# CertAuth API environment variables.
# Installed to /etc/certauth/certauth.env (mode 600, owned by the API user)
# and loaded via EnvironmentFile= in certauth-api.service.
#
# The API fails closed on startup if any of the REQUIRED variables below
# are missing.

# ---- REQUIRED -------------------------------------------------------------

# YubiKey hardware assignments (serials are printed by `ykman list`;
# setup-certauth.sh auto-detects them at provision time)
YK_ROOT_SERIAL=your-root-yubikey-serial
YK_INT_SERIAL=your-intermediate-yubikey-serial

# YubiKey PINs (change from the defaults with:
#   ykman piv access change-pin -P <old> --new-pin <new>)
YK_ROOT_PIN=your-yk-root-pin
YK_INT_PIN=your-yk-intermediate-pin

# JWT signing secret (generate with: python3 -c "import secrets; print(secrets.token_hex(32))")
JWT_SECRET=your-64-char-hex-secret

# Admin web/API login password
ADMIN_PASSWORD=your-secure-admin-password

# ---- OPTIONAL (defaults shown) ---------------------------------------------

# Admin username (default: certauth)
ADMIN_USERNAME=certauth

# Filesystem layout (defaults match setup-certauth.sh production layout)
CERTAUTH_CA_BASE=/etc/ssl/ca
CERTAUTH_ROOT_CA=/etc/ssl/ca/root/root-ca.crt
CERTAUTH_INT_CA=/etc/ssl/ca/intermediate/intermediate-ca.crt
CERTAUTH_CA_CHAIN=/etc/ssl/ca/ca-chain.crt
CERTAUTH_ISSUED_DIR=/etc/ssl/ca/issued
CERTAUTH_TMP_DIR=/var/lib/certauth/tmp
CERTAUTH_DB_PATH=/var/lib/certauth/certauth.db

# PKCS#11 (defaults work on aarch64 and x86_64 Ubuntu)
PKCS11_MODULE=/usr/lib/opensc-pkcs11.so
# pkcs11-tool --token-label; leave empty to match by key label only
PKCS11_TOKEN_LABEL=

# Leaf certificate subject (matches setup-certauth.sh defaults)
CA_ORG=Home
CA_COUNTRY=US

# PFX download default password (overridable per download)
PFX_PASS=certauth