# Copy to .env and edit. See DEPLOY.md for the full bring-up.
# .env is gitignored — it holds the Influx token and DB password.

# --- WebAuthn RP (admin passkeys are ORIGIN-BOUND — must be the UI's real URL) --
# For this deployment the UI is https://diskless-server.bitasylum.org .
FLEET_MGR_RP_ID=diskless-server.bitasylum.org
FLEET_MGR_RP_ORIGIN=https://diskless-server.bitasylum.org
FLEET_MGR_RP_NAME=Fleet Command

# --- admin plane HTTPS ---------------------------------------------------------
# The UI cert is a publicly-trusted Let's Encrypt cert via DNS-01 (the UI is on
# the mgmt net, not internet-reachable, so HTTP-01/TLS-ALPN-01 can't validate;
# DNS-01 proves control of bitasylum.org via a TXT record). An external ACME
# client (lego/certbot + your DNS provider) writes fullchain/privkey into
# ./pki/admin/ ; the manager hot-reloads on renewal. See DEPLOY.md.
FLEET_MGR_ADMIN_ADDR=127.0.0.1:9500
FLEET_MGR_ADMIN_CERT=/pki/admin/fullchain.pem
FLEET_MGR_ADMIN_KEY=/pki/admin/privkey.pem
# Dev-only escape hatch: plaintext, NO passkey auth. NEVER set true in prod.
FLEET_MGR_ADMIN_INSECURE=false

# --- agent plane (gRPC + mTLS, fleet CA) ---------------------------------------
# Routable mgmt address enrolled hosts dial (":9600" = all interfaces). The
# server cert is issued by the fleet CA (server-pki.sh); the client CA is the
# fleet root so host TPM certs verify. Paths are fixed in docker-compose.yml.
FLEET_MGR_AGENT_ADDR=:9600

# --- authorise pillar (enrol-broker admin plane over mTLS) ---------------------
# The broker runs network_mode:host on 127.0.0.1:9443. The manager's client cert
# is minted by ../enrol-broker/admin-pki.sh (admin CA), into ./pki/broker/ .
FLEET_MGR_BROKER_URL=https://127.0.0.1:9443

# --- InfluxDB (private; the manager is the ONLY reader/writer) -----------------
# The token is handed to BOTH influxdb (init admin token) and the manager, so a
# single value wires the two with no copy step. Treat as a secret.
FLEET_MGR_INFLUX_TOKEN=changeme-generate-a-long-random-token
FLEET_MGR_INFLUX_ORG=fleet
FLEET_MGR_INFLUX_BUCKET=fleet_health
INFLUX_ADMIN_USER=fleet-admin
INFLUX_ADMIN_PASSWORD=changeme-influx-admin-password
INFLUX_RETENTION=90d

# --- misc ----------------------------------------------------------------------
FLEET_MGR_SESSION_TTL_MIN=720
# Must match the enrol-broker's HOSTNQN_BASE.
HOSTNQN_BASE=nqn.2026-06.org.example.fleet:host-