# ============================================================
# Homelab Environment Variables
# Copy to .env and edit ALL values before deploying.
# ============================================================

# ── Host ────────────────────────────────────────────────────
HOST_IP=10.10.x.x
HOST_HOSTNAME=homelab.local
TZ=Europe/London

# ── Shared credentials ───────────────────────────────────────
ADMIN_PASSWORD=ChangeMe
ADMIN_EMAIL=admin@homelab.local

# ── Authentik ───────────────────────────────────────────────
AUTHENTIK_SECRET_KEY=ChangeMeToA50CharRandomString__________________
AUTHENTIK_DB_PASSWORD=ChangeMe

# ── Grafana ─────────────────────────────────────────────────
GRAFANA_ADMIN_PASSWORD=ChangeMe
# OAuth client secret from Authentik application
GRAFANA_OAUTH_CLIENT_SECRET=ChangeMe

# ── SonarQube ───────────────────────────────────────────────
SONARQUBE_DB_PASSWORD=ChangeMe

# ── Vaultwarden ─────────────────────────────────────────────
VAULTWARDEN_ADMIN_TOKEN=ChangeMe

# ── n8n ─────────────────────────────────────────────────────
N8N_ENCRYPTION_KEY=ChangeMeToA32CharRandomString___

# ── MinIO ───────────────────────────────────────────────────
MINIO_ROOT_USER=admin
MINIO_ROOT_PASSWORD=ChangeMe

# ── Netbox ──────────────────────────────────────────────────
# Must be 50+ characters
NETBOX_SECRET_KEY=ChangeMeToA50PlusCharRandomString________________________
NETBOX_DB_PASSWORD=ChangeMe
NETBOX_SUPERUSER_API_TOKEN=ChangeMeToA40HexCharString______________________

# ── DefectDojo ──────────────────────────────────────────────
DEFECTDOJO_SECRET_KEY=ChangeMe
DEFECTDOJO_CREDENTIAL_KEY=ChangeMe
DEFECTDOJO_DB_PASSWORD=ChangeMe

# ── BookStack ───────────────────────────────────────────────
# Generate with: docker run --rm --entrypoint /bin/bash lscr.io/linuxserver/bookstack:latest appkey
BOOKSTACK_APP_KEY=base64:ChangeMe__see_README_for_generation_command
BOOKSTACK_DB_PASSWORD=ChangeMe

# ── Semaphore ───────────────────────────────────────────────
SEMAPHORE_ACCESS_KEY_ENCRYPTION=ChangeMeToA32CharString_________

# ── WireGuard Easy ──────────────────────────────────────────
# Generate with: echo -n "yourpassword" | docker run --rm -i ghcr.io/wg-easy/wg-easy wgpw
# Double up all $ signs before pasting (e.g. $$2b$$12$$...)
WG_PASSWORD_HASH=$$2b$$12$$ChangeMe__see_README_for_generation_command

# ── OpenCanary ──────────────────────────────────────────────
CANARY_ALERT_EMAIL=alerts@example.com
NTFY_URL=http://10.10.x.x:8085/homelab-security

# ── CrowdSec ────────────────────────────────────────────────
# Get enrolment key from app.crowdsec.net
CROWDSEC_ENROLLMENT_KEY=your_enrollment_key_here

# ── Wazuh ───────────────────────────────────────────────────
# Wazuh uses its own internal certs, no config needed here

# ── pgAdmin ─────────────────────────────────────────────────
PGADMIN_EMAIL=admin@example.com
PGADMIN_PASSWORD=ChangeMe

# ── Paperless-ngx ───────────────────────────────────────────
# Generate with: python3 -c "import secrets; print(secrets.token_urlsafe(50))"
PAPERLESS_SECRET_KEY=ChangeMeToA50CharRandomStringForPaperless_____________

# ── Huginn ──────────────────────────────────────────────────
# Generate with: python3 -c "import secrets; print(secrets.token_urlsafe(50))"
HUGINN_SECRET_TOKEN=ChangeMeToA50CharRandomStringForHuginn________________