# =============================================================
# BASE CONFIG
# =============================================================
# Timezone: https://en.wikipedia.org/wiki/List_of_tz_database_time_zones
TZ=America/Chicago
# UNIX PUID and PGID — find with: id $USER
PUID=1000
PGID=1000
# Root path prefix for volume mounts
ROOT=/

# =============================================================
# FOUNDRY VTT
# =============================================================
FOUNDRY_USERNAME=ginnoir
FOUNDRY_PASSWORD=agt-UAU!uky_ykh3juy
FOUNDRY_ADMIN_KEY=fuckyouben
FOUNDRY_PATCH_URLS=https://gist.githubusercontent.com/ginnoir/898b152a09369f9089770daa71887262/raw/a354e4284f2b1feb616910f65bfe65a4ffdb5473/plutonium-12.x.sh

# =============================================================
# OWNCLOUD
# =============================================================
OWNCLOUD_DOMAIN=files.ginnoir.com
OWNCLOUD_DB_USER=ginnoir
OWNCLOUD_DB_PASSWORD=d0fet0th3x
OWNCLOUD_ADMIN_USER=ginnoir
OWNCLOUD_ADMIN_PASSWORD=d0fet0th3x

# =============================================================
# MARIADB
# =============================================================
MYSQL_ROOT_PASSWORD=d0fet0th3x

# =============================================================
# REACTIVE RESUME
# =============================================================
POSTGRES_PASSWORD=postgres
MINIO_ROOT_USER=minioadmin
MINIO_ROOT_PASSWORD=minioadmin
CHROME_TOKEN=chrome_token
# Auth/JWT signing secret for Reactive Resume — the `app` service reads
# ${RESUME_AUTH_SECRET}. Pinned to the value the running container already uses,
# so recreating it does not invalidate sessions. Rotate with: openssl rand -hex 64
RESUME_AUTH_SECRET=1b7e96f61f080d04d4bf673d9ea1d9349eb7693cddee5772b6c3f153c88032db5b97efd8570087bc6f340d2cd874aabc1e5c681bc22889921240d6a23738bc7f

# =============================================================
# FRESHRSS
# =============================================================
FRESHRSS_API_PASSWORD=d0fet0th3x
FRESHRSS_PASSWORD=d0fet0th3x
FRESHRSS_EMAIL=3nigma.matt@gmail.com

# ── famapp ────────────────────────────────────────────────────────────────────
FAMAPP_IMAGE=ghcr.io/ginnoir/famapp:latest
FAMAPP_PULL_POLICY=always
AUTHENTIK_IMAGE_TAG=2024.12.3
RUN_MIGRATIONS=true

AUTH_URL=https://fam.ginnoir.com
FAMAPP_DB_USER=famapp
FAMAPP_DB_PASSWORD=a9a999d16dd5cdc521bb62eff331265d3c24
FAMAPP_DB_NAME=famapp

# famapp Auth.js session secret (compose maps this to the container's AUTH_SECRET)
FAMAPP_AUTH_SECRET=CJsICgBs78YxxSdJfS8KU9Zn9k+QytRoVui9kVtuHtI=

# Fill in after Authentik bootstrap
AUTH_OIDC_ISSUER=https://auth.ginnoir.com/application/o/famapp/
AUTH_OIDC_CLIENT_ID=6uOZ8yjTR9Z2m1RZU1cLHYXHV2Lv6zZtfuJcrsdq
AUTH_OIDC_CLIENT_SECRET=CPcNM8jXaJ2jHFKxRwGuuKyMKJsT502l3FztO1AOcFqDzWqlWu5x7Ox52Q6zyBa2v33YzoA9igrXW8FFjd1Gp7wrZV4PGTwvXmOd7pIMOY93gNotAgJaewT8WHW1F3YD

VAPID_PUBLIC_KEY=BNED_UgfPhyoG6_JOabhpQpN3nr6QM5tO0PDiAadMGCcZROn8LM7tnsBrKaB1E5kfuDFb1rC_M86cT3uCvBqSBk
VAPID_PRIVATE_KEY=QyJiyCI2TJa_QWVXznfj4vjpWTBsyFfSCtn1brpE9aI
VAPID_SUBJECT=mailto:3nigma.matt@gmail.com

NTFY_URL=https://ntfy.ginnoir.com
NTFY_TOPIC=famapp

AUTHENTIK_DB_USER=authentik
AUTHENTIK_DB_PASSWORD=ebb7d34ecbc4fc8f95cd16ef491d2162cdf8
AUTHENTIK_DB_NAME=authentik
AUTHENTIK_SECRET_KEY=C33S/oXOVOLrlLnWGMRYadgH9zfEC7Bm1vHtbczkFxHcTOj9j6io397c/OGb

# MinIO object storage (used for plant/container image uploads)
famapp_MINIO_ROOT_USER=famapp
famapp_MINIO_ROOT_PASSWORD=d0fet0th3x
famapp_MINIO_BUCKET=garden

famapp_OPENPLANTBOOK_CLIENT_ID=5JdQLab69RhVaF4er7b7D29BCrkf3fo3OEiDsOQa
famapp_OPENPLANTBOOK_CLIENT_SECRET=kxPTrdQPAVta7sjVuIRf5EGIJ1fKvlMlqRSJpQtFxRftJhg7oeGnXzwH7ls6tluQLFUYVDYRMwISiAuKZGZLvkuJzUwFGCwhZw7UtW8OvcTGy4717WeNUinvuCDSsNXP

# =============================================================
# MANAGEMENT (homarr)
# =============================================================
# Homarr config encryption key (moved out of docker-compose.yml so all
# secrets live in .env). Generate with: openssl rand -hex 32
HOMARR_SECRET_ENCRYPTION_KEY=98989838bf06c9e42d77944ce848963a22ab316b55a09b0d199652ef0934394f

# =============================================================
# CLOUDFLARE DNS (for Caddy DNS-01 TLS challenge)
# =============================================================
# Create a scoped API token at: https://dash.cloudflare.com/profile/api-tokens
# Required permissions: Zone > DNS > Edit  (for ginnoir.com zone only)
# This is NOT the Zone ID or Account ID — it's the API Token secret value.
CF_API_TOKEN=cfut_ijIT9HDjXWKgd0dtnyLqxv8L3deB7hSDivSqquwp905a6c51

# GitHub Actions self-hosted runner (fine-grained PAT, Administration:write on homelabstack)
GITHUB_RUNNER_ACCESS_TOKEN=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

# Portainer git-stack auth (classic PAT, repo scope on homelabstack)
# Used by StackCreateDockerStandaloneRepository and StackGitRedeploy.
# Pass as RepositoryAuthorizationType:0 (Basic), RepositoryUsername=ginnoir.
# Runner PAT above does NOT work for this — different scopes.
# Gitea PAT for Portainer git stacks (env var name kept from GitHub era)
GITHUB_STACKS_PAT=54ea93904439c2919f1d8dab1ba545e54a2a3e86

# =============================================================
# DEV STACK
# =============================================================
# Gitea
GITEA_DB_PASSWORD=gitea_d3vp4ss_9f2k

# VS Code in browser (code-server)
CODE_SERVER_PASSWORD=c0de_s3rver_pass

# BookStack wiki
BOOKSTACK_DB_PASSWORD=bookstack_d3v_pass
BOOKSTACK_DB_ROOT_PASSWORD=bookstack_r00t_pass

# Plane project management
# Rotate with: openssl rand -hex 32
PLANE_SECRET_KEY=60gp0byfz2dvffa45cxl20p1scy9xbpf6d8c5y0geejgkyp1b52
PLANE_DB_PASSWORD=plane_d3v_p4ss_8x3m
PLANE_MINIO_USER=planeadmin
PLANE_MINIO_PASSWORD=plane_minio_p4ss

# Vault unseal keys + root token (generated 2026-06-04 during init)
# Need any 3 of 5 keys to unseal after a restart.
# Re-unseal with: apply-compose.ps1 -VaultUnseal  (or manually via SSH)
VAULT_UNSEAL_KEY_1=fDQVnopNwCDXkUehLdQTpSasymm6h4yGheBKUNdz+jHM
VAULT_UNSEAL_KEY_2=ix34PMxiwdpZQlzIBuxeWVgBGU/bhyomBR1BOA3NnGvJ
VAULT_UNSEAL_KEY_3=SWXVKnhoYsT6XNiUnWKgTgle2JwsRUNZzX4J3XK++l6n
VAULT_UNSEAL_KEY_4=rjSgX+lie2ulhJpm+yiWf3mY0hd+8JI6zbPlJPN5Scm+
VAULT_UNSEAL_KEY_5=UIt78/Qi+rO+krJ4Nt0quTGHQlj+MYaXqt+kt7pAqDma
VAULT_ROOT_TOKEN=hvs.QmhZvkXnFfebbRC7JVFLcNPn

# =============================================================
# DOCKER REGISTRY
# =============================================================
REGISTRY_PUSH_USERNAME=registry_push
REGISTRY_PUSH_PASSWORD=uBerCmqKpDn8HKMhELZDbY5a5mJrwxSWTu78Tpp3b7g
REGISTRY_PULL_USERNAME=registry_pull
REGISTRY_PULL_PASSWORD=MF38ASyGFpFzr2x4xy5u6EtyFoxAgF4qLUF8wYjGrss

# =============================================================
# GITEA RUNNER
# =============================================================
GITEA_RUNNER_REGISTRATION_TOKEN=