.env.example

# =============================================================================
# Enterprise Shell - Environment Variables
# =============================================================================
# Copy this file to .env.local and fill in the values for your environment.
# DO NOT commit actual secrets to version control!
# =============================================================================

# -----------------------------------------------------------------------------
# Backend Signing (HMAC-SHA256)
# -----------------------------------------------------------------------------
# Secret key used to sign backend requests (badge events, session data)
# Generate a secure random string: openssl rand -base64 32
BACKEND_SIGNING_SECRET=

# -----------------------------------------------------------------------------
# Admin Authentication
# -----------------------------------------------------------------------------
# API key fallback for admin endpoints (development only, use JWT in production)
# Generate a secure random string: openssl rand -hex 32
ADMIN_API_KEY=

# -----------------------------------------------------------------------------
# Redis Configuration (Optional)
# -----------------------------------------------------------------------------
# Redis connection URL for production multi-instance deployments
# Format: redis[s]://[[username:]password@]host[:port][/database]
# Optional - uses in-memory storage if not set
REDIS_URL=

# Nonce TTL in seconds (default: 300 = 5 minutes)
NONCE_TTL_SECONDS=300

# -----------------------------------------------------------------------------
# OIDC / JWT Authentication (Required for Production)
# -----------------------------------------------------------------------------
# OIDC provider URL (e.g., https://login.microsoftonline.com/{tenant}/v2.0)
OIDC_ISSUER_URL=

# Client ID for this application (from OIDC provider)
OIDC_CLIENT_ID=

# Expected audience claim (optional, defaults to OIDC_CLIENT_ID)
OIDC_AUDIENCE=

# JWKS URI for token verification (optional, derived from issuer if not set)
# OIDC_JWKS_URI=

# Enable API key fallback in non-production environments
# Set to "true" to allow development without OIDC
ENABLE_DEV_BYPASS=false

# -----------------------------------------------------------------------------
# Device Registry (Optional)
# -----------------------------------------------------------------------------
# Enable allowlist-only mode - only enrolled devices can authenticate
# Set to "true" to enable (optional, default: false)
DEVICE_ALLOWLIST_MODE=false

# -----------------------------------------------------------------------------
# Session Configuration
# -----------------------------------------------------------------------------
# Maximum session duration in seconds (default: 28800 = 8 hours)
# MAX_SESSION_DURATION=28800

# --- Location Signals (optional) ---
# presence = zone-level only (recommended)
# coarse   = building/floor/zone + confidence
# precise  = only if customer has RTLS approvals
LOCATION_MODE=presence
LOCATION_MAX_AGE_SECONDS=120
LOCATION_USE_REDIS=true

# --- Integrations (optional) ---
# Used to sign outgoing webhooks (HMAC)
INTEGRATION_SIGNING_SECRET=

# --- FleetDM Telemetry (optional) ---
# FleetDM instance URL
FLEETDM_BASE_URL=

# FleetDM API token (store in env, never log or store in Redis)
FLEETDM_API_TOKEN=

# Telemetry mode: off | optional | required
# optional = posture is advisory
# required = non-compliant devices blocked from session
TELEMETRY_MODE=off

# --- WebAuthn/FIDO2 Security Keys (optional) ---
# Relying Party ID (domain, e.g., "enterprise.example.com")
WEBAUTHN_RP_ID=

# Relying Party Name
WEBAUTHN_RP_NAME=Enterprise Shell

# Origin (https://...)
WEBAUTHN_ORIGIN=

# Require step-up auth for admin portal policy edits
WEBAUTHN_REQUIRE_STEP_UP_FOR_ADMIN=false

# --- Destructive Actions (optional) ---
# Enable wipe/retire/lock actions (dangerous!)
ENABLE_DESTRUCTIVE_ACTIONS=false