# Environment for the NetBird dashboard container (the SPA reads these at container start to
# build its runtime OIDC configuration). This example is insecure; the operator overrides
# the OIDC values in production.

# The public base URL of the management API/gRPC endpoint, i.e. the NetBird host name behind
# Traefik. Must be reachable by browsers.
NETBIRD_MGMT_API_ENDPOINT=https://netbird

# TLS is terminated by the traefik cookbook. "none" makes the dashboard image serve plain
# HTTP on port 80 (inside its namespace) and never attempt to obtain its own certificate.
LETSENCRYPT_DOMAIN=none

# OIDC client used by the browser (public client, PKCE). Point these at your provider; the
# keycloak cookbook of this repository is one way to provide them.
AUTH_AUTHORITY=https://idp.example.test/realms/netbird
AUTH_CLIENT_ID=netbird-client
AUTH_CLIENT_SECRET=
AUTH_AUDIENCE=netbird-client
AUTH_SUPPORTED_SCOPES=openid profile email offline_access
USE_AUTH0=false