Example .env file for HAP

# Headless Auth Platform — environment configuration (HAP_ prefix).
# Copy to .env and adjust. NEVER commit a real .env.

# --- Datastores ---
# Host ports follow the WBSP docker-compose convention (project 390): Postgres is published
# on 54390 and Redis on 63390 (see target/docker-compose.yml). These URLs are for running
# the app on the host (uvicorn) against the compose datastores; the container-internal ports
# are still 5432/6379.
HAP_DATABASE_URL=postgresql+asyncpg://hap:hap@localhost:54390/hap
HAP_REDIS_URL=redis://localhost:63390/0

# --- Key management ---
# env | aws_kms | vault. The env provider uses HAP_MASTER_ENCRYPTION_KEY for at-rest
# envelope encryption and stores generated signing keys via the provider (never in the DB).
HAP_KEY_PROVIDER=env
# base64-encoded 32-byte key. Generate: python -c "import os,base64;print(base64.b64encode(os.urandom(32)).decode())"
HAP_MASTER_ENCRYPTION_KEY=CHANGE_ME_base64_32_bytes

# --- Tokens / signing ---
HAP_DEFAULT_JWKS_ALGORITHM=RS256
HAP_ACCESS_TOKEN_DEFAULT_TTL=3600

# --- Tokens / issuer ---
# Public base URL; per-tenant issuer is {HAP_ISSUER_BASE_URL}/t/{tenant_slug}.
HAP_ISSUER_BASE_URL=http://localhost:8000

# --- Admin (MVP bootstrap) ---
# Single bootstrap key for the tenant-scoped + platform admin APIs (Phase 10 adds
# scoped admin-key issuance). Generate a strong random value in production.
HAP_ADMIN_API_KEY=CHANGE_ME_admin_key

# --- KeyProvider (env) ---
# Directory where the env KeyProvider persists AES-GCM-encrypted signing keys.
HAP_KEYSTORE_DIR=.keystore

# --- WebAuthn / passkeys ---
HAP_WEBAUTHN_RP_ID=localhost
HAP_WEBAUTHN_RP_NAME=Headless Auth Platform
HAP_WEBAUTHN_ORIGIN=http://localhost

# --- Runtime ---
HAP_ENVIRONMENT=dev

# --- Email delivery ---
# console (default): logs the message — OTP codes appear in stdout (dev only).
# smtp: send via an SMTP server, including AWS SES (HAP_SMTP_HOST = SES SMTP endpoint,
#       e.g. email-smtp.<region>.amazonaws.com; HAP_SMTP_USERNAME/PASSWORD = SES SMTP creds).
HAP_EMAIL_MODE=console
HAP_EMAIL_FROM=no-reply@localhost
HAP_SMTP_HOST=
HAP_SMTP_PORT=587
HAP_SMTP_USERNAME=
HAP_SMTP_PASSWORD=
HAP_SMTP_STARTTLS=true
HAP_SMTP_SSL=false
HAP_SMTP_TIMEOUT_SECONDS=10