59 lines
2.9 KiB
Plaintext
59 lines
2.9 KiB
Plaintext
# identity configuration template.
|
|
#
|
|
# Copy this to the container host as (for example)
|
|
# /opt/smart-home/identity/identity.env, fill in real values, and chmod 600 it.
|
|
# Same never-commit handling as admin-canvas.env / pantry-vision.env.
|
|
|
|
# ---------------------------------------------------------------------------
|
|
# Auth — required. identity fails closed (rejects every request) while this is
|
|
# empty. Also has to be baked into every kiosk that calls this service directly
|
|
# (hosts/kitchen-display/, hosts/door-panel/), same reasoning as
|
|
# PANTRY_VISION_TOKEN. Generate one with:
|
|
# openssl rand -hex 32
|
|
# ---------------------------------------------------------------------------
|
|
IDENTITY_TOKEN=
|
|
|
|
# ---------------------------------------------------------------------------
|
|
# Home Assistant — required for registration and presence lookups.
|
|
#
|
|
# NOT http://homeassistant:8123 — the homeassistant container runs with
|
|
# `network_mode: host` (setup-container-host.sh), so it's off the compose bridge
|
|
# network entirely and unreachable by container name from here, the same reason
|
|
# Node-RED's own setup notes point at the host's real LAN IP instead. Use that IP.
|
|
#
|
|
# HA_TOKEN is a Long-Lived Access Token: HA's own UI, click your profile (bottom
|
|
# left) -> Security tab -> Long-Lived Access Tokens -> Create Token. There is no
|
|
# way for this repo to generate or push this for you.
|
|
# ---------------------------------------------------------------------------
|
|
HA_URL=http://192.168.1.10:8123
|
|
HA_TOKEN=
|
|
|
|
# ---------------------------------------------------------------------------
|
|
# Registration candidate allowlist — THE anti-spoofing boundary. Comma-separated
|
|
# entity_id PREFIXES. MUST be edited to match your real HA entity IDs (Developer
|
|
# Tools -> States, after setting up Bermuda's Private BLE Device integration and/or
|
|
# fixed-MAC BLE tags per docs/project-plan.md §1.5) before registration will ever
|
|
# find a candidate. Only put IRK-resolved Private BLE Device entities or fixed-tag
|
|
# entities here — NEVER a raw bluetooth_le_tracker/device_tracker entity backed by
|
|
# an unresolved randomized MAC. See server.py's module docstring for why.
|
|
# ---------------------------------------------------------------------------
|
|
TRUSTED_ENTITY_PREFIXES=device_tracker.pble_,device_tracker.bletag_
|
|
|
|
# ---------------------------------------------------------------------------
|
|
# MQTT — for the /weather proxy only (smarthome/weather/current, the same
|
|
# household-wide topic hosts/thin-client's idle-gallery overlay already reads).
|
|
# ---------------------------------------------------------------------------
|
|
MQTT_BROKER_HOST=mosquitto
|
|
MQTT_BROKER_PORT=1883
|
|
MQTT_USERNAME=
|
|
MQTT_PASSWORD=
|
|
|
|
# ---------------------------------------------------------------------------
|
|
# Run behaviour
|
|
# ---------------------------------------------------------------------------
|
|
IDENTITY_PORT=8097
|
|
IDENTITY_DB_PATH=/data/identity.db
|
|
IDENTITY_PHOTO_DIR=/data/photos
|
|
IDENTITY_MAX_IMAGE_MB=15
|
|
LOG_LEVEL=INFO
|