# Sencho Configuration
# Copy this file to .env and update the values for production

# Directory containing docker-compose files
COMPOSE_DIR=/path/to/your/compose/files

# Database and state directory inside the container (default: /app/data)
DATA_DIR=/app/data

# Optional path to a host-installed Trivy binary. Sencho first looks for a
# managed install under DATA_DIR/bin/trivy; if absent and TRIVY_BIN is set,
# Sencho uses that path; otherwise it falls back to `trivy` on PATH. Once a
# managed install is present, the managed copy takes precedence over this.
TRIVY_BIN=

# Node environment (set automatically in Docker image; only change for local dev)
NODE_ENV=production

# Frontend URL for CORS in production (leave empty for same-origin setups)
FRONTEND_URL=

# Global API rate limit (requests per minute per user session, production only)
# Authenticated requests are keyed by user ID; unauthenticated by IP.
# Internal node-to-node traffic (node_proxy tokens) bypasses this limit entirely.
API_RATE_LIMIT=200

# Polling endpoint rate limit (requests per minute, production only)
# Applies to dashboard/status polling endpoints that are exempt from the global limit.
# Increase for environments with many concurrent browser sessions behind shared NAT.
API_POLLING_RATE_LIMIT=300

# Public URL of THIS primary instance, used to bake an externally-reachable
# SENCHO_PRIMARY_URL into pilot enrollment YAML. Set this when the primary
# sits behind a reverse proxy or Cloudflare Tunnel so pilots on a different
# network can dial the public hostname instead of the request Host header
# the admin happens to be on (loopback, LAN, etc.). Must be http(s)://; no
# trailing slash. When unset, enrollment falls back to the request Host.
SENCHO_PUBLIC_URL=

# ─── Pilot agent (remote host only) ──────────────────────────────
# These three vars are required ONLY on a remote host running as a
# pilot-agent reverse-tunnel container. The primary instance does not
# read them. See docs/features/pilot-agent.mdx for the full setup.

# Switches the container into agent mode. The primary instance leaves
# this unset.
SENCHO_MODE=

# WebSocket-capable URL of the controlling Sencho instance. Use https://
# scheme; the agent rewrites it to wss:// for the tunnel upgrade.
SENCHO_PRIMARY_URL=

# Single-use, 15-minute enrollment token issued by the primary when the
# pilot-agent node is created. After the first successful connect the
# agent persists a long-lived tunnel credential at /app/data/pilot.jwt
# and ignores this var on subsequent restarts.
SENCHO_ENROLL_TOKEN=

# Optional: path inside the agent container to a PEM CA bundle the
# agent should trust when validating the primary's TLS cert. Use this
# for self-hosted deployments terminating TLS with an internal CA.
# Leave unset to fall back to the system trust store. There is no
# escape hatch to disable TLS verification.
SENCHO_PILOT_CA_FILE=

# ─── SSO / LDAP Configuration ────────────────────────────────────

# LDAP / Active Directory
SSO_LDAP_ENABLED=false
SSO_LDAP_URL=ldap://ldap.example.com:389
SSO_LDAP_BIND_DN=cn=readonly,dc=example,dc=com
SSO_LDAP_BIND_PASSWORD=
SSO_LDAP_SEARCH_BASE=ou=users,dc=example,dc=com
SSO_LDAP_SEARCH_FILTER=(uid={{username}})
SSO_LDAP_ADMIN_GROUP_DN=
SSO_LDAP_DEFAULT_ROLE=viewer
SSO_LDAP_DISPLAY_NAME=LDAP
SSO_LDAP_TLS_REJECT_UNAUTHORIZED=true

# Google OIDC
SSO_OIDC_GOOGLE_ENABLED=false
SSO_OIDC_GOOGLE_CLIENT_ID=
SSO_OIDC_GOOGLE_CLIENT_SECRET=

# GitHub OAuth
SSO_OIDC_GITHUB_ENABLED=false
SSO_OIDC_GITHUB_CLIENT_ID=
SSO_OIDC_GITHUB_CLIENT_SECRET=

# Okta OIDC
SSO_OIDC_OKTA_ENABLED=false
SSO_OIDC_OKTA_ISSUER_URL=
SSO_OIDC_OKTA_CLIENT_ID=
SSO_OIDC_OKTA_CLIENT_SECRET=

# Custom OIDC (Keycloak, Authentik, Authelia, Zitadel, etc.)
SSO_OIDC_CUSTOM_ENABLED=false
SSO_OIDC_CUSTOM_DISPLAY_NAME=Custom OIDC
SSO_OIDC_CUSTOM_ISSUER_URL=
SSO_OIDC_CUSTOM_CLIENT_ID=
SSO_OIDC_CUSTOM_CLIENT_SECRET=
SSO_OIDC_CUSTOM_SCOPES=openid email profile
SSO_OIDC_CUSTOM_ID_CLAIM=
SSO_OIDC_CUSTOM_USERNAME_CLAIM=
SSO_OIDC_CUSTOM_EMAIL_CLAIM=

# Role mapping (shared across OIDC providers)
SSO_OIDC_ADMIN_CLAIM=groups
SSO_OIDC_ADMIN_CLAIM_VALUE=sencho-admins
SSO_DEFAULT_ROLE=viewer

# External base URL for OAuth callback URLs (required behind reverse proxy)
SSO_CALLBACK_URL=

# Experimental UI surfaces. When unset or any value other than "true",
# the UI hides surfaces that are kept in the repo but not yet promoted
# to the default 1.0 build (Fleet Routing tab, Fleet
# Deployments / Blueprints tab, Fleet Federation tab, Fleet Secrets
# sync tab, Fleet Actions tab). Backend routes for these surfaces stay
# live regardless. This flag controls UI discovery only.
SENCHO_EXPERIMENTAL=false

# Idle teardown for the persistent mesh proxy tunnel central opens to
# Distributed API (proxy-mode) remotes. The tunnel stays open for the
# life of the WebSocket. Set a positive number of milliseconds to
# enable idle teardown after that many ms of zero active mesh streams;
# the next mesh dial re-opens it. Default 0 (persistent).
SENCHO_MESH_PROXY_TUNNEL_IDLE_MS=0

# Mesh network subnet for this node. Leave unset to let Sencho pick the first
# free /24 from its candidate list (172.30.0.0/24, 172.31.0.0/24, 10.42.0.0/24,
# 10.43.0.0/24), or adopt the existing sencho_mesh network's subnet when it is
# already present. Set a specific CIDR only when you need to avoid an overlap
# with another network on this host. Configured independently per node.
# SENCHO_MESH_SUBNET=10.42.0.0/24

# Maximum bytes a single Git Source clone may download from the Git host before
# it is aborted. This bounds network transfer and abuse, not the decompressed
# on-disk size. A shallow clone of a compose repo is tiny; raise this only if
# you track compose files in a legitimately large repository. Default
# 104857600 (100 MB).
GITSOURCE_MAX_CLONE_BYTES=104857600

# Idle-output backstop for deploy and update compose steps (pull/recreate). If a
# step produces no output for this long while still running, Sencho treats it as
# stalled and stops it, so a hung image pull surfaces a clear failure (and the
# in-app recovery actions) instead of spinning. Conservative by default because a
# working pull can be briefly silent while a large layer extracts; raise it on
# slow links or heavy local builds. Default 600000 (10 minutes).
# SENCHO_COMPOSE_STALL_TIMEOUT_MS=600000

# Container-side path to the OpenZFS ARC stats file, for ZFS-aware host memory.
# On ZFS hosts (TrueNAS SCALE, Proxmox, ZFS on Ubuntu/Debian) the ARC cache is
# reclaimable but the kernel reports it as used, which can trigger false
# host-memory alerts. When ARC stats are readable, Sencho adds reclaimable ARC
# back into available memory. Sencho checks this path first, then
# /host/proc/spl/kstat/zfs/arcstats, then /proc/spl/kstat/zfs/arcstats. Set this
# only if your ARC stats live at a non-standard path inside the container. If no
# ARC stats are readable, host memory reporting is unchanged.
# SENCHO_ZFS_ARCSTATS_PATH=