66 lines
3.3 KiB
Plaintext
66 lines
3.3 KiB
Plaintext
# identity configuration template.
|
|
#
|
|
# Copy this to the container host as (for example)
|
|
# /opt/smart-home/identity/identity.env, fill in real values, and chmod 600 it.
|
|
# Same never-commit handling as admin-canvas.env / pantry-vision.env.
|
|
|
|
# ---------------------------------------------------------------------------
|
|
# Auth — required. identity fails closed (rejects every request) while this is
|
|
# empty. Also has to be baked into every kiosk that calls this service directly
|
|
# (hosts/kitchen-display/, hosts/door-panel/), same reasoning as
|
|
# PANTRY_VISION_TOKEN. Generate one with:
|
|
# openssl rand -hex 32
|
|
# ---------------------------------------------------------------------------
|
|
IDENTITY_TOKEN=
|
|
|
|
# ---------------------------------------------------------------------------
|
|
# Home Assistant — required for registration and presence lookups.
|
|
#
|
|
# NOT http://homeassistant:8123 — the homeassistant container runs with
|
|
# `network_mode: host` (setup-container-host.sh), so it's off the compose bridge
|
|
# network entirely and unreachable by container name from here, the same reason
|
|
# Node-RED's own setup notes point at the host's real LAN IP instead. Use that IP.
|
|
#
|
|
# HA_TOKEN is a Long-Lived Access Token: HA's own UI, click your profile (bottom
|
|
# left) -> Security tab -> Long-Lived Access Tokens -> Create Token. There is no
|
|
# way for this repo to generate or push this for you.
|
|
# ---------------------------------------------------------------------------
|
|
HA_URL=http://192.168.1.10:8123
|
|
HA_TOKEN=
|
|
|
|
# ---------------------------------------------------------------------------
|
|
# Registration candidate allowlist — THE anti-spoofing boundary. Comma-separated
|
|
# entity_id PREFIXES. MUST be edited to match your real HA entity IDs (Developer
|
|
# Tools -> States, after setting up Bermuda's Private BLE Device integration and/or
|
|
# fixed-MAC BLE tags per docs/project-plan.md §1.5) before registration will ever
|
|
# find a candidate. Only put IRK-resolved Private BLE Device entities or fixed-tag
|
|
# entities here — NEVER a raw bluetooth_le_tracker/device_tracker entity backed by
|
|
# an unresolved randomized MAC. See server.py's module docstring for why.
|
|
# ---------------------------------------------------------------------------
|
|
TRUSTED_ENTITY_PREFIXES=device_tracker.pble_,device_tracker.bletag_
|
|
|
|
# ---------------------------------------------------------------------------
|
|
# MQTT — the /weather proxy (smarthome/weather/current, the same household-wide
|
|
# topic hosts/thin-client's idle-gallery overlay already reads), and Frigate face
|
|
# recognition as a SECOND, corroborating presence signal (Phase 20, Tapo pan/tilt
|
|
# cameras) — never a registration signal, only ever OR-ed into /presence's "home"
|
|
# result. FRIGATE_EVENTS_TOPIC's payload shape (sub_label = ["name", confidence])
|
|
# is unverified against a real Frigate 0.16+ face-recognition deployment — see
|
|
# README.md.
|
|
# ---------------------------------------------------------------------------
|
|
MQTT_BROKER_HOST=mosquitto
|
|
MQTT_BROKER_PORT=1883
|
|
MQTT_USERNAME=
|
|
MQTT_PASSWORD=
|
|
FRIGATE_EVENTS_TOPIC=frigate/events
|
|
FACE_PRESENCE_WINDOW_SECONDS=600
|
|
|
|
# ---------------------------------------------------------------------------
|
|
# Run behaviour
|
|
# ---------------------------------------------------------------------------
|
|
IDENTITY_PORT=8097
|
|
IDENTITY_DB_PATH=/data/identity.db
|
|
IDENTITY_PHOTO_DIR=/data/photos
|
|
IDENTITY_MAX_IMAGE_MB=15
|
|
LOG_LEVEL=INFO
|