# required, if missing will generate random values
# encryption key used to store sessions (static random bytes) in base64
PREAUTH_KEY=''
# TOTP (RFC 6238) secret/token (static random bytes) in base32
PREAUTH_TOKEN=''

# optional, change time-to-live, subdomain, default-redirect, text or colors
# how long a session lasts (in minutes): 43200 is 30 days
PREAUTH_TTL=43200
PREAUTH_SUBDOMAIN='preauth'
PREAUTH_SEND_TO='https://secure.example.com/'
PREAUTH_BACKGROUND='#029386'
PREAUTH_FOREGROUND='#ffffff'
PREAUTH_TITLE='Pre-Authentication System'
PREAUTH_ID_NAME='Session ID'
PREAUTH_TOKEN_NAME='Authentication Token'
PREAUTH_SUBMIT_NAME='Submit'
# how many consecutive failed login attempts before we block them (a remote-ip)
PREAUTH_RATE_LIMIT=4
# maximum time between failed login attempts to still be consecutive (in minutes): 360 is 6 hours
PREAUTH_RATE_TIMEOUT=360
# how long after last failed login will they be blocked (in minutes): 1440 is 24 hours
PREAUTH_RATE_BLOCKED=1440
# what do we show when they get rate-limited
PREAUTH_DENIED_CODE=418
PREAUTH_DENIED_TITLE="I'm a teapot"
PREAUTH_DENIED_MESSAGE='I refuse to brew coffee.'
# alternatively, you could use a more standard response
#PREAUTH_DENIED_CODE=429
#PREAUTH_DENIED_TITLE='Too Many Requests'
#PREAUTH_DENIED_MESSAGE='Try again later.'

# who owns the session files
# permissions of the volume must match
USER_ID=1000
GROUP_ID=1000