# Configuration for the ungleich account webapp.
#
# Every setting is an environment variable. In development, copy this file
# (or dev/env.dev) to .env in the repository root. In Kubernetes, values
# marked [secret] go in a Secret and the rest in a ConfigMap.
#
# Required unless a default is shown.

# --- Django -----------------------------------------------------------------
SECRET_KEY=""                       # [secret] long random string
ALLOWED_HOSTS="account.ungleich.ch" # comma separated
DEBUG=False
LOG_LEVEL=INFO                      # root log level; output goes to stdout
#DJANGO_LOG_LEVEL=INFO
#LDAP3_LOG=False                    # ldap3 protocol logging (very verbose)

# --- LDAP -------------------------------------------------------------------
# Space separated; the first reachable server is used (failover).
LDAPSERVER="ldap://ldap1.ungleich.ch ldap://ldap2.ungleich.ch"
#LDAP_USE_TLS=False                 # StartTLS on every connection
LDAP_ADMIN_DN=""                    # DN with write access to customers
LDAP_ADMIN_PASSWORD=""              # [secret]

# Users log in from any of these (space separated) search bases.
LDAPSEARCH="ou=customers,dc=ungleich,dc=ch ou=users,dc=ungleich,dc=ch"
# Usernames and uidNumbers must be unique below this base.
ENTIRE_SEARCH_BASE="dc=ungleich,dc=ch"
# New registrations are created here.
LDAP_CUSTOMER_DN="ou=customers,dc=ungleich,dc=ch"
LDAP_CUSTOMER_GROUP_ID=             # gidNumber for new customers
LDAP_DEFAULT_START_UID=             # new uidNumbers are always above this

# --- Email ------------------------------------------------------------------
EMAIL_FROM_ADDRESS=""
#EMAIL_HOST=localhost
#EMAIL_PORT=25
#EMAIL_USE_TLS=True
#EMAIL_HOST_USER=""
#EMAIL_HOST_PASSWORD=""             # [secret]
#EMAIL_TIMEOUT=10

# --- OTP server -------------------------------------------------------------
OTPSERVER=""                        # base URL of the OTP API
ADMIN_NAME=""
ADMIN_REALM=""
ADMIN_SEED=""                       # [secret] base32 TOTP seed of ADMIN_NAME
USER_REALM=""                       # realm for seeds of new users
ALLOWED_REALMS=""                   # comma separated realms users may request
#OTP_TIMEOUT=10                     # seconds per request to the OTP server