# ── FreeIPA ───────────────────────────────────────────────────────────────────
IPA_HOSTNAME=ipa.corp.example.com
IPA_DOMAIN=corp.example.com
IPA_REALM=CORP.EXAMPLE.COM
IPA_ADMIN_PASSWORD=ChangeMe123!
IPA_DM_PASSWORD=ChangeMe456!
IPA_SETUP_DNS=false
IPA_DNS_FORWARDER=
IPA_SETUP_KRA=false

# ── Ansipa SMB shares ─────────────────────────────────────────────────────────
# LUKS_KEY_UPLOAD_PASSWORD — password for the 'luks-upload' service account used
#                        by the Ansible controller to write LUKS backup keys to
#                        the ansipa-luks-keys share. Pass to collect-luks-keys.yml
#                        with -e luks_upload_password=<this value>.
#                        To grant read access, add a Samba user to KeyAdmin on the
#                        container: useradd -r -G KeyAdmin <user> && smbpasswd -a <user>
# (ClamAV scan results now go to CheckMK via the dev_mon_clamscan local check —
#  there is no longer an ansipa-scans SMB share or scanupload account.)
LUKS_KEY_UPLOAD_PASSWORD=ChangeMe_LuksUpload!

# ── CheckMK CE monitoring ─────────────────────────────────────────────────────
# CMK_ADMIN_PASSWORD — web UI password for cmkadmin.
# CMK_SITE_ID       — OMD site name (default: cmk).  Used in all CheckMK URLs and
#                     agent registration.  Must match whatever was used on first start.
# CMK_ADVERTISED_URL — URL enrolled CLIENTS use to reach CheckMK; stored in the
#                     dev_mon_base hostgroup description. Must be routable from
#                     the clients' network (the docker HOST address + published
#                     port, e.g. http://mon.corp.example.com:8090) — NOT the
#                     container-internal 172.30.0.12:5000. Leave empty only if
#                     all monitored clients run inside the same docker network.
# Web UI:  http://localhost:8090/cmk/   after `docker compose up -d`
CMK_ADMIN_PASSWORD=ChangeMe_CMK!
CMK_SITE_ID=cmk
CMK_ADVERTISED_URL=

# ── nginx gateway (reverse proxy + portal) ────────────────────────────────────
# ANSIPA_HTTP_PORT — host port the ansipa nginx gateway listens on (plain HTTP).
#   Put your own TLS-terminating reverse proxy in front of it and forward to
#   http://<docker-host>:${ANSIPA_HTTP_PORT}. The gateway fronts all UIs on one
#   host: /ipa/ (FreeIPA), /cmk/ (CheckMK), /auth/ (Keycloak), / (portal).
# Example upstream nginx (in your main reverse proxy), to expose ansipa over HTTPS:
#   location / { proxy_pass http://<docker-host>:8088; proxy_set_header Host $host;
#                proxy_set_header X-Forwarded-Proto $scheme;
#                proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; }
# Or Caddy one-liner:  ansipa.example.com { reverse_proxy <docker-host>:8088 }
ANSIPA_HTTP_PORT=8088

# ── Keycloak ──────────────────────────────────────────────────────────────────
KC_HOSTNAME=keycloak.corp.example.com
KC_REALM=corp
KC_ADMIN=admin
KC_ADMIN_PASSWORD=ChangeMe789!
KC_DB_PASSWORD=ChangeMe000!

# ── Keycloak → FreeIPA LDAP federation ───────────────────────────────────────
# Leave IPA_BIND_PASSWORD blank to reuse IPA_DM_PASSWORD.
# In production, create a dedicated read-only service account in FreeIPA.
IPA_BIND_DN=cn=Directory Manager
IPA_BIND_PASSWORD=
IPA_USE_LDAPS=false