# Copy to /etc/skd/env or .env for local runs
# Optional allowlist of manageable users (otherwise all real users with uid>=1000)
SKD_ALLOWED_USERS=child1,child2
SKD_AUTH_SECRET=change-me-secret
SKD_TOKEN_TTL_SECONDS=900
# Auth mode: pam (default) or oidc
SKD_AUTH_MODE=pam
SKD_AUTH_ALLOWED_USERS=
SKD_AUTH_ALLOWED_GROUPS=sudo
SKD_AUTH_PAM_SERVICE=login
SKD_OIDC_ISSUER=
SKD_OIDC_CLIENT_ID=
SKD_OIDC_CLIENT_SECRET=
SKD_OIDC_REDIRECT_URI=http://localhost:8000/login/oidc/callback
SKD_OIDC_SCOPES=openid profile email
SKD_SESSION_COOKIE_NAME=skd_session
SKD_SESSION_COOKIE_SECURE=false
SKD_OIDC_STATE_COOKIE_NAME=skd_oidc_state
SKD_DEFAULT_COUNTDOWN=60
SKD_DEFAULT_SOUND=false
SKD_NOTIFY_TIMEOUT=5
# Set to true to test without performing real system changes
SKD_DRY_RUN=false