.env.example

# microfips environment template (issue #134).
# Copy to .env (gitignored) and fill in real values. NEVER commit real values.
# Load line-wise: while IFS='=' read -r k v; do export "$k=$v"; done < .env
# (`export $(grep -v '^#' .env | xargs)` splits SSIDs containing spaces.)

# --- WiFi (ESP32 wifi-feature builds; compile-time) ---
WIFI_SSID=your-network-name
WIFI_PASSWORD=your-network-password

# --- Host tool identity (microfips-link, microfips-sim, microfips-http-test) ---
# FIPS_NSEC: 64 hex chars. Required — no default device identity is allowed;
# unset = the tool panics rather than falling back to any committed key.
FIPS_NSEC=
# FIPS_PEER_NPUB: 66 hex chars (compressed pubkey of the peer/responder).
FIPS_PEER_NPUB=

# --- Responder peer allowlist (issue #134; WireGuard-style) ---
# Comma-separated 66-hex npubs a responder answers; unset = allowlist not
# configured (single-peer pin stays the enforcement). Malformed = panic
# (fail closed). VPS1-side enforcement lives in the fips repo.
#FIPS_PEER_ALLOWLIST=02<hex>,03<hex>

# --- Build-time per-device overrides (microfips-build) ---
# A same-named env var overrides any device-registry.json value at build time.
# DEVICE_NSEC_HEX_esp32s3=  # 64 hex — repin a board's identity
# DEVICE_NPUB_HEX_vps=      # 66 hex — repin the peer at a local daemon
# DEVICE_NSEC_HEX_esp32c3=  # 64 hex — REQUIRED for esp32c3 builds (no default)
# FIPS_TARGET_HOST=         # host-or-ip static target override

# --- VPS access (AGENTS.md "VPS Access"; never committed) ---
VPS_HOST=orangeclaw.dns4sats.xyz
VPS_USER=routstr
# Password read by `sshpass -e` (from the environment, never from argv).
# With key-based auth installed this is usually left empty.
SSHPASS=
# Legacy name still read by the shell scripts in scripts/ - set it to the same
# value as SSHPASS until those scripts are migrated off it.
# VPS_PASS=

# --- Lab bench key material (2026-09-05, per-run bench identities) ---
# LAB_KEY_SALT: 64 hex chars (32B). Derives the LONG-LIVED lab identities
# (the standard lab daemon) via `lab_keygen.py --salt <label>` — not
# derivable from public info, stable across restarts, never published.
# Scenario daemons/nodes use PER-RUN identities (BenchIdentities, fips-lab)
# and do NOT read this salt. Generate: python3 -c 'import secrets;
# print(secrets.token_hex(32))'
LAB_KEY_SALT=