# Sencho Configuration
# Copy this file to .env and update the values for production

# JWT secret - generate a secure random string for production
JWT_SECRET=your-secure-jwt-secret-here

# Directory containing docker-compose files
COMPOSE_DIR=/path/to/your/compose/files

# HTTP server port (default: 3000)
PORT=3000

# Database and state directory inside the container (default: /app/data)
DATA_DIR=/app/data

# Node environment (set automatically in Docker image; only change for local dev)
NODE_ENV=production

# Frontend URL for CORS in production (leave empty for same-origin setups)
FRONTEND_URL=

# Global API rate limit (requests per minute per user session, production only)
# Authenticated requests are keyed by user ID; unauthenticated by IP.
# Internal node-to-node traffic (node_proxy tokens) bypasses this limit entirely.
API_RATE_LIMIT=200

# Polling endpoint rate limit (requests per minute, production only)
# Applies to dashboard/status polling endpoints that are exempt from the global limit.
# Increase for environments with many concurrent browser sessions behind shared NAT.
API_POLLING_RATE_LIMIT=300

# ─── SSO / LDAP Configuration (Admiral) ───────────────────────────

# LDAP / Active Directory
SSO_LDAP_ENABLED=false
SSO_LDAP_URL=ldap://ldap.example.com:389
SSO_LDAP_BIND_DN=cn=readonly,dc=example,dc=com
SSO_LDAP_BIND_PASSWORD=
SSO_LDAP_SEARCH_BASE=ou=users,dc=example,dc=com
SSO_LDAP_SEARCH_FILTER=(uid={{username}})
SSO_LDAP_ADMIN_GROUP_DN=
SSO_LDAP_DEFAULT_ROLE=viewer
SSO_LDAP_DISPLAY_NAME=LDAP
SSO_LDAP_TLS_REJECT_UNAUTHORIZED=true

# Google OIDC
SSO_OIDC_GOOGLE_ENABLED=false
SSO_OIDC_GOOGLE_CLIENT_ID=
SSO_OIDC_GOOGLE_CLIENT_SECRET=

# GitHub OAuth
SSO_OIDC_GITHUB_ENABLED=false
SSO_OIDC_GITHUB_CLIENT_ID=
SSO_OIDC_GITHUB_CLIENT_SECRET=

# Okta OIDC
SSO_OIDC_OKTA_ENABLED=false
SSO_OIDC_OKTA_ISSUER_URL=
SSO_OIDC_OKTA_CLIENT_ID=
SSO_OIDC_OKTA_CLIENT_SECRET=

# Role mapping (shared across OIDC providers)
SSO_OIDC_ADMIN_CLAIM=groups
SSO_OIDC_ADMIN_CLAIM_VALUE=sencho-admins
SSO_DEFAULT_ROLE=viewer

# External base URL for OAuth callback URLs (required behind reverse proxy)
SSO_CALLBACK_URL=