env.example

# SPDX-FileCopyrightText: Copyright 2026, Slinky Software
# SPDX-License-Identifier: GPL-3.0-only

DJANGO_SECRET_KEY=change-me
DJANGO_ALLOWED_HOSTS=telephonytoolbox.example.internal
DJANGO_DEBUG=false
DJANGO_LOG_FILE=/var/log/telephonytoolbox/application.log
DJANGO_LOG_LEVEL=INFO
CSRF_TRUSTED_ORIGINS=https://telephonytoolbox.example.internal,https://localhost:9000

# TLS trust: point Python HTTP stacks (requests) at the OS CA trust store so
# internal-CA-signed endpoints (e.g. the OIDC provider) validate correctly.
# On RHEL9 the system bundle lives at /etc/pki/tls/certs/ca-bundle.crt.
REQUESTS_CA_BUNDLE=/etc/pki/tls/certs/ca-bundle.crt
SSL_CERT_FILE=/etc/pki/tls/certs/ca-bundle.crt

DATABASE_HOST=127.0.0.1
DATABASE_PORT=5432
DATABASE_NAME=telephonytoolbox
DATABASE_USER=telephonytoolbox
DATABASE_PASSWORD=change-me

AUTH_MODE=oidc
LOCAL_AUTH_ENABLED=true
EXTERNAL_AUTH_NAME=Authentik Login

CUCM_AXL_HOST=cucm.example.internal
CUCM_AXL_USERNAME=axl-user
CUCM_AXL_PASSWORD=change-me
CUCM_AXL_VERSION=14
CUCM_ROUTE_PARTITION=INTERNAL

AUDIT_RETENTION_DAYS=90

# Branding overrides. Leave blank for the default (blank/transparent) logos and
# favicon. Set an absolute path to a readable image file to override each asset;
# it is served at runtime via /api/branding/<slug>/ (no frontend rebuild needed).
BRAND_HEADER_LOGO=
BRAND_LOGIN_LOGO=
BRAND_FAVICON=

ENTRA_CLIENT_ID=
ENTRA_CLIENT_SECRET=
ENTRA_TENANT_ID=
ENTRA_REDIRECT_URI=https://telephonytoolbox.example.internal/api/auth/login/entra/callback/

OIDC_CLIENT_ID=telephony-toolbox
OIDC_CLIENT_SECRET=change-me
OIDC_METADATA_URL=https://auth.example.internal/application/o/telephony-toolbox/.well-known/openid-configuration
OIDC_REDIRECT_URI=https://telephonytoolbox.example.internal/api/auth/login/oidc/callback/
OIDC_SCOPES=openid profile email
OIDC_EMAIL_CLAIM=email
OIDC_USERNAME_CLAIM=preferred_username
OIDC_DISPLAY_NAME_CLAIM=name

LDAP_SERVER_URI=
LDAP_BIND_DN=
LDAP_BIND_PASSWORD=
LDAP_USER_SEARCH_BASE=
LDAP_USER_EMAIL_ATTRIBUTE=mail
LDAP_USER_DISPLAY_NAME_ATTRIBUTE=displayName
LDAP_USER_ENABLED_ATTRIBUTE=
# Optional: Restrict login to users matching a group filter. Use %email as a placeholder for the user's email address.
# Examples:
#   (mail=%email)  — Simple match on email attribute
#   (&(mail=%email)(memberOf=CN=TelephonyToolboxUsers,OU=Groups,DC=example,DC=com))  — Email + group membership
#   (|(mail=%email)(uid=%email))  — Match on mail or uid attribute
# Leave blank to allow any valid LDAP user.
LDAP_GROUP_SEARCH_FILTER=

# AudioCodes CDR module: comma-separated Fernet key(s) encrypting the source database
# credential stored in the application database. The first key encrypts; all keys decrypt.
# The RHEL deploy scripts generate this when blank and never overwrite it. Keep it out of
# source control and back it up separately from database backups.
CDR_SOURCE_ENCRYPTION_KEY=