# theta-env — unified SSO Manager + Proxy deployment.
#
# Copy this file to `.env` and fill in the values, then run `./setup.sh`.
# All values are read by setup.sh / docker-compose / the bootstrap.

# ── Directory / domain (REQUIRED-ish — set these) ────────────────────────────

# Your organization's LDAP base DN. Derives the LDAP domain + cert defaults.
LDAP_BASE_DN=dc=example,dc=com
# DNS domain (dc=foo,dc=bar -> foo.bar). Leave blank to derive from LDAP_BASE_DN.
LDAP_DOMAIN=
LDAP_ADMIN_PASS=change-me-ldap-admin-password
ORG_NAME=My Org

# ── Public hostnames (REQUIRED) ───────────────────────────────────────────────
# The proxy serves the SSO Manager UI at https://<SSO_HOST> and its own
# management UI at https://<PROXY_HOST>. Both must resolve (DNS or hosts file)
# to the host running this stack, and the proxy must be able to complete ACME
# (port 80 reachable) for real certs — or use the self-signed fallback on LAN.
SSO_HOST=sso.example.com
PROXY_HOST=proxy.example.com

# ── First admin (created in the SSO by the bootstrap) ───────────────────────
# The bootstrap creates this user in LDAP, adds them to app_sso_admin +
# app_sso_oauth_admin, and logs in as them to register the proxy OAuth client.
# Re-running setup.sh resets this password to BOOTSTRAP_ADMIN_PASS.
BOOTSTRAP_ADMIN_UID=admin
BOOTSTRAP_ADMIN_PASS=change-me-admin-password
BOOTSTRAP_ADMIN_EMAIL=admin@example.com

# ── Proxy LDAP service account (created by the bootstrap) ────────────────────
# The proxy binds to LDAP as cn=ldapclient,ou=people,<base> with this password.
# Re-running setup.sh resets it to LDAP_SERVICE_PASS.
LDAP_SERVICE_PASS=change-me-ldap-service-password

# ── OAuth JWT secret (REQUIRED — persist it) ────────────────────────────────
# Signs the SSO's access/refresh tokens. Generate with: openssl rand -hex 32
# Leave blank to auto-generate (NOT persisted across container recreation —
# set it explicitly for a stable install).
JWT_SECRET=

# ── Optional: outbound email (SSO password resets / invites) ─────────────────
SMTP_HOST=
SMTP_PORT=587
SMTP_USER=
SMTP_PASS=
SMTP_FROM=

# ── Optional: host port overrides ───────────────────────────────────────────
# SSO web UI (mapped to host for first-run convenience; the proxy fronts it in
# normal use, so you can leave it unmapped by setting SSO_PORT=0).
SSO_PORT=3001
LDAPS_PORT=636
# Proxy listeners:
HTTP_PORT=80
HTTPS_PORT=443
HTTPS_ALT_PORT=4443
MGMT_PORT=3000

# ── Optional: LDAP TLS cert CN (hostname LDAPS clients verify) ───────────────
# Defaults to LDAP_DOMAIN. Set to the hostname the proxy connects via
# (sso-manager inside the docker net uses the service name, which is in the
# cert's SAN, so the default is usually fine).
LDAP_CERT_CN=