# Which cert/tenancy strategy to run: "single" or "shared".
# See traefik/static/traefik.single.yml vs traefik.shared.yml.
GATEWAY_MODE=single

# The hostname (or IP, for a first local smoke test) wg-easy advertises to
# peers as the WireGuard endpoint. Must be reachable on udp/51820.
GATEWAY_PUBLIC_HOST=vpn.example.com

# bcrypt hash of the wg-easy admin UI password. Generate with:
#   docker run --rm ghcr.io/wg-easy/wg-easy:14 node -e \
#     "console.log(require('bcryptjs').hashSync(process.argv[1], 10))" 'your-password'
WG_EASY_PASSWORD_HASH=

# Credentials the control-plane uses to log into wg-easy's own admin API
# (POST /api/auth/password -> session cookie; wg-easy has no separate
# bearer-token auth). WG_EASY_ADMIN_PASSWORD is the PLAINTEXT password
# corresponding to WG_EASY_PASSWORD_HASH above — wg-easy only ever sees the
# hash, but the control-plane needs the plaintext to log in the same way a
# human would through the UI.
WG_EASY_ADMIN_USERNAME=admin
WG_EASY_ADMIN_PASSWORD=

# GATEWAY_MODE=single only: the one box token a single-tenant deployment
# accepts at /v1/boxes/register, skipping full account/registration-token
# issuance. Generate with: openssl rand -hex 32
GATEWAY_BOX_TOKEN=

# Bearer token required to create accounts via POST /v1/accounts.
# Only meaningful once account endpoints exist (Phase 2+); harmless to set
# now. Generate with: openssl rand -hex 32
GATEWAY_ADMIN_TOKEN=

# GATEWAY_MODE=shared only: base domain subdomains are issued under, and the
# DNS provider Traefik's DNS-01 challenge should use for the wildcard cert.
# See traefik/static/traefik.shared.yml.
GATEWAY_BASE_DOMAIN=boxes.example.com