# TrueNAS connection
TRUENAS_HOST=192.168.10.10
SSH_USER=youruser

# VM identity / networking
VM_NAME=nodered
# Static IP OUTSIDE the Fritzbox DHCP pool (.20-.200) AND not already taken by
# another device — verify with `ping`/`arp` first. .12 and .13 are TAKEN (Music
# Assistant et al.), so we use .14. Must be on the same flat LAN as Home Assistant.
VM_IP=192.168.10.14
VM_SUBNET_CIDR=24
VM_GATEWAY=192.168.10.1
# DNS for the VM. Point it at your AdGuard jail (dogfooding) + a public fallback.
VM_DNS=192.168.10.11
VM_DNS_FALLBACK=1.1.1.1
# Physical NIC the VM attaches to (TrueNAS bridges it automatically). Must be the
# LAN interface that carries the NAS IP. On this box: igb0 (em0 is down).
# Find valid values: GET /api/v2.0/vm/device/nic_attach_choices
VM_NIC_ATTACH=igb0

# VM resources (Node-RED is light).
VM_VCPUS=1
VM_MEMORY_MB=1024
VM_DISK_SIZE=10G
VM_TIMEZONE=Europe/Berlin

# Storage on the NAS. VM_DATASET holds the zvol, seed ISO and image cache.
VM_POOL=tank
VM_DATASET=tank/vms

# Images
# Debian 13 "trixie" genericcloud raw image (no qemu-img needed). Check for newer point releases.
DEBIAN_IMAGE_URL=https://cloud.debian.org/images/cloud/trixie/latest/debian-13-genericcloud-amd64.raw
NODERED_IMAGE=nodered/node-red:latest

# credentialSecret to decrypt the migrated flows (nodered/seed/flows_cred.json).
# This MUST match the secret the HA Node-RED add-on used, or the credentials in
# your flows will fail to decrypt. Rendered into the compose env
# NODE_RED_CREDENTIAL_SECRET.
NODERED_CREDENTIAL_SECRET=changeme-or-your-HA-addon-credential-secret

# VM login user (for the serial console, `logs`/`update` over SSH).
VM_USER=admin
# Console/SSH password for VM_USER. Used by the TrueNAS serial console and as an
# SSH fallback when the key isn't available. CHANGE THIS from the default.
VM_PASSWORD=changeme
# Your SSH PUBLIC key for the VM login (strongly recommended; required for
# `logs`/`update`). Example: VM_SSH_AUTHORIZED_KEY="ssh-ed25519 AAAA... you@host"
VM_SSH_AUTHORIZED_KEY=