.env.example

# ── OIDC Provider ─────────────────────────────────────────────────────────────
# Keycloak: http://<host>:8080/realms/<realm>/.well-known/openid-configuration
# Kanidm:   https://<host>/oauth2/openid/<client_name>/.well-known/openid-configuration
OIDC_DISCOVERY_URL=http://localhost:8080/realms/master/.well-known/openid-configuration

# Client credentials — create a "confidential" client in your provider
OIDC_CLIENT_ID=oidc-diagnostic-client
OIDC_CLIENT_SECRET=your-client-secret-here

# Scopes to request (space-separated).
# Standard OIDC scopes: openid email profile address phone offline_access
# Keycloak extras:      roles groups
# Note: 'roles' is Keycloak-specific, not part of the OIDC spec.
# Add only scopes your provider is configured to grant.
OIDC_SCOPE=openid email profile

# PKCE code challenge method — S256 (default, required by Kanidm), plain, or disabled
# Disable only for legacy providers that do not support PKCE.
OIDC_PKCE_METHOD=S256

# Token signing algorithm to enforce — ES256 (recommended, ECDSA) or RS256 (legacy, RSA).
# Leave unset to accept whatever algorithm the server advertises.
OIDC_TOKEN_SIGNING_ALG=ES256

# ── Flask ──────────────────────────────────────────────────────────────────────
# Generate a strong random value: python3 -c "import secrets; print(secrets.token_hex(32))"
SECRET_KEY=change-this-to-a-random-secret-key
FLASK_DEBUG=false
PORT=5000

# Pepper combined with each user's per-session key (held in their cookie) to
# encrypt session data on disk. Treat as critically as SECRET_KEY. Rotating
# this value invalidates ALL active sessions immediately.
# Generate: python3 -c "import secrets; print(secrets.token_hex(32))"
SESSION_ENCRYPTION_PEPPER=change-this-to-a-random-32-byte-hex

# Where encrypted session ciphertext is written. Defaults to /tmp/flask_session
# inside the container. Use a tmpfs mount to ensure ciphertext does not
# persist across container restarts.
# SESSION_FILE_DIR=/tmp/flask_session

# Maximum session lifetime in minutes. When a session expires you are signed
# out regardless of whether the underlying tokens are still valid. The nav bar
# shows the session expiry countdown alongside the token expiry countdown.
SESSION_LIFETIME_MINUTES=120

# ── Reverse proxy (Traefik, nginx, etc.) ──────────────────────────────────────
# The app reads X-Forwarded-Proto from Traefik automatically — no extra config needed.
# If your proxy doesn't forward that header, set this to force https:// in callback URLs.
# PREFERRED_URL_SCHEME=https

# Force the session cookie to be sent only over HTTPS (set true when behind TLS).
# This is set automatically when PREFERRED_URL_SCHEME=https; use this flag if you
# handle TLS termination another way.
# SESSION_COOKIE_SECURE=true

# ── UI options ─────────────────────────────────────────────────────────────────
# Show the configuration card (discovery URL, client ID, etc.) on the landing page.
# Defaults to false (hidden) — recommended for shared or internal deployments.
SHOW_CONFIG=false

# Show a prominent privacy/data-handling notice on the landing page.
# Enable this for any public or shared deployment so users understand what data
# is held and when it is cleared.
# PRIVACY_NOTICE=true

# Optional custom message shown on the landing page before the login button.
# Useful for demo instances, maintenance notices, or access instructions.
# BANNER_TEXT=This is a public demo. Only connect accounts you are comfortable sharing with the operator.
# BANNER_TYPE=info   # info (default) | warning | error | success