.env.example

# Vulcan Development Environment Configuration
# Copy this file to .env and update with your values
#
# For production Docker deployments, see .env.production.example

# =============================================================================
# DATABASE
# =============================================================================
# Defaults (port 5432, host 127.0.0.1) work for single-project development.
# Running multiple projects simultaneously? Assign unique ports per project.
# See docs/site/development/port-registry.md for recommended port assignments.
#
# DATABASE_PORT=5432
# DATABASE_HOST=127.0.0.1
# DATABASE_NAME=vulcan_development   # dev + production only; test is hardcoded (vulcan_test)
# POSTGRES_PORT=5432
#
# macOS with Kerberos/GSSAPI connection errors (corporate networks):
# DATABASE_GSSENCMODE=disable
#
# App server port (Puma):
# PORT=3000

# Docker database password (used by docker-compose)
POSTGRES_PASSWORD=postgres

# =============================================================================
# RAILS SECRETS (Required for Production)
# =============================================================================
# Generate these with the setup script: ./setup-docker-secrets.sh
# Or manually with: openssl rand -hex 64
SECRET_KEY_BASE=development_secret_key_base_not_for_production_use
CIPHER_PASSWORD=development_cipher_password_not_for_production_use
CIPHER_SALT=development_cipher_salt_not_for_production_use

# =============================================================================
# SSL/TLS CONFIGURATION
# =============================================================================
# Force HTTPS redirects. Defaults to true (secure by default).
# Set to false ONLY for Docker quickstart without SSL termination or local testing.
# When behind a reverse proxy (nginx, traefik), the proxy handles SSL termination
# and sets X-Forwarded-Proto header, so keep this true.
# RAILS_FORCE_SSL=true
# For local Docker testing without SSL:
# RAILS_FORCE_SSL=false

# =============================================================================
# TEST OKTA CONFIGURATION (Development/Testing)
# =============================================================================
# OIDC authentication (Okta, Auth0, Keycloak, Azure AD)
# See docs/site/deployment/auth/ for provider-specific setup guides
VULCAN_ENABLE_OIDC=false
VULCAN_OIDC_PROVIDER_TITLE=Okta
VULCAN_OIDC_ISSUER_URL=https://your-domain.okta.com
VULCAN_OIDC_CLIENT_ID=your_oidc_client_id
VULCAN_OIDC_CLIENT_SECRET=your_oidc_client_secret
VULCAN_OIDC_REDIRECT_URI=http://localhost:3000/users/auth/oidc/callback

# With auto-discovery enabled (default), these endpoints are discovered automatically
# from the issuer's /.well-known/openid-configuration endpoint
# VULCAN_OIDC_DISCOVERY=true

# =============================================================================
# MULTI-PROVIDER OIDC (Optional — N simultaneous providers)
# =============================================================================
# Set VULCAN_OIDC_PROVIDERS to enable multiple OIDC providers simultaneously.
# Each key becomes a tab on the login page and a callback route.
# When unset, the legacy single-provider vars above are used (backward compat).
#
# VULCAN_OIDC_PROVIDERS=okta,login_gov
#
# Per-provider vars follow the pattern VULCAN_OIDC_<KEY>_<FIELD>:
#
# --- Okta ---
# VULCAN_OIDC_OKTA_ISSUER_URL=https://your-domain.okta.com/oauth2/default
# VULCAN_OIDC_OKTA_CLIENT_ID=your_okta_client_id
# VULCAN_OIDC_OKTA_CLIENT_SECRET=your_okta_client_secret
# VULCAN_OIDC_OKTA_REDIRECT_URI=http://localhost:3000/users/auth/okta/callback
# VULCAN_OIDC_OKTA_TITLE=Okta
#
# --- Login.gov (uses private_key_jwt, no client secret) ---
# VULCAN_OIDC_LOGIN_GOV_ISSUER_URL=https://idp.int.identitysandbox.gov
# VULCAN_OIDC_LOGIN_GOV_CLIENT_ID=urn:gov:gsa:openidconnect.profiles:sp:sso:your-org:vulcan
# VULCAN_OIDC_LOGIN_GOV_CLIENT_AUTH_METHOD=jwt_bearer
# VULCAN_OIDC_LOGIN_GOV_PRIVATE_KEY_PATH=/path/to/login_gov_private.pem
# VULCAN_OIDC_LOGIN_GOV_ACR_VALUES=urn:acr.login.gov:auth-only
# VULCAN_OIDC_LOGIN_GOV_TITLE=Login.gov
#
# Provider keys must be lowercase snake_case (a-z, 0-9, underscores).
# Each provider can have its own logo at app/assets/images/<key>-logo.{svg,png}.
# See docs/site/deployment/auth/ for provider-specific setup guides.

# =============================================================================
# AUTHENTICATION OPTIONS
# =============================================================================
# Enable local username/password login (useful for development)
VULCAN_ENABLE_LOCAL_LOGIN=true
VULCAN_ENABLE_USER_REGISTRATION=true
# Session timeout: plain seconds (900), or with suffix: 30s, 15m, 1h
# Plain numbers: 1-9=hours, 10-299=minutes, 300+=seconds
# Default: 3600 (1 hour). DoD standard: 900 (15 min)
VULCAN_SESSION_TIMEOUT=1h
# Remember Me: keep user logged in across browser restarts
# When enabled + checked, session persists for remember_me_duration instead of session_timeout
VULCAN_ENABLE_REMEMBER_ME=true
# VULCAN_REMEMBER_ME_DURATION=8h

# Admin Bootstrap (choose one method):
# Method 1: First user becomes admin (default, great for dev)
VULCAN_FIRST_USER_ADMIN=true
# Method 2: Create specific admin from env vars (runs on db:prepare)
# VULCAN_ADMIN_EMAIL=admin@example.com
# VULCAN_ADMIN_PASSWORD=SecurePassword123!

# LDAP (disabled by default)
VULCAN_ENABLE_LDAP=false
# VULCAN_LDAP_HOST=ldap.example.com
# VULCAN_LDAP_PORT=389
# VULCAN_LDAP_BASE=dc=example,dc=com
# VULCAN_LDAP_BIND_DN=cn=admin,dc=example,dc=com
# VULCAN_LDAP_ADMIN_PASS=ldap_password

# =============================================================================
# APPLICATION SETTINGS
# =============================================================================
VULCAN_APP_URL=http://localhost:3000
VULCAN_CONTACT_EMAIL=admin@example.com
VULCAN_WELCOME_TEXT=Welcome to Vulcan Development

# Project permissions
VULCAN_PROJECT_CREATE_PERMISSION_ENABLED=true

# =============================================================================
# EMAIL/SMTP (Optional)
# =============================================================================
VULCAN_ENABLE_SMTP=false
# VULCAN_SMTP_ADDRESS=smtp.gmail.com
# VULCAN_SMTP_PORT=587
# VULCAN_SMTP_DOMAIN=example.com
# VULCAN_SMTP_SERVER_USERNAME=notifications@example.com  # Defaults to VULCAN_CONTACT_EMAIL if not set
# VULCAN_SMTP_SERVER_PASSWORD=smtp_password

# =============================================================================
# ACCOUNT LOCKOUT (STIG AC-07 — enabled by default)
# =============================================================================
# Lock accounts after consecutive failed login attempts.
# Accounts auto-unlock after unlock_in_minutes OR via admin unlock on Users page.
# Set VULCAN_LOCKOUT_ENABLED=false to disable entirely.
# unlock_strategy: email (sends unlock email), time (auto-unlock), both (default)
# VULCAN_LOCKOUT_ENABLED=true
# VULCAN_LOCKOUT_MAX_ATTEMPTS=3
# VULCAN_LOCKOUT_UNLOCK_IN_MINUTES=15
# VULCAN_LOCKOUT_UNLOCK_STRATEGY=both
# VULCAN_LOCKOUT_LAST_ATTEMPT_WARNING=true

# =============================================================================
# CLASSIFICATION BANNER & CONSENT (Optional)
# =============================================================================
# Display a colored classification banner at top and bottom of every page
# DoD standard colors: UNCLASSIFIED=#007a33, CUI=#502b85, CONFIDENTIAL=#0033a0,
# SECRET=#c8102e, TOP SECRET=#ff671f, TS/SCI=#f7ea48 (text: #000000)
VULCAN_BANNER_ENABLED=false
# VULCAN_BANNER_TEXT=UNCLASSIFIED
# VULCAN_BANNER_BACKGROUND_COLOR=#007a33
# VULCAN_BANNER_TEXT_COLOR=#ffffff

# Consent/terms-of-use modal — blocks access until user clicks "I Agree"
# Acknowledgment is tracked server-side in the Rails session (AC-8 compliant).
# Increment VULCAN_CONSENT_VERSION to re-prompt all users.
# Content supports Markdown formatting (bold, lists, links, etc.)
VULCAN_CONSENT_ENABLED=false
# VULCAN_CONSENT_VERSION=1
# VULCAN_CONSENT_TITLE=Terms of Use
# VULCAN_CONSENT_CONTENT=By using this system you agree to the **acceptable use policy**.
# How long consent remains valid: 0 = per-session (DoD default), or e.g. 24h, 12h, 30m
VULCAN_CONSENT_TTL=0

# =============================================================================
# PASSWORD POLICY (Optional — DoD-aligned defaults)
# =============================================================================
# All settings default to DoD "2222" values when unset (15 chars, 2 of each type).
# Set any count to 0 to disable that requirement.
# VULCAN_PASSWORD_MIN_LENGTH=15
# VULCAN_PASSWORD_MIN_UPPERCASE=2
# VULCAN_PASSWORD_MIN_LOWERCASE=2
# VULCAN_PASSWORD_MIN_NUMBER=2
# VULCAN_PASSWORD_MIN_SPECIAL=2

# =============================================================================
# API TOKENS — Personal Access Tokens for programmatic API access
# =============================================================================
# Enable/disable the PAT feature entirely. When false, token management
# endpoints return 404 and Authorization: Token headers are ignored.
VULCAN_API_TOKENS_ENABLED=true
# Maximum number of active (non-revoked) tokens per user
# VULCAN_API_TOKENS_MAX_PER_USER=20
# Maximum token lifetime in days (enforced on creation)
# VULCAN_API_TOKENS_MAX_LIFETIME_DAYS=365
# Auto-revoke tokens unused for this many days (rake api_tokens:revoke_idle)
# VULCAN_API_TOKENS_AUTO_REVOKE_IDLE_DAYS=90

# =============================================================================
# SLACK INTEGRATION (Optional)
# =============================================================================
VULCAN_ENABLE_SLACK_COMMS=false
# VULCAN_SLACK_API_TOKEN=xoxb-your-token
# VULCAN_SLACK_CHANNEL_ID=C1234567890

# =============================================================================
# DEVELOPMENT NOTES
# =============================================================================
# Default admin login (after seeding): admin@example.com with default password
# Override seed password: VULCAN_SEED_ADMIN_PASSWORD=YourPassword123!
# To seed the database: bundle exec rake db:seed
# To reset and reseed: bundle exec rake db:reset