# Control Service configuration — template.
#
# Copy to control-service.env and fill in real values. The real file is
# gitignored and must never be committed. docker compose loads it with env_file.
#
# Secrets in this lab also live in ~/.config/environment.d/10-secrets.conf; the
# same variable names can be exported there instead. The service reads only the
# process environment, so either source works.

# Listen address inside the container.
CONTROL_ADDR=:8791

# SQLite database on the persistent volume.
CONTROL_DB_PATH=/data/control.db

CONTROL_APP_ENV=production
CONTROL_LOG_LEVEL=info

# Signs the session cookie. Set to a long random string (>= 16 chars).
# Generate: openssl rand -hex 32
CONTROL_SESSION_SECRET=change-me-to-a-long-random-string

# Session lifetime (Go duration).
CONTROL_SESSION_TTL=12h

# Secure cookie flag. Keep true behind Caddy/HTTPS. Set false only for
# plain-HTTP local testing.
CONTROL_COOKIE_SECURE=true

# The single dashboard login (Sam).
CONTROL_ADMIN_USERNAME=sam

# Option A (simple): plaintext password. Constant-time compared at login.
CONTROL_ADMIN_PASSWORD=change-me

# Option B (preferred): a bcrypt hash; leave CONTROL_ADMIN_PASSWORD empty.
# Generate: docker run --rm --entrypoint /app/control webrestrict/control:0.1.0-phase1 hash-password 'your-password'
# CONTROL_ADMIN_PASSWORD_HASH=$2a$10$...