# --- main options ---

# URI containing secret and config for TOTP, which determines the token to login
# app will generate one, if not provided, but you should copy it to your .env file
# format: "otpauth://totp/<label>?secret=<secret-key>"
#TOTP_URI=''                # blank to have the app generate one at random

# how long will someone stay logged in, measured in seconds, zero for DEFAULT
#COOKIE_TTL=2592000         # default 30 days

# we can use a central auth, so that users only need to login once to have access to
# multiple services. Requires using sub-domains under the same domain.
# IE: if enabled have "service-one.example.com" redirect "auth.example.com", and after
# successful auth, user can visit "service-two.example.com" without having to login again.
#SUBDOMAIN_REDIRECT=false   # default disabled, boolean
#AUTH_SUBDOMAIN=''          # blank, hostname we send user to, to see login page

# --- extra options ---

# how long do we allow *ALL* traffic from an ip address after successful login
# could be useful if you have a system which does not handle cookies
#IP_TTL=0                   # default disabled, time in seconds

# once blocked, do we respond with "I'm a teapot", false to use "Too many requests"
#TEAPOT=true                # default enabled, boolean

# --- remote-user header ---
# Controls the value sent in the Remote-User header on successful auth.
# session: the session id (default, backward-compatible)
# static:  a fixed string (set via REMOTE_USER_STATIC)
# mapped:  look up session id in REMOTE_USER_MAP (format: id1:user1,id2:user2)
# none:    do not send the Remote-User header at all
#REMOTE_USER=session
#REMOTE_USER_STATIC=authenticated
#REMOTE_USER_MAP=''

# --- rate limiting ---

# Note: rate limiting can *NOT* be disabled, but you could allow hundreds of logins a second
# rate limiting, default is the lower of 2 per 30 seconds or 10 per hour
#BURST_COUNT=2              # 2 per 30 seconds
#BURST_TIME=30              # seconds
#UPPER_COUNT=10             # 10 per hour
#UPPER_TIME=3600            # seconds (1 hour)

# --- public access (rate-limited, no auth required) ---
# Comma-separated path patterns for public access. Wildcards:
#   *  matches any chars within one path segment (not crossing /)
#   ** matches any chars including / (crosses path segments)
# Optional host prefix: host.example.com/path/**
# When empty (default), the feature is fully disabled.
#PUBLIC_PATHS=''
#PUBLIC_BURST_COUNT=100       # max requests per burst window per IP
#PUBLIC_BURST_TIME=60         # burst window in seconds
#PUBLIC_UPPER_COUNT=500       # max requests per sustained window per IP
#PUBLIC_UPPER_TIME=3600       # sustained window in seconds (1 hour)

# --- styling options ---

#TITLE='Pre-Authentication System'
#BG_COLOR='#029386'         # teal
#FG_COLOR='#ffffff'         # white
#ERROR_COLOR='#ffb16d'      # apricot (light orange)
#ID_NAME='Session ID'
#TOKEN_NAME='Authentication Token'
#SUBMIT_NAME='Submit'
#ERROR_MESSAGE='Unsuccessful login attempt'
# title and message to use on block page, if teapot is true
#TEAPOT_TITLE="I'm a teapot"
#TEAPOT_MESSAGE='I refuse to brew coffee'
# title and message to use on block page, if teapot is false
#TOO_MANY_TITLE='Too many requests'
#TOO_MANY_MESSAGE='Try again later'

# --- debug options ---
#SHELL_VERBOSITY=0          # set to "3" to log debug