# Copy to .env on the monitoring host (vps1) before `docker compose up`.
# .env is gitignored — never commit real secrets.
#
# vps1 is NOT the beta environment — that runs on vps2 now, as its own Swarm
# stack. Don't confuse the two when reading older docs that say "beta" here.

# The public hostname vps1's Caddy serves Grafana at (see caddy-grafana.conf).
GRAFANA_DOMAIN=dashboard.thermograph.org

# Break-glass local admin (Google SSO below is the primary login). Keep this
# strong; it's the fallback if OAuth ever breaks.
GF_ADMIN_USER=admin
GF_SECURITY_ADMIN_PASSWORD=change-me-to-something-strong

# --- Google SSO ------------------------------------------------------------------
# Create a Google Cloud "OAuth 2.0 Client ID" (type: Web application) and set:
#   Authorized redirect URI:  https://dashboard.thermograph.org/login/google
# Then paste the client id/secret here and flip OAUTH_ENABLED=true.
# Login is locked to pre-provisioned accounts (allow_sign_up=false) — provision
# your email as an admin (see README) so only you can sign in.
OAUTH_ENABLED=false
GOOGLE_CLIENT_ID=
GOOGLE_CLIENT_SECRET=

# --- Alerting (Discord) ----------------------------------------------------------
# Where every alert in grafana/provisioning/alerting/ is delivered: a webhook on
# the private #ops-alerts channel (Owners category) of the Thermograph.org
# Discord. NOT email — vps1's Grafana relays SMTP through vps2's Postfix, so
# email alerts die exactly when prod (on vps2) does.
#
# To mint one: Discord -> #ops-alerts -> Edit Channel -> Integrations ->
# Webhooks -> New Webhook -> Copy Webhook URL. Treat it like a password; anyone
# with it can post to the channel. Grafana refuses to start without it.
DISCORD_ALERT_WEBHOOK_URL=https://discord.com/api/webhooks/<id>/<token>