# Sencho Configuration
# Copy this file to .env and update the values for production

# JWT secret - generate a secure random string for production
JWT_SECRET=your-secure-jwt-secret-here

# Directory containing docker-compose files
COMPOSE_DIR=/path/to/your/compose/files

# ─── SSO / LDAP Configuration (Admiral) ───────────────────────────

# LDAP / Active Directory
SSO_LDAP_ENABLED=false
SSO_LDAP_URL=ldap://ldap.example.com:389
SSO_LDAP_BIND_DN=cn=readonly,dc=example,dc=com
SSO_LDAP_BIND_PASSWORD=
SSO_LDAP_SEARCH_BASE=ou=users,dc=example,dc=com
SSO_LDAP_SEARCH_FILTER=(uid={{username}})
SSO_LDAP_ADMIN_GROUP_DN=
SSO_LDAP_DEFAULT_ROLE=viewer
SSO_LDAP_TLS_REJECT_UNAUTHORIZED=true

# Google OIDC
SSO_OIDC_GOOGLE_ENABLED=false
SSO_OIDC_GOOGLE_CLIENT_ID=
SSO_OIDC_GOOGLE_CLIENT_SECRET=

# GitHub OAuth
SSO_OIDC_GITHUB_ENABLED=false
SSO_OIDC_GITHUB_CLIENT_ID=
SSO_OIDC_GITHUB_CLIENT_SECRET=

# Okta OIDC
SSO_OIDC_OKTA_ENABLED=false
SSO_OIDC_OKTA_ISSUER_URL=
SSO_OIDC_OKTA_CLIENT_ID=
SSO_OIDC_OKTA_CLIENT_SECRET=

# Role mapping (shared across OIDC providers)
SSO_OIDC_ADMIN_CLAIM=groups
SSO_OIDC_ADMIN_CLAIM_VALUE=sencho-admins
SSO_DEFAULT_ROLE=viewer

# External base URL for OAuth callback URLs (required behind reverse proxy)
SSO_CALLBACK_URL=