# Copy to .env, fill in, then: chmod 600 .env
# Values here are rendered into authproxy.cfg, pam_radius config and the
# Technitium forwarder zones at container start — the ONLY place DC IPs live.

# ── Domain controllers ────────────────────────────────────────────────
# AHDC01 (Trochalakis, 192.168.20.0/24)
TROCH_DC1_IP=192.168.20.CHANGEME
# AHDC03 (Trochalakis, 192.168.20.0/24)
TROCH_DC2_IP=192.168.20.CHANGEME
# AH-OSWLDC (Oswald, 192.168.7.0/24)
OSWALD_DC_IP=192.168.7.CHANGEME

# ── Duo (create an "OpenVPN" / RADIUS application in the Duo Admin Panel) ──
DUO_IKEY=
DUO_SKEY=
DUO_API_HOST=api-XXXXXXXX.duosecurity.com

# ── AD service account for the Duo Auth Proxy (read-only domain user) ──
# sAMAccountName, not UPN
DUO_SVC_USER=svc-duoproxy
DUO_SVC_PASSWORD=
AD_SEARCH_DN=DC=ad,DC=atlashorizon,DC=net
# Optional: restrict VPN to a group. Leave empty to allow any enabled user.
# Used only if you uncomment security_group_dn in authproxy.cfg.template.
DUO_SECURITY_GROUP_DN=

# ── OpenVPN ↔ Duo Auth Proxy RADIUS shared secret ─────────────────────
# Generate with: openssl rand -hex 24
RADIUS_SECRET=

# ── Technitium DNS web console admin password ─────────────────────────
# Applied on FIRST start only; change later via the console itself.
TECHNITIUM_ADMIN_PASSWORD=

# ── Optional (defaults shown) ─────────────────────────────────────────
# Duo Auth Proxy version; pin (e.g. 6.5.1) for deterministic updates
#DUO_AUTHPROXY_VERSION=latest
# Service directories — only set these when the stack lives in /opt
# (the Ansible deploy writes them automatically)
#OPENVPN_DIR=/opt/openvpn
#DUO_DIR=/opt/duo-authproxy
#TECHNITIUM_DIR=/opt/technitium