# bootapi configuration (environment variables).
#
# bootapi is configured entirely from the environment (12-factor style, same as
# encapi). In Kubernetes these come from the Deployment env + a Vault-sourced
# Secret (see docs/deployment.md). Locally, `env $(grep -v '^#' config.example.env | xargs) ./bin/bootapi`.

# --- HTTP ---
BOOTAPI_LISTEN_ADDR=:8000

# --- NetBox (source of truth for host -> boot data) ---
BOOTAPI_NETBOX_URL=https://netbox.k8s.syd1.au.unkin.net
# Provide the token inline OR (preferred in k8s) via a file mounted from Vault:
BOOTAPI_NETBOX_TOKEN=
# BOOTAPI_NETBOX_TOKEN_FILE=/var/run/secrets/netbox/api_token
BOOTAPI_NETBOX_TIMEOUT=5s
BOOTAPI_NETBOX_INSECURE=false

# --- caching ---
# Short by design: a re-provisioned host must pick up NetBox changes on its next
# boot. Set 0 to disable.
BOOTAPI_CACHE_TTL=30s

# --- templates ---
# Optional override directory (a ConfigMap mount in k8s); files here win over
# the embedded defaults. Leave empty to use only the built-in templates.
# BOOTAPI_TEMPLATE_DIR=/etc/bootapi/templates
# Template used when NetBox provides no platform/role/override selection key.
BOOTAPI_DEFAULT_TEMPLATE=almalinux9

# --- URLs baked into rendered output ---
# bootapi's own externally-reachable base URL (goes into the iPXE inst.ks=).
BOOTAPI_BASE_URL=http://bootapi.k8s.syd1.au.unkin.net
# Base URL of the OS install trees (kernel/initrd + inst.repo).
BOOTAPI_BOOT_BASE_URL=http://mirror.k8s.syd1.au.unkin.net/almalinux/9

# --- puppet bootstrap targets (baked into kickstart %post) ---
BOOTAPI_PUPPET_SERVER=puppet.query.consul
BOOTAPI_PUPPET_CA_SERVER=puppetca.query.consul

# --- network defaults (used when NetBox does not record them per-device) ---
BOOTAPI_DOMAIN=main.unkin.net
BOOTAPI_NAMESERVERS=198.18.19.19

# --- render-time secrets (NEVER stored in NetBox; from Vault in k8s) ---
# crypt(3) hash for the root account. Empty => root account locked.
BOOTAPI_ROOT_PASSWORD_HASH=
# BOOTAPI_ROOT_PASSWORD_HASH_FILE=/var/run/secrets/bootapi/root_password_hash
# Newline-separated SSH public keys installed for root.
BOOTAPI_SSH_AUTHORIZED_KEYS=

# --- unknown-MAC fallback: "local" (safe: boot local disk) or "shell" (debug) ---
BOOTAPI_UNKNOWN_MAC_FALLBACK=local