
|
|
KEYWARDEN_SHELL_PRESERVE_TMP=0
|
|
KEYWARDEN_SHELL_DIAG_TIMEOUT_SECONDS=10
|
|
# Optional legacy global fallback token for agents.
|
|
# Preferred model is per-agent token issued during /agent/enroll.
|
|
# KEYWARDEN_AGENT_API_TOKEN=
|
|
|
|
# Database
|
|
KEYWARDEN_POSTGRES_DB=keywarden
|
|
KEYWARDEN_POSTGRES_USER=keywarden
|
|
KEYWARDEN_POSTGRES_PASSWORD=postgres
|
|
KEYWARDEN_POSTGRES_HOST=keywarden-db
|
|
KEYWARDEN_POSTGRES_PORT=5432
|
|
|
|
|
|
# Admin
|
|
KEYWARDEN_ADMIN_USERNAME=admin
|
|
KEYWARDEN_ADMIN_EMAIL=admin@example.com
|
|
KEYWARDEN_ADMIN_PASSWORD=password
|
|
|
|
# Auth mode: native | oidc | hybrid
|
|
# native: Uses Keywarden username/password login only. OIDC/social options are hidden and disabled.
|
|
# oidc: Disables built-in login and uses OIDC only. Users can be auto-onboarded from IdP claims.
|
|
# hybrid: Supports OIDC + Keywarden native login; login screen prefers OIDC/social options first.
|
|
|
|
KEYWARDEN_AUTH_MODE=native
|
|
|
|
|
|
# OIDC (optional) Currently supports Authentik officially and tested. Other solutions such as Keycloak may work.
|
|
# KEYWARDEN_OIDC_CLIENT_ID=
|
|
# KEYWARDEN_OIDC_CLIENT_SECRET=
|
|
# KEYWARDEN_OIDC_DISCOVERY_ENDPOINT= # Not required with Authentik
|
|
# KEYWARDEN_OIDC_AUTHORIZATION_ENDPOINT=https://auth.example.com/application/o/authorize/
|
|
# KEYWARDEN_OIDC_TOKEN_ENDPOINT=https://auth.example.com/application/o/token/
|
|
# KEYWARDEN_OIDC_USER_ENDPOINT=https://auth.example.com/application/o/userinfo/
|
|
# KEYWARDEN_OIDC_JWKS_ENDPOINT=https://auth.example.com/application/o/keywarden/jwks/
|
|
# KEYWARDEN_OIDC_ISSUER=
|
|
# KEYWARDEN_OIDC_PROVIDER_ID=corporate-sso # Not required with Authentik
|
|
# KEYWARDEN_OIDC_SCOPES=openid email profile groups
|
|
# KEYWARDEN_OIDC_REQUIRE_VERIFIED_EMAIL=true # Set to false if emails are not verified on provider
|
|
# KEYWARDEN_OIDC_EMAIL_CLAIM=email
|
|
# KEYWARDEN_OIDC_EMAIL_VERIFIED_CLAIM=email_verified
|
|
# KEYWARDEN_OIDC_USERNAME_CLAIM=preferred_username
|
|
# KEYWARDEN_OIDC_ALLOW_AUTO_ONBOARDING=true
|
|
# KEYWARDEN_OIDC_GROUPS_CLAIM=groups
|
|
# KEYWARDEN_OIDC_SYNC_ADMIN_FROM_GROUPS=true # defaults to true when KEYWARDEN_AUTH_MODE=oidc
|
|
# KEYWARDEN_OIDC_ADMIN_GROUPS=authentik Admins
|
|
# KEYWARDEN_OIDC_ADMIN_DEMOTE_ON_MISS=false
|
|
|
|
# Social login (optional)
|
|
# KEYWARDEN_SITE_ID=1
|
|
# KEYWARDEN_SOCIAL_REQUIRE_VERIFIED_EMAIL=true
|
|
# KEYWARDEN_SOCIAL_ALLOW_AUTO_ONBOARDING=false
|
|
# KEYWARDEN_SOCIAL_GOOGLE_ENABLED=false
|
|
# KEYWARDEN_SOCIAL_GOOGLE_CLIENT_ID=
|
|
# KEYWARDEN_SOCIAL_GOOGLE_CLIENT_SECRET=
|
|
# KEYWARDEN_SOCIAL_GITHUB_ENABLED=false
|
|
# KEYWARDEN_SOCIAL_GITHUB_CLIENT_ID=
|
|
# KEYWARDEN_SOCIAL_GITHUB_CLIENT_SECRET=
|
|
# KEYWARDEN_SOCIAL_APPLE_ENABLED=false
|
|
# KEYWARDEN_SOCIAL_APPLE_CLIENT_ID=
|
|
# KEYWARDEN_SOCIAL_APPLE_CLIENT_SECRET=
|
|
|
|
# Authentik Secrets
|
|
AUTHENTIK_PG_PASS=
|
|
AUTHENTIK_SECRET_KEY=
|