# Copy to .env and fill in.  .env is gitignored.

# Hostname for the Traefik dashboard. Must resolve publicly for the
# Let's Encrypt HTTP-01 challenge to succeed, even though the router itself
# is additionally restricted to the LAN by internal-whitelist@file.
#   dev:  traefik-dev.pkartchner.com
#   prod: traefik.pkartchner.com
TRAEFIK_DASHBOARD_HOST=traefik-dev.pkartchner.com

# Basic-auth users for the dashboard, htpasswd format.
#
# EVERY '$' MUST BE DOUBLED to '$$'. Compose interpolates the substituted value,
# so a single '$' makes it read "$apr1" as an unset variable and silently
# collapse the hash to an empty string — which produces a dashboard that
# rejects every password rather than an obvious error.
#
# Generate and escape in one step:
#   htpasswd -nb admin 'yourpassword' | sed -e 's/\$/\$\$/g'
TRAEFIK_DASHBOARD_AUTH=admin:$$apr1$$CHANGEME$$REPLACETHISVALUE

# CrowdSec bouncer API key. Generate after the crowdsec stack is up:
#   docker exec crowdsec cscli bouncers add traefik-bouncer -o raw
# Consumed by the crowdsec-bouncer middleware defined as a Docker label in
# docker-compose.yml, so it never appears in any committed file.
CROWDSEC_LAPI_KEY=

# Static config file for THIS host.
#   prod: leave unset (defaults to ./traefik.yml, HTTP-01)
#   dev : ./traefik.dev.yml  (DNS-01, because public port 80 forwards to prod)
# TRAEFIK_STATIC_CONFIG=./traefik.dev.yml