.env.example

# PowerDNS Authoritative Server
PDNS_URL=http://localhost:8081
PDNS_API_KEY=changeme

# PowerDNS Recursor
RECURSOR_URL=http://localhost:8082
RECURSOR_API_KEY=changeme

# JWT
JWT_SECRET=change-me-to-a-long-random-string

# Server
PORT=3000

# SQLite database path
DATABASE_URL=./data/dns-admin.db

# OIDC / SSO (optional — leave blank to disable)
# For local Keycloak testing: docker compose up -d keycloak
# Login at http://localhost:8080 as admin/admin, test user: testuser/testuser
OIDC_ISSUER_URL=http://localhost:8080/realms/dns-admin
OIDC_CLIENT_ID=dns-admin-ui
OIDC_CLIENT_SECRET=dns-admin-secret
OIDC_REDIRECT_URI=http://localhost:3000/auth/oidc/callback

# OIDC role mapping (optional — defaults work with Keycloak)
# Which ID token claim contains the user's roles
OIDC_ROLES_CLAIM=roles
# Which value in that claim grants admin (everything else → viewer)
OIDC_ADMIN_ROLE=admin