# Example /data/tasmofleet.env for an example deployment: bootstrap settings only.
# Everything else (device networks, MQTT, firmware, backups, updates, discovery, policy,
# single sign-on, ...) is configured on the System settings page and stored in the
# database. Keys may carry the TASMOFLEET_ prefix; real environment variables win.
# Secrets can also be given as <KEY>_FILE (path to a file holding the value).
# Do not commit a filled-in copy.
#
# A fresh container needs none of this: it serves a self-signed certificate on :8443,
# creates the first admin (password in /data/initial-admin-password) and starts the setup.

DATA_DIR=/data
LISTEN=:8080

# Device-facing firmware listener: plain HTTP on the container IP (IoT firewall rule is IP based).
# The URL the devices use (FIRMWARE_BASE_URL) is set on the System settings page.
FIRMWARE_LISTEN=:80

# External URL (OIDC redirect = PUBLIC_URL + BASE_PATH + /oidc/callback).
PUBLIC_URL=https://tasmofleet.example.com
BASE_PATH=

# Only the Traefik host may set forwarded headers; with a proxy the listener stays plain HTTP.
TRUSTED_PROXIES=172.31.12.20/32

# Break-glass: a local admin on the login page (create with: tasmofleet user add --role admin <user>;
# reset with: tasmofleet user passwd <user>). See docs/runbooks/emergency-access.md.
LOCAL_LOGIN=true
# INITIAL_ADMIN_PASSWORD_FILE=/data/initial-admin-password-seed
# METRICS_TOKEN_FILE=/data/metrics-token
# LOG_LEVEL=info  (set here it locks the level; leave it out to choose it on the settings page)
LOG_FORMAT=json

# Single sign-on can be set here (then it is read-only on the settings page) or on the page itself:
# AUTH_MODE=oidc
# OIDC_ISSUER=https://auth.example.com/application/o/tasmofleet/
# OIDC_CLIENT_ID=
# OIDC_CLIENT_SECRET_FILE=/data/oidc-client-secret
# ADMIN_GROUPS=Tasmofleet Admins
# OPERATOR_GROUPS=Tasmofleet Users