# Environment configuration for KCA. Copy to .env or export the variables.

# --- Database --------------------------------------------------------------
# PostgreSQL (default). Run `aerich upgrade` before starting the app.
DATABASE_ENGINE=postgres
DATABASE_HOST=localhost
DATABASE_PORT=5432
DATABASE_NAME=kca
DATABASE_USER=kca
DATABASE_PASSWORD=password
#DATABASE_OPTIONS=
#DATABASE_URL=

# SQLite production alternative: DATABASE_NAME is an absolute or relative file
# path; host, port, user and password are ignored. Use a persistent writable
# filesystem and run `aerich upgrade` before starting the app.
#DATABASE_ENGINE=sqlite
#DATABASE_NAME=/data/kca.db
#DATABASE_OPTIONS=busy_timeout=5000
# Equivalent single-setting form:
#DATABASE_URL=sqlite:///data/kca.db?busy_timeout=5000

# --- OIDC ------------------------------------------------------------------
# Indexed blocks OIDC_0_*, OIDC_1_*, ... with contiguous indices from 0.
OIDC_0_PROVIDER=default
OIDC_0_ISSUER=http://localhost:8180/kca
OIDC_0_CLIENT_ID=kca
OIDC_0_CLIENT_SECRET=dev-secret
OIDC_0_REDIRECT_URI=http://localhost:8080/auth/default/callback
OIDC_0_POST_LOGIN_REDIRECT=http://localhost:8080/
OIDC_0_POST_LOGOUT_REDIRECT=http://localhost:8080/

# --- Sessions --------------------------------------------------------------
REDIS_URL=redis://localhost:6379/0

# --- Private-key encryption ------------------------------------------------
# REQUIRED in production: a random 32-byte AES-256 key, base64 or hex.
#   openssl rand -base64 32
# When unset, a built-in development key is used (the UI warns about it).
#KCA_MASTER_KEY=

# Optional absolute path to an OpenSSL 3 libcrypto used for XCA legacy curves
# and hashes. Normally discovered automatically; no OpenSSL CLI is required.
#KCA_LIBCRYPTO=/usr/lib/x86_64-linux-gnu/libcrypto.so.3

# --- Application -----------------------------------------------------------
APP_HOST=0.0.0.0
APP_PORT=8080
STATIC_DIR=web/dist
MAX_UPLOAD_BYTES=20971520
KEYGEN_CONCURRENCY=2
SESSION_COOKIE_SECURE=false
#LOGGING_CONFIG=

# --- OpenTelemetry (optional) ----------------------------------------------
# The Docker image includes the 'otel' extra. Non-image installs need:
#   uv sync --package kca-app --extra otel
# Export targets are OTLP/HTTP; the /v1/traces, /v1/metrics and /v1/logs
# paths are appended automatically.
OTEL_ENABLED=false
OTEL_SERVICE_NAME=kca
#OTEL_EXPORTER_OTLP_ENDPOINT=http://localhost:4318
#OTEL_EXPORTER_OTLP_HEADERS=Authorization=Bearer token,X-Tenant=one
OTEL_EXCLUDED_PATHS=/api/health
#OTEL_METRIC_EXPORT_INTERVAL_MILLIS=60000
#OTEL_METRICS_POLL_INTERVAL_SECONDS=15

# --- OCSP status publisher (optional) --------------------------------------
# When a bucket is configured, KCA publishes one full JSON status snapshot
# per CA. The standalone OCSP responder reads these objects. Uses the normal
# AWS credential chain (AWS_ACCESS_KEY_ID /
# AWS_SECRET_ACCESS_KEY, role, instance profile, ...).
#KCA_OCSP_S3_BUCKET=kca-ocsp
KCA_OCSP_S3_PREFIX=ocsp
#KCA_OCSP_S3_REGION=eu-central-1
#KCA_OCSP_S3_ENDPOINT=http://localhost:9000
KCA_OCSP_S3_FORCE_PATH_STYLE=false
KCA_OCSP_PUBLISH_INTERVAL_SECONDS=1
# Republish unchanged snapshots as a liveness heartbeat. Each object receives
# an Expires header; the responder rejects it after that timestamp. Keep the
# heartbeat comfortably below the object expiry.
KCA_OCSP_HEARTBEAT_INTERVAL_SECONDS=30
KCA_OCSP_OBJECT_EXPIRY_SECONDS=60

# --- CORS (optional) -------------------------------------------------------
#CORS_ALLOW_ORIGINS=
#CORS_ALLOW_ORIGIN_REGEX=
#CORS_ALLOW_METHODS=GET
#CORS_ALLOW_HEADERS=
#CORS_ALLOW_CREDENTIALS=false
#CORS_EXPOSE_HEADERS=
#CORS_MAX_AGE=600