# identity configuration template.
#
# Copy this to the container host as (for example)
# /opt/smart-home/identity/identity.env, fill in real values, and chmod 600 it.
# Same never-commit handling as admin-canvas.env / pantry-vision.env.

# ---------------------------------------------------------------------------
# Auth — required. identity fails closed (rejects every request) while this is
# empty. Also has to be baked into every kiosk that calls this service directly
# (hosts/kitchen-display/, hosts/door-panel/), same reasoning as
# PANTRY_VISION_TOKEN. Generate one with:
#   openssl rand -hex 32
# ---------------------------------------------------------------------------
IDENTITY_TOKEN=

# ---------------------------------------------------------------------------
# Home Assistant — required for registration and presence lookups.
#
# NOT http://homeassistant:8123 — the homeassistant container runs with
# `network_mode: host` (setup-container-host.sh), so it's off the compose bridge
# network entirely and unreachable by container name from here, the same reason
# Node-RED's own setup notes point at the host's real LAN IP instead. Use that IP.
#
# HA_TOKEN is a Long-Lived Access Token: HA's own UI, click your profile (bottom
# left) -> Security tab -> Long-Lived Access Tokens -> Create Token. There is no
# way for this repo to generate or push this for you.
# ---------------------------------------------------------------------------
HA_URL=http://192.168.1.10:8123
HA_TOKEN=

# ---------------------------------------------------------------------------
# Registration candidate allowlist — THE anti-spoofing boundary. Comma-separated
# entity_id PREFIXES. MUST be edited to match your real HA entity IDs (Developer
# Tools -> States, after setting up Bermuda's Private BLE Device integration and/or
# fixed-MAC BLE tags per docs/project-plan.md §1.5) before registration will ever
# find a candidate. Only put IRK-resolved Private BLE Device entities or fixed-tag
# entities here — NEVER a raw bluetooth_le_tracker/device_tracker entity backed by
# an unresolved randomized MAC. See server.py's module docstring for why.
# ---------------------------------------------------------------------------
TRUSTED_ENTITY_PREFIXES=device_tracker.pble_,device_tracker.bletag_

# ---------------------------------------------------------------------------
# MQTT — the /weather proxy (smarthome/weather/current, the same household-wide
# topic hosts/thin-client's idle-gallery overlay already reads), and Frigate face
# recognition as a SECOND, corroborating presence signal (Phase 20, Tapo pan/tilt
# cameras) — never a registration signal, only ever OR-ed into /presence's "home"
# result. FRIGATE_EVENTS_TOPIC's payload shape (sub_label = ["name", confidence])
# is unverified against a real Frigate 0.16+ face-recognition deployment — see
# README.md.
# ---------------------------------------------------------------------------
MQTT_BROKER_HOST=mosquitto
MQTT_BROKER_PORT=1883
MQTT_USERNAME=
MQTT_PASSWORD=
FRIGATE_EVENTS_TOPIC=frigate/events
FACE_PRESENCE_WINDOW_SECONDS=600

# ---------------------------------------------------------------------------
# Visit history — "who was home when, and with whom". identity samples its own
# /presence on a timer and writes arrival/departure rows; nothing pushes events at
# it. See server.py's "VISITS ARE SAMPLED, NOT REPORTED".
#
# PRESENCE_POLL_SECONDS   how often to sample. Each sample is a full HA /api/states
#                         fetch, so this is deliberately coarse — it's a household
#                         log, not a security audit trail.
# DEPARTURE_GRACE_SECONDS how long someone must read as "not home" before their
#                         visit is closed. BLE presence flaps (a phone in a pocket
#                         in the far room drops out and comes back); without this,
#                         one evening at home becomes forty "visits". The recorded
#                         departure time is the last moment they were actually seen,
#                         not when this window expired.
# VISIT_MAX_OPEN_HOURS    safety net for a visit that never gets a definite "not
#                         home" to close it (someone device-less marked home by hand
#                         and never marked away). Closed as 'timed_out', never as
#                         'departed' — the log never claims to have observed a
#                         departure it didn't.
# ---------------------------------------------------------------------------
PRESENCE_POLL_SECONDS=60
DEPARTURE_GRACE_SECONDS=900
VISIT_MAX_OPEN_HOURS=72

# ---------------------------------------------------------------------------
# Arrival push notifications — "tell me when someone gets home." Fires on the same
# arrival transition the visit log above is built from (a trusted identifier coming
# into range and HA registering it), so there's exactly one definition of "arrived."
#
# Per-person opt-in: tick "Push me when someone gets home" in the admin panel. A
# person can also untick "announce my arrivals" to keep their own comings and goings
# out of everyone else's notifications.
#
# NTFY_URL — the same self-hosted ntfy this stack already runs for `chores`
#   (setup-container-host.sh's ENABLE_NTFY). This is a call from one container to
#   another; identity itself never talks to the WAN.
#
#   Unlike HA_URL above, a container NAME works here: ntfy is an ordinary service on
#   the compose bridge network, so Docker's own DNS resolves "ntfy" — and the port is
#   its INTERNAL 80, not the 8090 published to the LAN. (homeassistant is the odd one
#   out because it runs network_mode: host, which is why HA_URL needs a real IP.)
# NTFY_DEFAULT_TOPIC — fallback for anyone without their own topic set in the admin
#   panel. Leave both blank to turn the whole feature off; it then silently no-ops.
#
# WHETHER YOUR PHONE ACTUALLY RINGS WHILE YOU'RE OUT IS A NETWORK QUESTION, NOT AN
# identity ONE — and "did they get home while I was out?" is most of the point of
# this feature. docs/network-integration.md's answer applies unchanged: WireGuard
# back into your own network, never a port-forward. See identity/README.md's
# "Getting the push while you're actually away".
# ---------------------------------------------------------------------------
NTFY_URL=http://ntfy
NTFY_DEFAULT_TOPIC=household

# ---------------------------------------------------------------------------
# Run behaviour
# ---------------------------------------------------------------------------
IDENTITY_PORT=8097
IDENTITY_DB_PATH=/data/identity.db
IDENTITY_PHOTO_DIR=/data/photos
# Background images for the admin panel's floorplan editor. Same volume as the
# registration photos — cover it with whatever backs up /data.
IDENTITY_FLOORPLAN_DIR=/data/floorplans
IDENTITY_MAX_IMAGE_MB=15
LOG_LEVEL=INFO