# Packet Station test settings on the test VM (native, no Docker).
# deploy/vm/install.sh --stack test copies this to /etc/packetstation/packetstation.env
# (root:packetstation 0640) if that file does not exist yet. It never overwrites it.
# It holds no secret: passwords and keys are files in /etc/packetstation/secrets.
# The test VM never points at VISUAL production. It reads VISUAL DEV.
#
# systemd reads this file (EnvironmentFile=). One KEY=value per line. Comments on their own lines.
# Quote a value with spaces in double quotes. A value with a backslash goes in single quotes.
# Not read from here: STATIC_DIR, PS_BUILD, WORKER_BEAT_FILE, TZ (ps-launch.sh sets them).

# ---- Stack and site ----
# prod, test, ci or dev. Guards against crossing stacks.
STACK=test
# The VISUAL site in every call. The docker-1 test stack runs with PESCO.
SITE_ID=PESCO
# Site time zone for schedules and display. The processes run in UTC.
SITE_TZ=America/Denver
# Public URL, used in links and mail.
PUBLIC_URL=https://packetstation-test.pescoinc.biz
# NPM on docker-1, as the VM sees it. Only this address may set X-Forwarded-*. install.sh also
# opens port 8000 to this address only (packetstation-firewall.service). Must be an IP address.
TRUSTED_PROXY_HOST=192.168.101.12
# DEBUG, INFO, WARNING or ERROR. Logs go to the journal.
LOG_LEVEL=INFO

# ---- PostgreSQL 16 on this VM, over the local socket (roles made by install.sh) ----
# A folder means the Unix socket. PostgreSQL listens on no TCP port.
PG_HOST=/var/run/postgresql
PG_PORT=5432
PG_DATABASE=packetstation
PG_APP_USER=ps_app
PG_APP_PASSWORD_FILE=/etc/packetstation/secrets/postgres_app_password
PG_MIGRATE_USER=ps_migrate
PG_MIGRATE_PASSWORD_FILE=/etc/packetstation/secrets/postgres_migrate_password

# ---- Keys and folders ----
# The services get the secrets as systemd credentials and ps-launch.sh points these at them.
# The paths here are the files those credentials are loaded from.
SESSION_KEY_FILE=/etc/packetstation/secrets/session_key
SEAL_KEY_FILE=/etc/packetstation/secrets/seal_key
# Stored files (drawings, MTRs, reports, data books). Owned by packetstation, 0750.
ASSETS_DIR=/var/lib/packetstation/assets
# Nightly dumps (ps-backup). The worker's backup-check job reads the markers here.
BACKUP_DIR=/var/backups/packetstation
# The archive NFS mount (Gitea issue 7). Uncomment once the share is mounted here and
# `ps-run doctor` can write to it. Unset turns the archive off. The folder under it is set by an
# Admin on the Admin page, File locations.
#ARCHIVE_ROOT=/mnt/packetstation-archive

# ---- Uploads and storage ----
UPLOAD_MAX_BYTES=26214400
UPLOAD_MAX_BYTES_BOM=5242880
ASSETS_QUOTA_WARN_PCT=85
# 0 measures the file system under ASSETS_DIR.
ASSETS_QUOTA_BYTES=0

# ---- ClamAV (optional, off: Gitea issue 19) ----
# Empty means no scan. On a VM, clamd would run from the clamav-daemon package on 127.0.0.1.
#CLAMAV_HOST=127.0.0.1
CLAMAV_PORT=3310
CLAMAV_TIMEOUT_SECONDS=30

# ---- LDAP (PESCO Active Directory) ----
LDAP_URL="ldaps://DC-02.PESCO.COM:636 ldaps://PDC-1.PESCO.COM:636"
LDAP_BASE_DN=DC=PESCO,DC=com
LDAP_BIND_DN=CN=svc-packetstation,OU=System_Accounts,OU=Admin,DC=PESCO,DC=com
LDAP_PASSWORD_FILE=/etc/packetstation/secrets/ldap_bind_password
LDAP_USER_FILTER="(|(sAMAccountName={0})(userPrincipalName={0}))"
LDAP_GROUP_BASE_DN=OU=PacketStation,OU=Groups,OU=PESCO_FARMINGTON,DC=PESCO,DC=com
# The PESCO CA chain. install.sh --ca-bundle puts it here and in the system trust store.
LDAP_CA_BUNDLE=/etc/packetstation/ca/pesco-ca.pem
LDAP_STARTTLS=false
LDAP_ALLOW_INSECURE=false

# ---- Mail (relay app-03, no auth) ----
SMTP_HOST=app-03.pesco.com
SMTP_PORT=25
SMTP_FROM=noreply@pescoinc.biz
SMTP_STARTTLS=true
SMTP_CA_BUNDLE=/etc/packetstation/ca/pesco-ca.pem
# The test VM never mails people about test data. The Admin "Send a test" still sends.
NOTIFY_DRY_RUN=true

# ---- VisualKit (VISUAL ERP, read only) ----
# VISUAL DEV. The test VM never points at production. Single quotes keep the backslash.
VISUAL_SERVER='vsql.pesco.com\DEV'
VISUAL_DATABASE=PESCOINCDEV
VISUAL_USER=visualkit_ro
VISUAL_PASSWORD_FILE=/etc/packetstation/secrets/visualkit_password
# no until vsql has a trusted certificate (Gitea issue 5). The PESCO CA is in the VM's system
# store (install.sh --ca-bundle), which the ODBC driver reads, so yes works once vsql has one.
VISUAL_ENCRYPT=no
VISUAL_DRIVER="ODBC Driver 18 for SQL Server"

# ---- MFilesKit (M-Files, read only) ----
MFILES_URL=https://mfiles.pescoinc.biz/REST
MFILES_VAULT_GUID={BB69270D-023E-4EA8-B899-AD20B1349702}
MFILES_USERNAME=mfileskitRO
# ps-launch.sh exports MFILES_PASSWORD from this file (the worker's credential).
MFILES_PASSWORD_FILE=/etc/packetstation/secrets/mfileskit_password
# Leave MFILES_CA_BUNDLE unset: mfiles.pescoinc.biz has a public Let's Encrypt certificate.