75 lines
3.1 KiB
Bash
75 lines
3.1 KiB
Bash
# cert-portal configuration
|
|
# Copy to .env and fill in real values. Never commit .env.
|
|
|
|
# --- HTTP ---
|
|
# Bind address for uvicorn when you run `python -m cert_portal`
|
|
HOST=0.0.0.0
|
|
PORT=8000
|
|
# production | development. In production, OpenAPI/Swagger is off unless DOCS_ENABLED=true.
|
|
ENVIRONMENT=production
|
|
# Expose /docs and /redoc (also forced on when ENVIRONMENT=development).
|
|
DOCS_ENABLED=false
|
|
# Public URL the browser uses to reach this app (OIDC redirect and cookie security).
|
|
PUBLIC_BASE_URL=https://certs.example.com
|
|
# Set false only for local http:// testing. Cookies will not be marked Secure.
|
|
SESSION_HTTPS_ONLY=true
|
|
# Random 32+ byte string used to sign the session cookie.
|
|
SESSION_SECRET=change-me-to-a-long-random-string
|
|
|
|
# --- OIDC (generic: Keycloak, Okta, Authentik, Entra, ...) ---
|
|
# Issuer URL with no trailing slash. Discovery is {issuer}/.well-known/openid-configuration
|
|
OIDC_ISSUER=https://idp.example.com/realms/example
|
|
OIDC_CLIENT_ID=cert-portal
|
|
OIDC_CLIENT_SECRET=change-me
|
|
# Must match a redirect URI registered on the client. Path is /auth/callback
|
|
OIDC_REDIRECT_URI=https://certs.example.com/auth/callback
|
|
OIDC_SCOPES=openid email profile
|
|
# Claim used to search LDAP. Falls back to email, then preferred_username, then sub.
|
|
OIDC_USERNAME_CLAIM=email
|
|
|
|
# --- LDAP / Active Directory (objectSid lookup) ---
|
|
# ldaps:// is required in production. ldap:// is accepted only for a lab.
|
|
LDAP_URL=ldaps://dc.example.com:636
|
|
LDAP_BIND_DN=CN=cert-portal,OU=Services,DC=example,DC=com
|
|
LDAP_BIND_PASSWORD=change-me
|
|
LDAP_BASE_DN=DC=example,DC=com
|
|
# {username} is replaced with the OIDC username claim.
|
|
LDAP_USER_FILTER=(&(objectClass=user)(|(userPrincipalName={username})(mail={username})))
|
|
# Optional. Distinguished name or CN of a group the user must belong to.
|
|
# Nested membership uses LDAP_MATCHING_RULE_IN_CHAIN.
|
|
LDAP_REQUIRED_GROUP=
|
|
# Verify the DC TLS certificate. Set false only in a lab.
|
|
LDAP_VERIFY_TLS=true
|
|
# Optional path to a CA bundle (PEM) for LDAPS.
|
|
LDAP_CA_CERTS_FILE=
|
|
|
|
# --- AD CS Web Enrollment (certsrv) ---
|
|
# Base URL with no trailing slash. Example: https://ca.example.com/certsrv
|
|
CERTSRV_URL=https://ca.example.com/certsrv
|
|
CERTSRV_USERNAME=cert-portal
|
|
CERTSRV_PASSWORD=change-me
|
|
# NetBIOS or DNS domain used as DOMAIN\user for NTLM. Leave empty if USERNAME is already DOMAIN\user.
|
|
CERTSRV_DOMAIN=EXAMPLE
|
|
# Certificate template common name (not the display name), e.g. UserWifi
|
|
CERTSRV_TEMPLATE=UserWifi
|
|
# Verify the certsrv TLS certificate.
|
|
CERTSRV_VERIFY_TLS=true
|
|
# Optional CA bundle (PEM) for the certsrv HTTPS connection.
|
|
CERTSRV_CA_CERTS_FILE=
|
|
|
|
# --- Enrollment ---
|
|
ENROLLMENT_KEY_SIZE=2048
|
|
|
|
# --- Identity profile (embedded in the .mobileconfig) ---
|
|
PROFILE_ORGANIZATION=Example Org
|
|
PROFILE_DISPLAY_NAME=User Certificate
|
|
# Reverse-DNS prefix for PayloadIdentifier values.
|
|
PROFILE_IDENTIFIER_PREFIX=com.example.cert-portal
|
|
# Optional PEM/DER CA cert to embed so the device trusts the issued chain.
|
|
PROFILE_CA_CERT_PATH=
|
|
|
|
# --- Profile signing (different PKCS#12 from the per-user identity) ---
|
|
# Long-lived P12/PFX whose certificate is already trusted on devices.
|
|
PROFILE_SIGNING_P12_PATH=/etc/cert-portal/profile-signing.p12
|
|
PROFILE_SIGNING_P12_PASSWORD=change-me
|