# Filling this file in by hand? Run `ops/deploy.sh` instead — it prompts
# for the values below, generates the tokens, and renders
# traefik/dynamic/control-plane.yml from its tracked template. Read the
# README's Prerequisites checklist first either way.

# Tenancy switch only — "single" (one operator, the common case) or
# "shared" (multi-tenant, out of scope for most deployments). Has no
# effect on ports, certs, or infrastructure — that's all your own
# Traefik/wg-easy now, configured below.
GATEWAY_MODE=single

# YOUR wg-easy's admin API — reachable at whatever host:port makes sense
# for your setup. If it's a sibling container that joined the same docker
# network as this control-plane (see GATEWAY_TRAEFIK_NETWORK below), this
# is usually http://<its-container-name>:51821.
WG_EASY_URL=http://wg-easy:51821

# "14" or "15" — these are genuinely different, incompatible wg-easy APIs
# (see control_plane/wgeasy.py vs wgeasy_v15.py's module docstrings, each
# independently verified against a real running container). Check your
# wg-easy image's actual tag.
WG_EASY_API_VERSION=14

# v15 only: the admin user's username. v14 has no username concept — see
# WG_EASY_ADMIN_PASSWORD below, used alone in that case.
WG_EASY_ADMIN_USERNAME=

# PLAINTEXT password for wg-easy's admin API — never a hash, on either
# version. v14 sends this as a bare `Authorization` header (no username,
# no session — confirmed by reading the actual pinned image's source,
# which differs from what wg-easy's current docs describe). v15 sends it
# as HTTP Basic auth alongside WG_EASY_ADMIN_USERNAME.
WG_EASY_ADMIN_PASSWORD=

# v15 only: restricts new WireGuard clients to this subnet instead of
# v15's full-tunnel default (0.0.0.0/0, ::/0) — see wgeasy_v15.py's
# restrict_default_allowed_ips(), applied on every control-plane startup.
# Should match your wg-easy's actual WireGuard peer subnet.
GATEWAY_WG_ALLOWED_IPS=10.8.0.0/24

# Host directory YOUR Traefik's file provider already watches (or a new
# one you add as an *additional* providers.file directory in its static
# config — additive, doesn't touch your existing dynamic config). This
# gets bind-mounted into the control-plane container.
GATEWAY_DYNAMIC_DIR_HOST=./dynamic

# Your Traefik's certResolver name — mirrored into every route
# furtka-gateway publishes. Blank means no explicit resolver (`tls: {}`),
# trusting your Traefik to apply its own default cert automatically (e.g.
# a wildcard defaultGeneratedCert). Set this if your Traefik doesn't have
# a default and needs an explicit resolver named per-route.
GATEWAY_CERT_RESOLVER=

# Hostname a Furtka box actually reaches the control-plane API on — needs
# its own A/AAAA record pointing at wherever your Traefik is reachable.
# Not read by docker-compose itself; it's what ops/deploy.sh substitutes
# into traefik/dynamic/control-plane.yml.
GATEWAY_CONTROL_PLANE_HOST=gw.example.com

# Where the control-plane's own API is bound (docker-compose.yaml's port
# publish) and where your Traefik reaches it, respectively. For the
# recommended same-docker-network setup, ops/deploy.sh keeps the bind
# loopback-only and sets the target to the fixed container name
# furtka-gateway-control-plane:8090.
# Different values only for a separate-host setup, where
# GATEWAY_CONTROL_PLANE_BIND must be widened beyond 127.0.0.1 — put real
# access control around that bind address, this file carries a WireGuard
# private key in its registration responses.
GATEWAY_CONTROL_PLANE_BIND=127.0.0.1:8090
GATEWAY_CONTROL_PLANE_TARGET=furtka-gateway-control-plane:8090

# Same-docker-network setup only (the recommended path — see the README's
# Prerequisites checklist): your Traefik's docker network name
# (`docker network ls` / `docker inspect <your-traefik-container>`).
# ops/deploy.sh writes a docker-compose.override.yaml that joins this
# network. Leave blank for a separate-host setup.
GATEWAY_TRAEFIK_NETWORK=

# The one box token a single-tenant deployment accepts at
# /v1/boxes/register, skipping full account/registration-token issuance.
# Generate with: openssl rand -hex 32
GATEWAY_BOX_TOKEN=

# Bearer token required to create accounts via POST /v1/accounts.
# Only meaningful once account endpoints exist (Phase 2+); harmless to set
# now. Generate with: openssl rand -hex 32
GATEWAY_ADMIN_TOKEN=

# Optional: override the control-plane image `docker stack deploy` pulls
# (Swarm ignores docker-compose.yaml's `build:` key — see README's Swarm
# caveats). Defaults to the `latest` tag CI publishes on every push to
# master; pin to a specific commit-sha tag for a reproducible deploy.
# Not read by plain `docker compose up`, which always builds locally.
GATEWAY_CONTROL_PLANE_IMAGE=