# Copy to .env, fill in, then: chmod 600 .env
# Values here are rendered into unbound.conf, authproxy.cfg and pam_radius
# config at container start — this is the ONLY place DC IPs live.

# ── Domain controllers ────────────────────────────────────────────────
# AHDC01 (Trochalakis, 192.168.20.0/24)
TROCH_DC1_IP=192.168.20.CHANGEME
# AHDC03 (Trochalakis, 192.168.20.0/24)
TROCH_DC2_IP=192.168.20.CHANGEME
# AH-OSWLDC (Oswald, 192.168.7.0/24)
OSWALD_DC_IP=192.168.7.CHANGEME

# ── Duo (create an "OpenVPN" / RADIUS application in the Duo Admin Panel) ──
DUO_IKEY=
DUO_SKEY=
DUO_API_HOST=api-XXXXXXXX.duosecurity.com

# ── AD service account for the Duo Auth Proxy (read-only domain user) ──
# sAMAccountName, not UPN
DUO_SVC_USER=svc-duoproxy
DUO_SVC_PASSWORD=
AD_SEARCH_DN=DC=ad,DC=atlashorizon,DC=net
# Optional: restrict VPN to a group. Leave empty to allow any enabled user.
# Used only if you uncomment security_group_dn in authproxy.cfg.template.
DUO_SECURITY_GROUP_DN=

# ── OpenVPN ↔ Duo Auth Proxy RADIUS shared secret ─────────────────────
# Generate with: openssl rand -hex 24
RADIUS_SECRET=