# cert-portal configuration
# Copy to .env and fill in real values. Never commit .env.

# --- HTTP ---
# Bind address for uvicorn when you run `python -m cert_portal`
HOST=0.0.0.0
PORT=8000
# production | development. In production, OpenAPI/Swagger is off unless DOCS_ENABLED=true.
ENVIRONMENT=production
# Expose /docs and /redoc (also forced on when ENVIRONMENT=development).
DOCS_ENABLED=false
# Public URL the browser uses to reach this app (OIDC redirect and cookie security).
PUBLIC_BASE_URL=https://certs.example.com
# Set false only for local http:// testing. Cookies will not be marked Secure.
SESSION_HTTPS_ONLY=true
# Random 32+ byte string used to sign the session cookie.
SESSION_SECRET=change-me-to-a-long-random-string

# --- OIDC (generic: Keycloak, Okta, Authentik, Entra, ...) ---
# Issuer URL with no trailing slash. Discovery is {issuer}/.well-known/openid-configuration
OIDC_ISSUER=https://idp.example.com/realms/example
OIDC_CLIENT_ID=cert-portal
OIDC_CLIENT_SECRET=change-me
# Must match a redirect URI registered on the client. Path is /auth/callback
OIDC_REDIRECT_URI=https://certs.example.com/auth/callback
OIDC_SCOPES=openid email profile
# Claim used to search LDAP. Falls back to email, then preferred_username, then sub.
OIDC_USERNAME_CLAIM=email

# --- LDAP / Active Directory (objectSid lookup) ---
# ldaps:// is required in production. ldap:// is accepted only for a lab.
LDAP_URL=ldaps://dc.example.com:636
LDAP_BIND_DN=CN=cert-portal,OU=Services,DC=example,DC=com
LDAP_BIND_PASSWORD=change-me
LDAP_BASE_DN=DC=example,DC=com
# {username} is replaced with the OIDC username claim.
LDAP_USER_FILTER=(&(objectClass=user)(|(userPrincipalName={username})(mail={username})))
# Optional. Distinguished name or CN of a group the user must belong to.
# Nested membership uses LDAP_MATCHING_RULE_IN_CHAIN.
LDAP_REQUIRED_GROUP=
# Verify the DC TLS certificate. Set false only in a lab.
LDAP_VERIFY_TLS=true
# Optional path to a CA bundle (PEM) for LDAPS.
LDAP_CA_CERTS_FILE=

# --- AD CS Web Enrollment (certsrv) ---
# Base URL with no trailing slash. Example: https://ca.example.com/certsrv
CERTSRV_URL=https://ca.example.com/certsrv
CERTSRV_USERNAME=cert-portal
CERTSRV_PASSWORD=change-me
# NetBIOS or DNS domain used as DOMAIN\user for NTLM. Leave empty if USERNAME is already DOMAIN\user.
CERTSRV_DOMAIN=EXAMPLE
# Certificate template common name (not the display name), e.g. UserWifi
CERTSRV_TEMPLATE=UserWifi
# Verify the certsrv TLS certificate.
CERTSRV_VERIFY_TLS=true
# Optional CA bundle (PEM) for the certsrv HTTPS connection.
CERTSRV_CA_CERTS_FILE=

# --- Enrollment ---
ENROLLMENT_KEY_SIZE=2048

# --- Identity profile (embedded in the .mobileconfig) ---
PROFILE_ORGANIZATION=Example Org
PROFILE_DISPLAY_NAME=User Certificate
# Reverse-DNS prefix for PayloadIdentifier values.
PROFILE_IDENTIFIER_PREFIX=com.example.cert-portal
# Optional PEM/DER CA cert to embed so the device trusts the issued chain.
PROFILE_CA_CERT_PATH=

# --- Profile signing (different PKCS#12 from the per-user identity) ---
# Long-lived P12/PFX whose certificate is already trusted on devices.
PROFILE_SIGNING_P12_PATH=/etc/cert-portal/profile-signing.p12
PROFILE_SIGNING_P12_PASSWORD=change-me