.env.example

# Local development (laptop) only. Not used in Docker or EC2 (they set USERS_PATH/CONFIG_PATH themselves).
# Copy to .env and set paths so config + users stay in one folder.
#
# Option A — single data directory (recommended): set both to the same folder
#   OSCAL_DATA_DIR=/Users/you/Documents/OSCAL_Reports_data
#   (backend uses OSCAL_DATA_DIR/config.json and OSCAL_DATA_DIR/users.json)
#
# Option B — explicit files (must be same directory if you want one folder)
USERS_PATH=/Users/you/Documents/OSCAL_Reports_data/users.json
CONFIG_PATH=/Users/you/Documents/OSCAL_Reports_data/config.json
#
# If you omit both: when ../OSCAL_Reports_data exists next to the repo and contains
# users.json or config.json, both files are read/written there automatically.

# Okta OIDC: must match a Sign-in redirect URI in Okta exactly (scheme + host + port + path).
# Set when proxy does not send X-Forwarded-Host/Proto (avoids redirect_uri=localhost:3020).
# OSCAL_OKTA_REDIRECT_URI=https://keekar.3utilities.com/auth/okta/callback
# OSCAL_OKTA_REDIRECT_URI=http://keekar.3utilities.com:3021/auth/okta/callback

# Generic SSO (Authentik) and Guardian Agent assessments for local development. Container deployments use
# .env.docker.example instead (guide: docs/GUARDIAN_SSO_DOCKER_DEPLOYMENT.md). Uncomment and replace the placeholders.
# If you load this file with a shell ("source .env"), keep the single quotes around the targets JSON.
# OSCAL_GENERIC_SSO_ISSUER=https://<sso-host>/application/o/<application-slug>/
# OSCAL_GENERIC_SSO_CLIENT_ID=<oauth-client-id>
# OSCAL_GUARDIAN_ASSESSMENTS_ENABLED=true
# OSCAL_GUARDIAN_GENERIC_SSO_ASSESSMENTS_URL=https://<api-id>.execute-api.<region>.amazonaws.com/v1/guardian
# OSCAL_GUARDIAN_ASSESSMENTS_ALLOWED_HOSTS=<api-id>.execute-api.<region>.amazonaws.com
# OSCAL_GUARDIAN_GENERIC_SSO_SCOPE=guardian-assessments
# OSCAL_GUARDIAN_GENERIC_SSO_MAX_TOKEN_AGE_SECONDS=600
# OSCAL_GUARDIAN_ASSESSMENT_TARGETS_JSON='[{"provider":"cloudflare","targetId":"<target-id>","label":"<label>","groups":["<idp-group-name>"]}]'