claude generated first pass

.env.example

@@ -0,0 +1,29 @@
+# Copy to .env, fill in, then: chmod 600 .env
+# Values here are rendered into unbound.conf, authproxy.cfg and pam_radius
+# config at container start — this is the ONLY place DC IPs live.
+
+# ── Domain controllers ────────────────────────────────────────────────
+# AHDC01 (Trochalakis, 192.168.20.0/24)
+TROCH_DC1_IP=192.168.20.CHANGEME
+# AHDC03 (Trochalakis, 192.168.20.0/24)
+TROCH_DC2_IP=192.168.20.CHANGEME
+# AH-OSWLDC (Oswald, 192.168.7.0/24)
+OSWALD_DC_IP=192.168.7.CHANGEME
+
+# ── Duo (create an "OpenVPN" / RADIUS application in the Duo Admin Panel) ──
+DUO_IKEY=
+DUO_SKEY=
+DUO_API_HOST=api-XXXXXXXX.duosecurity.com
+
+# ── AD service account for the Duo Auth Proxy (read-only domain user) ──
+# sAMAccountName, not UPN
+DUO_SVC_USER=svc-duoproxy
+DUO_SVC_PASSWORD=
+AD_SEARCH_DN=DC=ad,DC=atlashorizon,DC=net
+# Optional: restrict VPN to a group. Leave empty to allow any enabled user.
+# Used only if you uncomment security_group_dn in authproxy.cfg.template.
+DUO_SECURITY_GROUP_DN=
+
+# ── OpenVPN ↔ Duo Auth Proxy RADIUS shared secret ─────────────────────
+# Generate with: openssl rand -hex 24
+RADIUS_SECRET=