# Copy to /etc/skd/env or .env for local runs
# Optional allowlist of manageable users (otherwise all real users with uid>=1000)
SKD_ALLOWED_USERS=
SKD_AUTH_SECRET=change-me-secret
SKD_TOKEN_TTL_SECONDS=900
# PAM ist immer aktiv; OIDC wird zusaetzlich angeboten, wenn konfiguriert.
# SKD_AUTH_MODE bleibt optional und wird derzeit nicht erzwungen.
SKD_AUTH_MODE=pam
SKD_AUTH_ALLOWED_USERS=
SKD_AUTH_ALLOWED_GROUPS=sudo
# Ubuntu/Debian: install.sh creates /etc/pam.d/skd; adjust for other distros.
SKD_AUTH_PAM_SERVICE=skd
SKD_OIDC_ISSUER=
SKD_OIDC_CLIENT_ID=
SKD_OIDC_CLIENT_SECRET=
SKD_OIDC_REDIRECT_URI=http://localhost/login/oidc/callback
SKD_OIDC_SCOPES=openid profile email
SKD_SESSION_COOKIE_NAME=skd_session
SKD_SESSION_COOKIE_SECURE=false
SKD_OIDC_STATE_COOKIE_NAME=skd_oidc_state
SKD_DEFAULT_COUNTDOWN=60
SKD_DEFAULT_SOUND=false
SKD_NOTIFY_TIMEOUT=5
# Update client configuration
SKD_UPDATE_URL=https://update.wlkns.org
SKD_UPDATE_TOKEN=
SKD_UPDATE_INTERVAL=3600
SKD_UPDATE_STATUS_URL=https://update.wlkns.org/status
SKD_UPDATE_STATUS_FILE=/var/lib/skd/update_status.json
SKD_UPDATE_LOG_FILE=/var/lib/skd/update_logs.jsonl
# Set to true to test without performing real system changes
SKD_DRY_RUN=false