# ============================================
# ServerKit Configuration
# ============================================
# Copy this file to .env and customize for your environment
# Generate secure keys with: python -c "import secrets; print(secrets.token_hex(32))"
# ============================================

# ----------------------------------------
# REQUIRED: Security Keys
# ----------------------------------------
# Generate unique keys for production!
SECRET_KEY=your-secret-key-here
JWT_SECRET_KEY=your-jwt-secret-key-here
# Fernet key for encrypting secrets at rest.
# Generate with: python -c "from cryptography.fernet import Fernet; print(Fernet.generate_key().decode())"
SERVERKIT_ENCRYPTION_KEY=your-fernet-key-here

# ----------------------------------------
# Database Configuration
# ----------------------------------------
# SQLite (default - good for small deployments):
DATABASE_URL=sqlite:///serverkit.db

# PostgreSQL (recommended for production):
# DATABASE_URL=postgresql://user:password@localhost:5432/serverkit

# MySQL:
# DATABASE_URL=mysql://user:password@localhost:3306/serverkit

# ----------------------------------------
# Network Configuration
# ----------------------------------------
# CORS Origins - your domain(s), comma-separated
CORS_ORIGINS=http://localhost,https://your-domain.com

# Public URL that agents should dial back to. Set this whenever the panel
# sits behind a reverse proxy / tunnel / custom domain — the connection
# string the panel issues to agents will embed this URL instead of the
# request's Host header (which would otherwise be the internal IP/port).
# Leave commented out for plain localhost development.
# SERVERKIT_PUBLIC_URL=https://panel.your-domain.com

# Ports (for Docker)
PORT=80
SSL_PORT=443

# ----------------------------------------
# Trusted reverse proxy (client IP)
# ----------------------------------------
# The panel runs behind its bundled nginx, so the real client IP arrives in
# X-Forwarded-For and the raw socket peer is nginx. Enable this so ServerKit
# trusts the proxy and derives the real client IP (via Werkzeug ProxyFix) for
# rate-limiting, login lockout and audit logs. Leave it FALSE / unset only for
# a directly-exposed server with no proxy in front (otherwise a client could
# forge X-Forwarded-For). TRUSTED_PROXY_HOPS = number of proxies in front of
# Flask (bundled nginx = 1; raise it if you add e.g. Cloudflare on top).
TRUST_PROXY_HEADERS=true
TRUSTED_PROXY_HOPS=1

# ----------------------------------------
# Login brute-force throttle (per client IP)
# ----------------------------------------
# On top of the per-user account lockout, block a client IP after too many
# failed logins (defends against password-spraying across many usernames).
# Defaults shown; override only if you need to tune them.
# AUTH_IP_MAX_ATTEMPTS=10
# AUTH_IP_WINDOW_MINUTES=15
# AUTH_IP_BLOCK_MINUTES=15

# ----------------------------------------
# Environment
# ----------------------------------------
# Options: development, production
FLASK_ENV=production

# ----------------------------------------
# GitHub Repository (for agent downloads)
# ----------------------------------------
# This is used to fetch agent releases for the downloads page
SERVERKIT_GITHUB_REPO=jhd3197/ServerKit

# ----------------------------------------
# Optional: Notification Webhooks
# ----------------------------------------
# These can also be configured via the web UI at Settings > Notifications

# Discord Webhook URL
# DISCORD_WEBHOOK_URL=https://discord.com/api/webhooks/...

# Slack Webhook URL
# SLACK_WEBHOOK_URL=https://hooks.slack.com/services/...

# Telegram Bot
# TELEGRAM_BOT_TOKEN=your-bot-token
# TELEGRAM_CHAT_ID=your-chat-id