# Dankclaw stack secrets and configuration.
# Copy to .env and fill real values. Never commit real secrets.

# SearXNG
SEARXNG_SECRET=changeme
SEARXNG_BASE_URL=http://search.franksdank.cloud/
# Kagi search API key (https://help.kagi.com/kagi/api/). Powers the paid
# `kagi` engine in shared/searxng/settings.yml; deploy-remote.sh bakes it into
# the live settings.yml via scripts/searxng-render-settings.py. The quadlet
# does NOT pass it into the container environment.
KAGI_API_KEY=changeme

# Gluetun VPN (see https://github.com/qdm12/gluetun-wiki)
# Single-peer WireGuard model. Fill from your provider's WireGuard config.
VPN_SERVICE_PROVIDER=protonvpn
VPN_TYPE=wireguard
WIREGUARD_PRIVATE_KEY=changeme
WIREGUARD_ADDRESSES=0.0.0.0/32
WIREGUARD_PUBLIC_KEY=changeme
WIREGUARD_ENDPOINT_IP=0.0.0.0
WIREGUARD_ENDPOINT_PORT=51820
WIREGUARD_ALLOWED_IPS=0.0.0.0/0,::/0
WIREGUARD_PERSISTENT_KEEPALIVE_INTERVAL=25s

# Gitea database
GITEA_DB_PASSWORD=changeme

# Grafana OAuth2 client secret (authentik OAuth2Provider "grafana", pk 9).
# Created via ak shell on authentik-server; the live .env must hold the
# provider's generated client_secret verbatim. Rotation = rotate the provider
# secret in authentik, restart grafana after updating the live .env value.
GRAFANA_OAUTH_CLIENT_SECRET=changeme

# Caddy (the homelab's single reverse proxy, on this host)
# bcrypt hash (caddy hash-password). deploy.sh renders it into
# /home/dank/Containers/caddy/Caddyfile, which the container mounts.
# CADDY_BASICAUTH_HASH: the shared family password, now used only by the
#   pihole vhost (grafana moved behind the Authentik guard chain 2026-09-01).
#   Username: dankuser.
CADDY_BASICAUTH_HASH=changeme
# (The homepage's per-user hashes were retired: the homepage and its /admin/
#  page are now behind Authentik forward_auth, not basicauth.)

# Hermes -> Signal (signal-cli daemon on the host, port 8080)
# E.164 number of the linked Signal account (your primary number, for Note-to-Self).
SIGNAL_ACCOUNT=+15551234567
# Comma-separated E.164 numbers allowed to message the agent.
SIGNAL_ALLOWED_USERS=+15551234567

# Hermes web UI (Hermex server) login password. Required: the webui binds to
# loopback and is reached only through the SSH tunnel, but Hermex still signs
# in with this password. Set a strong value in the live .env.
HERMES_WEBUI_PASSWORD=changeme

# Porkbun API (franksdank.cloud + franksdank.casa zones). Caddy uses these
# for DNS-01 Let's Encrypt wildcard cert issuance. Porkbun API keys are
# account-wide; rotate them here rather than in the dashboard.
# PORKBUN_API_SECRET_KEY is the name the caddy-dns/porkbun module expects.
PORKBUN_API_KEY=changeme
PORKBUN_API_SECRET_KEY=changeme

# Authentik (SSO / OIDC provider)
# AUTHENTIK_PG_PASS: the PostgreSQL password for authentik-postgres.
#   Generate: openssl rand -base64 32
AUTHENTIK_PG_PASS=changeme
# AUTHENTIK_SECRET_KEY: the server's secret key (64+ chars).
#   Generate: openssl rand -base64 48
AUTHENTIK_SECRET_KEY=changeme

# Marreta (content-cleaning proxy, behind the Authentik guard chain).
# deploy-remote.sh seeds /home/dank/Containers/marreta/env from these three
# values (only if that file does not already exist) and the marreta quadlet
# maps them to the app's APP_KEY / ADMIN_EMAIL / ADMIN_PASSWORD.
# MARRETA_APP_KEY: Laravel encryption key. Generate:
#   openssl rand -base64 32
# Changing it after first boot invalidates encrypted session/cookie data.
MARRETA_APP_KEY=changeme
# Admin panel login (marreta.franksdank.cloud/admin). The app creates this
# account on first boot from these values.
MARRETA_ADMIN_EMAIL=admin@franksdank.cloud
MARRETA_ADMIN_PASSWORD=changeme

# open-notebook (podcast generator; internal-only, no vhost).
# deploy-remote.sh seeds /home/dank/Containers/open-notebook/env from these
# values (only if that file does not already exist) and refuses to start the
# units while any of them is blank: a blank OPEN_NOTEBOOK_PASSWORD means
# authentication OFF, and a blank encryption key means no provider credential
# can be saved. The seed writes SURREAL_PASS too — the spelling the `surreal`
# CLI reads — from SURREAL_PASSWORD, so the app and the database cannot be
# given different values.
# OPEN_NOTEBOOK_ENCRYPTION_KEY: encrypts the stored AI provider keys at rest.
#   Generate: openssl rand -hex 32
# Changing it after credentials are saved makes them undecryptable.
OPEN_NOTEBOOK_ENCRYPTION_KEY=changeme
# UI/API password. Every API route — including the episode-audio download the
# app serves without a session — is open to the LAN while this is unset.
OPEN_NOTEBOOK_PASSWORD=changeme
# SurrealDB root password (the root user NAME comes from
# scripts/open-notebook.env, so this file holds only the secret).
#   Generate: openssl rand -base64 32
SURREAL_PASSWORD=changeme