# ---------------------------------------------------------------- basics
# Only used to name the very first site and to label authenticator app entries.
# Add further sites, and rename this one, from Admin -> Sites.
SITE_NAME=Hideaway Visitor Sign In
TZ=Australia/Melbourne
PORT=3000
# Port published on the docker host.
HOST_PORT=8088

# Long random string. Generate one with:  openssl rand -hex 32
# Changing this invalidates admin sessions AND makes stored visitor PINs unreadable.
APP_SECRET=change-me-to-a-long-random-string

# ------------------------------------------------------- admin accounts
# Used ONCE, to create the first admin account if none exist. After the first
# sign in you will be asked to set a new password, and further admins are
# invited from the console.
ADMIN_BOOTSTRAP_EMAIL=you@example.com
ADMIN_BOOTSTRAP_PASSWORD=change-me-then-change-again

# Restrict admin sign in to one or more email domains. Blank allows any address.
# ADMIN_ALLOWED_DOMAINS=hideawaygaming.com.au,school.vic.edu.au
ADMIN_ALLOWED_DOMAINS=

# Every admin must enrol an authenticator app at first sign in.
ADMIN_REQUIRE_2FA=true

# --------------------------------------------------------------- kiosk
# Require a photo before a visitor can complete sign in.
REQUIRE_PHOTO=true
# Photos older than this are deleted from disk automatically. 0 disables the sweep.
PHOTO_RETENTION_DAYS=90
# Sign out anyone still on site at this local time. Blank turns it off.
AUTO_SIGNOUT_TIME=18:30

# Warn admins this many days before a recurring visitor's WWCC or VIT expires.
EXPIRY_WARNING_DAYS=28

# ---------------------------------------------------------------- https
# The browser will not allow camera access over plain http unless the address is
# localhost. Either terminate TLS at a reverse proxy, or turn this on and run
# scripts/gen-cert.sh to create a self-signed certificate.
HTTPS_ENABLED=false
HTTPS_KEY=/data/certs/server.key
HTTPS_CERT=/data/certs/server.crt

# Set both of these to true when running behind an HTTPS reverse proxy.
TRUST_PROXY=false
SECURE_COOKIES=false

# --------------------------------------------------------- google sheets
SHEETS_ENABLED=false
# The long id from the sheet URL: docs.google.com/spreadsheets/d/<THIS PART>/edit
SHEETS_SPREADSHEET_ID=
SHEETS_TAB_NAME=Visitor log
# Point at the mounted service account json...
GOOGLE_CREDENTIALS_PATH=/secrets/google-service-account.json
# ...or paste it base64 encoded instead (base64 -w0 key.json). One or the other.
GOOGLE_CREDENTIALS_B64=
SHEETS_RETRY_INTERVAL_MS=60000

# -------------------------------------------------------------- storage
DATA_DIR=/data