# Dankclaw stack secrets and configuration.
# Copy to .env and fill real values. Never commit real secrets.

# SearXNG
SEARXNG_SECRET=changeme
SEARXNG_BASE_URL=http://search.franksdank.cloud/

# Gluetun VPN (see https://github.com/qdm12/gluetun-wiki)
# Single-peer WireGuard model. Fill from your provider's WireGuard config.
VPN_SERVICE_PROVIDER=protonvpn
VPN_TYPE=wireguard
WIREGUARD_PRIVATE_KEY=changeme
WIREGUARD_ADDRESSES=0.0.0.0/32
WIREGUARD_PUBLIC_KEY=changeme
WIREGUARD_ENDPOINT_IP=0.0.0.0
WIREGUARD_ENDPOINT_PORT=51820
WIREGUARD_ALLOWED_IPS=0.0.0.0/0,::/0
WIREGUARD_PERSISTENT_KEEPALIVE_INTERVAL=25s

# Gitea database
GITEA_DB_PASSWORD=changeme

# Grafana admin
GRAFANA_ADMIN_USER=admin
GRAFANA_ADMIN_PASSWORD=changeme

# Caddy (the homelab's single reverse proxy, on this host)
# bcrypt hashes (caddy hash-password). deploy.sh renders them into
# /home/dank/Containers/caddy/Caddyfile.
# CADDY_BASICAUTH_HASH: the shared family password (the other vhosts: gitea,
#   grafana, search, ...). Username: dank.
CADDY_BASICAUTH_HASH=changeme
# CADDY_ADMIN_HASH: the operator-only password (the homepage /admin/ page).
#   Username: frank.
CADDY_ADMIN_HASH=changeme
# CADDY_HOMEPAGE_HASH: the homepage user-page password. Username: dankuser.
CADDY_HOMEPAGE_HASH=changeme

# Hermes -> Signal (signal-cli daemon on the host, port 8080)
# E.164 number of the linked Signal account (your primary number, for Note-to-Self).
SIGNAL_ACCOUNT=+15551234567
# Comma-separated E.164 numbers allowed to message the agent.
SIGNAL_ALLOWED_USERS=+15551234567

# Porkbun API (franksdank.cloud + franksdank.casa zones). Caddy uses these
# for DNS-01 Let's Encrypt wildcard cert issuance. Porkbun API keys are
# account-wide; rotate them here rather than in the dashboard.
# PORKBUN_API_SECRET_KEY is the name the caddy-dns/porkbun module expects.
PORKBUN_API_KEY=changeme
PORKBUN_API_SECRET_KEY=changeme