# Production mode has no built-in credentials. This password bootstraps the
# first administrator and remains the authoritative admin password on restart.
RMM_INSECURE_DEV_MODE=false
RMM_OPERATOR_USERNAME=admin
RMM_OPERATOR_PASSWORD=replace-with-a-long-random-password

# Optional emergency/API bearer token. Leave empty when browser sessions are enough.
RMM_OPERATOR_TOKEN=

# Shared enrollment is disabled by default. Users create one-time grants in the UI.
RMM_ALLOW_LEGACY_ENROLLMENT=false
RMM_ENROLLMENT_TOKEN=
RMM_ALLOW_LEGACY_LUCI_PROXY=false

# Set true when the UI is served through an HTTPS reverse proxy.
RMM_COOKIE_SECURE=true
RMM_PUBLIC_SCHEME=https
RMM_METRIC_RETENTION_DAYS=30

RMM_HTTP_BIND_IP=127.0.0.1
RMM_HTTP_PORT=18080

# The router connects to this port. Ports 22000-22099 are operator endpoints.
RMM_TUNNEL_BIND_IP=0.0.0.0
RMM_TUNNEL_SSH_PORT=2222
RMM_TUNNEL_OPERATOR_BIND_IP=127.0.0.1
RMM_TUNNEL_KEY_PATH=./secrets/router_tunnel_key.pub

# Optional HTTPS reverse proxy overlay.
RMM_DOMAIN=rmm.example.com
RMM_DEVICE_DOMAIN=routers.example.com
RMM_PROXY_HTTP_PORT=80
RMM_PROXY_HTTPS_PORT=443

# Required only with compose.keendns.yaml. The certificate must cover
# *.routers.example.com and the private key must not be committed.
RMM_WILDCARD_CERT_PATH=./secrets/routers-wildcard.crt
RMM_WILDCARD_KEY_PATH=./secrets/routers-wildcard.key