# Configuration for the ungleich account webapp.
#
# Every setting is an environment variable. In development, copy this file
# (or dev/env.dev) to .env in the repository root. In Kubernetes, values
# marked [secret] go in a Secret and the rest in a ConfigMap.
#
# Required unless a default is shown.

# --- Django -----------------------------------------------------------------
SECRET_KEY=""                       # [secret] long random string
ALLOWED_HOSTS="account.ungleich.ch" # comma separated
DEBUG=False
LOG_LEVEL=INFO                      # root log level; output goes to stdout
#DJANGO_LOG_LEVEL=INFO
#LDAP3_LOG=False                    # ldap3 protocol logging (very verbose)

# --- HTTPS / proxy ------------------------------------------------------------
#TRUST_X_FORWARDED_PROTO=False      # True behind a TLS-terminating ingress
#CSRF_TRUSTED_ORIGINS=""            # comma separated, e.g. https://account.ungleich.ch
#SESSION_COOKIE_SECURE=             # default: True unless DEBUG
#CSRF_COOKIE_SECURE=                # default: True unless DEBUG
#SECURE_SSL_REDIRECT=False          # usually done by the ingress
#SECURE_HSTS_SECONDS=0              # read Django's HSTS docs before raising

# --- Database -----------------------------------------------------------------
# Sessions, reset tokens and pending registrations. Set DATABASE_HOST to use
# PostgreSQL (required for more than one replica); otherwise SQLite is used.
#DATABASE_HOST=""
#DATABASE_PORT=5432
#DATABASE_NAME=ungleich_user
#DATABASE_USER=ungleich_user
#DATABASE_PASSWORD=""               # [secret]
#DATABASE_SSLMODE=prefer
#DATABASE_CONN_MAX_AGE=60
#SQLITE_PATH=./db.sqlite3           # only without DATABASE_HOST

# --- LDAP -------------------------------------------------------------------
# Space separated; the first reachable server is used (failover).
LDAPSERVER="ldap://ldap1.ungleich.ch ldap://ldap2.ungleich.ch"
#LDAP_USE_TLS=False                 # StartTLS on every connection
LDAP_ADMIN_DN=""                    # DN with write access to customers
LDAP_ADMIN_PASSWORD=""              # [secret]

# Users log in from any of these (space separated) search bases.
LDAPSEARCH="ou=customers,dc=ungleich,dc=ch ou=users,dc=ungleich,dc=ch"
# Usernames and uidNumbers must be unique below this base.
ENTIRE_SEARCH_BASE="dc=ungleich,dc=ch"
# New registrations are created here.
LDAP_CUSTOMER_DN="ou=customers,dc=ungleich,dc=ch"
LDAP_CUSTOMER_GROUP_ID=             # gidNumber for new customers
LDAP_DEFAULT_START_UID=             # new uidNumbers are always above this

# --- Email ------------------------------------------------------------------
EMAIL_FROM_ADDRESS=""
#EMAIL_HOST=localhost
#EMAIL_PORT=25
#EMAIL_USE_TLS=True
#EMAIL_HOST_USER=""
#EMAIL_HOST_PASSWORD=""             # [secret]
#EMAIL_TIMEOUT=10

# --- OTP server -------------------------------------------------------------
OTPSERVER=""                        # base URL of the OTP API
ADMIN_NAME=""
ADMIN_REALM=""
ADMIN_SEED=""                       # [secret] base32 TOTP seed of ADMIN_NAME
USER_REALM=""                       # realm for seeds of new users
ALLOWED_REALMS=""                   # comma separated realms users may request
#OTP_TIMEOUT=10                     # seconds per request to the OTP server