# ATAuth Gateway Configuration
# Copy to .env and fill in required values

# Server
PORT=3100
HOST=0.0.0.0

# OAuth Client Configuration (AT Protocol)
OAUTH_CLIENT_ID=https://auth.yourdomain.com/client-metadata.json
OAUTH_REDIRECT_URI=https://auth.yourdomain.com/auth/callback

# Admin API Token (generate with: openssl rand -hex 32)
ADMIN_TOKEN=

# Database Path (SQLite)
# Docker Compose overrides this to /app/data/gateway.db
DB_PATH=./data/gateway.db

# CORS Origins (comma-separated)
CORS_ORIGINS=http://localhost:3000,https://app.yourdomain.com

# --- OIDC Provider ---
OIDC_ENABLED=true
OIDC_ISSUER=https://auth.yourdomain.com
# REQUIRED when OIDC is enabled (generate with: openssl rand -hex 32)
OIDC_KEY_SECRET=
OIDC_KEY_ALGORITHM=ES256

# --- Passkey/WebAuthn ---
PASSKEY_ENABLED=true
WEBAUTHN_RP_NAME=ATAuth
WEBAUTHN_RP_ID=auth.yourdomain.com
WEBAUTHN_ORIGIN=https://auth.yourdomain.com

# --- MFA/TOTP ---
# MFA is enabled by default; set MFA_ENABLED=false to disable
MFA_TOTP_ISSUER=ATAuth
# REQUIRED when MFA is enabled - 64 hex chars (generate with: openssl rand -hex 32)
MFA_ENCRYPTION_KEY=
MFA_BACKUP_CODES_COUNT=10

# --- Email Verification ---
EMAIL_ENABLED=false
# EMAIL_PROVIDER=smtp
# EMAIL_FROM=ATAuth <noreply@yourdomain.com>
# SMTP_HOST=smtp.yourdomain.com
# SMTP_PORT=587
# SMTP_SECURE=false
# SMTP_USER=
# SMTP_PASS=

# --- Forward-Auth Proxy ---
FORWARD_AUTH_ENABLED=false
# REQUIRED when forward-auth is enabled (generate with: openssl rand -hex 32)
# FORWARD_AUTH_SESSION_SECRET=
# FORWARD_AUTH_SESSION_TTL=604800
# FORWARD_AUTH_PROXY_COOKIE_TTL=86400