# Port to expose Rackpad on (default: 3000)
RACKPAD_PORT=3000

# Background health-check loop interval in milliseconds
MONITOR_INTERVAL_MS=300000

# Set to 1 when Rackpad sits behind Nginx, Caddy, Traefik, or another reverse proxy
TRUST_PROXY=0

# Optional comma-separated hostnames Rackpad should accept in production
# Example: TRUSTED_HOSTS=rackpad.example.com
TRUSTED_HOSTS=

# Optional comma-separated browser origins Rackpad should trust in production
# Example: TRUSTED_ORIGINS=https://rackpad.example.com
TRUSTED_ORIGINS=

# Optional OIDC sign-in. APP_URL should be the public Rackpad origin.
OIDC_ENABLED=0
APP_URL=
OIDC_ISSUER_URL=
OIDC_CLIENT_ID=
OIDC_CLIENT_SECRET=
OIDC_REDIRECT_URI=
OIDC_LABEL=OIDC
OIDC_DEFAULT_ROLE=viewer
# Set to 1 while troubleshooting issuer/discovery/token endpoint problems.
OIDC_DEBUG=0
# Optional comma-separated role mappings.
OIDC_ADMIN_USERS=
OIDC_EDITOR_USERS=
OIDC_VIEWER_USERS=
OIDC_ADMIN_GROUPS=
OIDC_EDITOR_GROUPS=
OIDC_VIEWER_GROUPS=

# Set to 0 to prevent discovery from refreshing IEEE MAC OUI vendor data.
OUI_AUTO_UPDATE=1

# MAC discovery mode: auto, neighbor, arp-scan, nmap, or off.
# auto tries arp-scan/nmap when available, then falls back to the OS neighbor cache.
DISCOVERY_MAC_SCAN_MODE=auto

# Bound concurrent discovery work. Manual and scheduled scans share this queue.
DISCOVERY_SCAN_MAX_ACTIVE=2
DISCOVERY_SCAN_MAX_ACTIVE_PER_LAB=1
DISCOVERY_SCAN_MAX_QUEUED=32

# ── SNMP monitoring, sync, and traps ──────────────────────────
# Required before storing shared SNMP credential secrets. Use a long random
# value (e.g. `openssl rand -hex 32`). Without it, shared SNMP credentials
# cannot be saved; ICMP/TCP/HTTP and inline SNMP v1/v2c monitoring still work.
RACKPAD_SECRET_KEY=

# Set to 1 to enable SNMP inventory sync (applies VLANs + subnets; DHCP scopes
# are preview-only). Disabled by default.
SNMP_INVENTORY_SYNC=0

# SNMP trap receiver. Enabled by default; listens on UDP 1162 (unprivileged so
# Docker does not need extra capabilities — forward 162 to 1162 upstream).
# Traps are logged by default; monitor state only changes when the trap matches
# a configured monitor/source credential or community. When containerised, also
# publish the port, e.g. `-p 1162:1162/udp`.
SNMP_TRAP_ENABLED=1
SNMP_TRAP_PORT=1162
SNMP_TRAP_BIND=0.0.0.0

# GitHub user/org that owns the GHCR image (used by docker-compose.yml)
GITHUB_REPO_OWNER=kobii-git

# Image tag or release version to pull
RACKPAD_TAG=latest