# Documentation: https://patchmon.net/docs/patchmon-operator-guide#patchmon-environment-variables-reference

# ==============================================================================
# Run the script ./setup-env.sh for easy first time filling of variables
#       Or Manually perform the tasks below
# ==============================================================================
# [ ] Enter in your frontend URLs you will use to access PatchMon in CORS_ORIGIN
# [ ] Run "openssl rand -hex 64" and put that value in the JWT_SECRET=
# [ ] Run "openssl rand -hex 64" and put that value in the AI_ENCRYPTION_KEY=
# [ ] Run "openssl rand -hex 64" and put that value in the SESSION_SECRET==
# [ ] Run "openssl rand -hex 32" and put that password in where it says POSTGRES_PASSWORD= for the postgresql database
# [ ] Run "openssl rand -hex 32" and put that password in where it says REDIS_PASSWORD= for the redis db

# ==============================================================================
# SERVER
# ==============================================================================
# CORS_ORIGIN must match your frontend URL. Comma-separated for multiple origins.
# Example: 
#CORS_ORIGIN=https://patchmon.domain.tld,http://patchmon.local:3000

CORS_ORIGIN=https://patch.mikemcfetridge.com,http://192.168.2.3:3000,http://localhost:3000
JWT_SECRET=b552dcd09a958144ee3e436acd09767574fba73d2f4237496c97e6d2d59d2b6d4575d0148a3869276130d505492e73c023d40c090c42780fb611d0be9c29f4dc

# ==============================================================================
# DATABASE (Postgresql)
# ==============================================================================
# It's optional to change the patchmon_user and patchmon_db
# POSTGRES_HOST is "database" because that's the name of the docker container.
# If you are using an external DB or localhost then you may change this accordingly

POSTGRES_HOST=database
POSTGRES_PASSWORD=0200334338be290e45a13737783fc4e3c873bf63fd4817bf6f254e23f4db38c6
POSTGRES_USER=patchmon_user
POSTGRES_DB=patchmon_db
DATABASE_URL=postgresql://${POSTGRES_USER}:${POSTGRES_PASSWORD}@${POSTGRES_HOST}:5432/${POSTGRES_DB}

# ==============================================================================
# REDIS
# ==============================================================================
## REDIS_HOST is "redis" because that's the name of the docker container.
# If you are using an external redis server then you may change this accordingly

REDIS_HOST=redis
REDIS_PORT=6379
REDIS_PASSWORD=0200334338be290e45a13737783fc4e3c873bf63fd4817bf6f254e23f4db38c6
REDIS_DB=0

# ==============================================================================
# SESSION ENCRYPTION SECRETS
# ==============================================================================
# Used in various encryptions (keep these safe)

SESSION_SECRET=b552dcd09a958144ee3e436acd09767574fba73d2f4237496c97e6d2d59d2b6d4575d0148a3869276130d505492e73c023d40c090c42780fb611d0be9c29f4dc
AI_ENCRYPTION_KEY=b552dcd09a958144ee3e436acd09767574fba73d2f4237496c97e6d2d59d2b6d4575d0148a3869276130d505492e73c023d40c090c42780fb611d0be9c29f4dc

# ==============================================================================
# GUACAMOLE (Windows RDP - Beta)
# ==============================================================================
# RDP: connect to guacd sidecar (server image has no guacd binary)

GUACD_ADDRESS=guacd:4822


# ==============================================================================
# OPTIONAL - CAN BE CONFIGURED VIA APP SETTINGS UI
# ==============================================================================
### Setting them here overrides the configured settings from the app or defaults coded in 

## Server
## TRUST_PROXY is to be set to true if you are using another proxy in front of the app like nginx / caddy etc
# ENABLE_HSTS=false
TRUST_PROXY=true

## Timezone (TZ or TIMEZONE) Set in full as an example : TZ=Europe/London
# TZ=UTC

## Logging
## LOG_LEVEL can be info/warn/debug/error
# ENABLE_LOGGING=true
# LOG_LEVEL=info

## Authentication / Lockout
# MAX_LOGIN_ATTEMPTS=5
# LOCKOUT_DURATION_MINUTES=15
# SESSION_INACTIVITY_TIMEOUT_MINUTES=30
# TFA_MAX_REMEMBER_SESSIONS=5

## Auth / JWT / TFA
# When true, auth cookies are browser session cookies (cleared when the browser session ends; not persisted across browser restarts).
# AUTH_BROWSER_SESSION_COOKIES=true
# JWT_EXPIRES_IN=1h
# MAX_TFA_ATTEMPTS=5
# TFA_LOCKOUT_DURATION_MINUTES=30
# TFA_REMEMBER_ME_EXPIRES_IN=30d

## Password policy
# PASSWORD_MIN_LENGTH=8
# PASSWORD_REQUIRE_UPPERCASE=true
# PASSWORD_REQUIRE_LOWERCASE=true
# PASSWORD_REQUIRE_NUMBER=true
# PASSWORD_REQUIRE_SPECIAL=true

## Body limits (e.g. 5mb, 10mb, 2mb)
# JSON_BODY_LIMIT=5mb
# AGENT_UPDATE_BODY_LIMIT=2mb

## Env file path (default: .env)
# ENV_FILE=.env

## Database connection / pool (startup only)
# PM_DB_CONN_MAX_ATTEMPTS=30
# PM_DB_CONN_WAIT_INTERVAL=2
# DB_CONNECTION_LIMIT=30
# DB_CONNECT_TIMEOUT=10
# DB_TRANSACTION_LONG_TIMEOUT=60000

## Server - Port 3000 is the frontend port, which is proxying backend queries to the backend. This is handled by the server itself. If you change this port, you change the port that is used to access PatchMon and therefore will also need to ammend the "ports" values in your docker-compose.yml
# PORT=3000
# APP_ENV=production

## Rate limits (env-only)
# RATE_LIMIT_WINDOW_MS=900000
# RATE_LIMIT_MAX=5000
# AUTH_RATE_LIMIT_WINDOW_MS=600000
# AUTH_RATE_LIMIT_MAX=500
# AGENT_RATE_LIMIT_WINDOW_MS=60000
# AGENT_RATE_LIMIT_MAX=1000
# PASSWORD_RATE_LIMIT_WINDOW_MS=900000
# PASSWORD_RATE_LIMIT_MAX=5

## User default - Can be changed in settings
# DEFAULT_USER_ROLE=user

## Redis
# REDIS_TLS=false
# REDIS_TLS_VERIFY=false
# REDIS_TLS_CA=/path/to/ca.pem
# REDIS_CONNECT_TIMEOUT_MS=60000
# REDIS_COMMAND_TIMEOUT_MS=60000

## OIDC / SSO (when OIDC_ENABLED=true, issuer/client/secret/redirect required)
# OIDC_ENABLED=false
# OIDC_ISSUER_URL=
# OIDC_CLIENT_ID=
# OIDC_CLIENT_SECRET=
# OIDC_REDIRECT_URI=
# OIDC_SCOPES=openid email profile groups
# OIDC_AUTO_CREATE_USERS=false
# OIDC_DEFAULT_ROLE=user
# OIDC_DISABLE_LOCAL_AUTH=false
# OIDC_BUTTON_TEXT=Login with SSO
# OIDC_SESSION_TTL=600
# OIDC_POST_LOGOUT_URI=
# OIDC_SYNC_ROLES=false
# OIDC_ADMIN_GROUP=
# OIDC_SUPERADMIN_GROUP=
# OIDC_HOST_MANAGER_GROUP=
# OIDC_READONLY_GROUP=
# OIDC_USER_GROUP=
# OIDC_ENFORCE_HTTPS=true
# FRONTEND_URL=       # Fallback for OIDC_POST_LOGOUT_URI

## Agent binaries
# AGENTS_DIR=agents
# AGENT_BINARIES_DIR # 

## RDP (in-browser RDP for Windows hosts via guacd)
# GUACD_PATH=       # Path to guacd binary, or empty to use PATH
# GUACD_ADDRESS=127.0.0.1:4822