.env.example

# Copy this file to .env and fill in the values.
# The .env file is gitignored and must never be committed.

# ----- Web app -----
# Sign session cookies. Generate one with:
#   python -c "import secrets; print(secrets.token_hex(32))"
SECRET_KEY=

# Shared passcode your team types to log in. Choose something private.
ACCESS_PASSCODE=

# Minutes a login stays valid before re-entry is needed.
SESSION_MINUTES=480

# Trust the X-Forwarded-For header for the client IP used in rate limiting.
# Leave False for the default direct-bind deployment: the header is
# client-controlled and trusting it would let an attacker rotate the
# rate-limit key to bypass login and open throttling. Set True ONLY when
# running behind a single trusted reverse proxy that sets X-Forwarded-For.
TRUST_PROXY=False

# Send the session cookie only over HTTPS. Keep False for plain-HTTP LAN use
# (otherwise the cookie is never sent). Set True when the app is fronted by
# HTTPS, e.g. a TLS-terminating proxy or VPN gateway.
SESSION_COOKIE_SECURE=False

# ----- ZKTeco device -----
# The IP address of the device on your office network.
# Find it on the device under Menu > Comm > Ethernet, or your router's
# connected-devices list. Factory default is often 192.168.1.201.
DEVICE_IP=192.168.1.201

# Network port the device listens on. Default is 4370.
DEVICE_PORT=4370

# Communication password set on the device. 0 means no password.
DEVICE_PASSWORD=0

# Connection timeout in seconds.
DEVICE_TIMEOUT=5

# Many networks block ping. Leave True unless you know ping works.
DEVICE_OMMIT_PING=True

# Set True only if the normal (TCP) connection fails to establish.
DEVICE_FORCE_UDP=False

# ----- Auto-discovery (optional) -----
# When True, if DEVICE_IP can't be reached the app scans the subnets below for
# a ZKTeco and uses the first one found (caching it). Only works when this
# machine is on the SAME subnet as the device. Leave False to always use
# DEVICE_IP exactly.
DEVICE_AUTODISCOVER=False

# Subnets to scan as /24 prefixes (first three octets), comma-separated.
# Defaults to DEVICE_IP's own subnet if left blank.
DEVICE_DISCOVERY_SUBNETS=192.168.0,192.168.1

# Per-host connect timeout during a scan, in seconds. Keep small.
DEVICE_DISCOVERY_TIMEOUT=0.8

# Guard: the device IP and discovery subnets must be private/LAN ranges unless
# this is True. Stops the scanner being pointed at arbitrary public hosts.
DEVICE_ALLOW_PUBLIC=False

# How many seconds the door stays unlocked after a tap.
DOOR_OPEN_SECONDS=5

# ----- Network camera (optional) -----
# The camera itself is connected from the in-app "Connect" panel and saved to
# camera_config.json (gitignored). These only tune behaviour.
# Timeout (seconds) when the app fetches the camera feed.
CAMERA_TIMEOUT=10
# How often the browser refreshes the still image in snapshot mode (ms).
CAMERA_SNAPSHOT_INTERVAL_MS=1000
# SSRF guard: by default the camera URL host must be a private/LAN address.
# Set True only if your camera is intentionally reachable at a public IP.
CAMERA_ALLOW_PUBLIC=False