# ===========================================
# Vaultwarden API Configuration
# ===========================================
# Copy this file to .env and fill in your values.
# NEVER commit your actual .env file!

# --- Required ---

# Your Vaultwarden instance URL
VAULTWARDEN_URL=https://vault.yourdomain.com

# Your Vaultwarden login email
VAULTWARDEN_EMAIL=you@example.com

# Your Vaultwarden master password
VAULTWARDEN_PASSWORD=your-master-password

# API key for authenticating to this service (min 32 chars).
# This single key has FULL access to every secret the account can decrypt.
# Generate one: openssl rand -base64 32
# At least one of API_KEY / API_KEYS / API_KEYS_FILE is required.
API_KEY=

# --- Optional ---

# Multiple, individually-revocable keys, each scoped to specific organizations
# and/or collections. Scope is enforced SERVER-SIDE regardless of query filters,
# so a scoped key can only read secrets within its scope. Each key needs >= 32 chars.
# Refs may be friendly names or UUIDs (UUIDs recommended — names are case-insensitive,
# break on rename, and a duplicate name binds to the lowest matching UUID). A key with
# no organizations/collections is unscoped (full access). Note: an org-scoped key cannot
# read personal/no-org items.
#
# Inline JSON (string env var):
# API_KEYS=[{"name":"dev-team","key":"<32+ chars>","organizations":["MyOrg"],"collections":["Secrets - DEV"]}]
#
# Or a mounted JSON file (takes precedence over API_KEYS; ideal as a Docker secret):
# API_KEYS_FILE=/run/secrets/api-keys.json

# Restrict access to specific IPs/CIDRs
# ALLOWED_IPS=192.168.1.0/24,10.0.0.1

# Auto-whitelist GitHub Actions IPs (for CI/CD)
# ENABLE_GITHUB_IP_RANGES=true

# Trusted reverse proxy IPs (for correct client IP detection)
# TRUSTED_PROXY_IP=172.16.0.0/12

# How often to re-sync the vault (default: 5m)
# SYNC_INTERVAL=5m

# Rate limiting (per client IP). Whitelisted IPs (ALLOWED_IPS / TRUSTED_PROXY_IP)
# bypass the limiter entirely. Defaults: 30 requests per 1m window.
# RATE_LIMIT_MAX=30
# RATE_LIMIT_WINDOW=1m

# Environment (development shows detailed errors, production hides them)
# ENVIRONMENT=production

# Enable debug logging (shows secret names in logs — NOT for production!)
# DEBUG=false