first build

.env.example

@@ -0,0 +1,74 @@
+# cert-portal configuration
+# Copy to .env and fill in real values. Never commit .env.
+
+# --- HTTP ---
+# Bind address for uvicorn when you run `python -m cert_portal`
+HOST=0.0.0.0
+PORT=8000
+# production | development. In production, OpenAPI/Swagger is off unless DOCS_ENABLED=true.
+ENVIRONMENT=production
+# Expose /docs and /redoc (also forced on when ENVIRONMENT=development).
+DOCS_ENABLED=false
+# Public URL the browser uses to reach this app (OIDC redirect and cookie security).
+PUBLIC_BASE_URL=https://certs.example.com
+# Set false only for local http:// testing. Cookies will not be marked Secure.
+SESSION_HTTPS_ONLY=true
+# Random 32+ byte string used to sign the session cookie.
+SESSION_SECRET=change-me-to-a-long-random-string
+
+# --- OIDC (generic: Keycloak, Okta, Authentik, Entra, ...) ---
+# Issuer URL with no trailing slash. Discovery is {issuer}/.well-known/openid-configuration
+OIDC_ISSUER=https://idp.example.com/realms/example
+OIDC_CLIENT_ID=cert-portal
+OIDC_CLIENT_SECRET=change-me
+# Must match a redirect URI registered on the client. Path is /auth/callback
+OIDC_REDIRECT_URI=https://certs.example.com/auth/callback
+OIDC_SCOPES=openid email profile
+# Claim used to search LDAP. Falls back to email, then preferred_username, then sub.
+OIDC_USERNAME_CLAIM=email
+
+# --- LDAP / Active Directory (objectSid lookup) ---
+# ldaps:// is required in production. ldap:// is accepted only for a lab.
+LDAP_URL=ldaps://dc.example.com:636
+LDAP_BIND_DN=CN=cert-portal,OU=Services,DC=example,DC=com
+LDAP_BIND_PASSWORD=change-me
+LDAP_BASE_DN=DC=example,DC=com
+# {username} is replaced with the OIDC username claim.
+LDAP_USER_FILTER=(&(objectClass=user)(|(userPrincipalName={username})(mail={username})))
+# Optional. Distinguished name or CN of a group the user must belong to.
+# Nested membership uses LDAP_MATCHING_RULE_IN_CHAIN.
+LDAP_REQUIRED_GROUP=
+# Verify the DC TLS certificate. Set false only in a lab.
+LDAP_VERIFY_TLS=true
+# Optional path to a CA bundle (PEM) for LDAPS.
+LDAP_CA_CERTS_FILE=
+
+# --- AD CS Web Enrollment (certsrv) ---
+# Base URL with no trailing slash. Example: https://ca.example.com/certsrv
+CERTSRV_URL=https://ca.example.com/certsrv
+CERTSRV_USERNAME=cert-portal
+CERTSRV_PASSWORD=change-me
+# NetBIOS or DNS domain used as DOMAIN\user for NTLM. Leave empty if USERNAME is already DOMAIN\user.
+CERTSRV_DOMAIN=EXAMPLE
+# Certificate template common name (not the display name), e.g. UserWifi
+CERTSRV_TEMPLATE=UserWifi
+# Verify the certsrv TLS certificate.
+CERTSRV_VERIFY_TLS=true
+# Optional CA bundle (PEM) for the certsrv HTTPS connection.
+CERTSRV_CA_CERTS_FILE=
+
+# --- Enrollment ---
+ENROLLMENT_KEY_SIZE=2048
+
+# --- Identity profile (embedded in the .mobileconfig) ---
+PROFILE_ORGANIZATION=Example Org
+PROFILE_DISPLAY_NAME=User Certificate
+# Reverse-DNS prefix for PayloadIdentifier values.
+PROFILE_IDENTIFIER_PREFIX=com.example.cert-portal
+# Optional PEM/DER CA cert to embed so the device trusts the issued chain.
+PROFILE_CA_CERT_PATH=
+
+# --- Profile signing (different PKCS#12 from the per-user identity) ---
+# Long-lived P12/PFX whose certificate is already trusted on devices.
+PROFILE_SIGNING_P12_PATH=/etc/cert-portal/profile-signing.p12
+PROFILE_SIGNING_P12_PASSWORD=change-me