OpenIPAM/.env.example at main · alilotfi23/OpenIPAM · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
[TEMPLATE]
# Copy to .env and adjust. All settings are read via the IPAM_ prefix (see app/config.py).

IPAM_APP_NAME=OpenIPAM

# Postgres (async SQLAlchemy driver)
IPAM_DATABASE_URL=postgresql+asyncpg://ipam:ipam@localhost:5432/ipam

# Redis (background jobs + idempotency cache + rate limiting)
IPAM_REDIS_URL=redis://localhost:6379/0

IPAM_LOG_LEVEL=INFO
# JSON structured logs in production
IPAM_LOG_JSON=false

# Serve Swagger UI (/api/docs) and the OpenAPI schema. Set false in
# production so the API surface isn't exposed to attackers.
IPAM_ENABLE_DOCS=true

# JWT (auth; set a real secret >= 32 bytes before production use)
IPAM_JWT_SECRET=dev-only-change-me-before-production-use
IPAM_JWT_ALGORITHM=HS256
IPAM_JWT_ACCESS_TOKEN_MINUTES=30
IPAM_JWT_REFRESH_TOKEN_DAYS=7
# Mark auth cookies Secure (set true when serving over HTTPS)
IPAM_COOKIE_SECURE=false

# Connection pool sizing + statement timeout (see Part 2 §6 of CLAUDE.md)
IPAM_POOL_SIZE=10
IPAM_MAX_OVERFLOW=5
IPAM_STATEMENT_TIMEOUT_MS=30000

# Email-less password reset: how long an admin-issued one-time reset token
# stays valid (bootstrap_admin-style flow — no email, the admin hands the
# token to the user out-of-band; the raw token is shown exactly once)
IPAM_PASSWORD_RESET_TOKEN_MINUTES=30

# Rate limiting on burst-prone automation endpoints (per-client, per minute;
# non-positive disables that bucket; Redis-down degrades to no limiting)
IPAM_RATE_LIMIT_ALLOC_PER_MINUTE=30
IPAM_RATE_LIMIT_INGEST_PER_MINUTE=60
# Login brute-force guard (per client IP per minute; shared by the API and
# UI login forms). Non-positive disables the bucket.
IPAM_RATE_LIMIT_LOGIN_PER_MINUTE=20
# Trust X-Forwarded-For for rate-limit identity when behind a proxy.
# Keep false when clients connect directly; set true behind Nginx/HAProxy
# (otherwise every client shares the proxy IP's rate-limit bucket).
IPAM_TRUST_PROXY=false

# Login-CSRF strictness on the API pre-auth endpoints (/api/v1/auth/login,
# /api/v1/auth/password-reset). false (default) = check-when-present: a
# mismatched Origin/Referer is rejected, absent evidence is allowed (curl/
# Terraform/scripts send no Origin and have no browser session to hijack).
# Set true only if the deployment serves browsers exclusively: missing
# evidence is then rejected too, which breaks Origin-less API automation.
IPAM_STRICT_API_ORIGIN_CHECK=false

# DNS sync backend used by POST /dns/zones/{id}/sync, the zone page's
# "Sync now" button, and the auto-sync event path. "noop" records sync intent
# without talking to anything; "powerdns" pushes zones to a PowerDNS
# Authoritative server; "bind" renders BIND master files + rndc reload;
# "rfc2136" sends TSIG-signed dynamic UPDATEs (settings below).
IPAM_DNS_SYNC_BACKEND=noop

# Auto-sync coalescing window (seconds): zone/record writes enqueue one arq
# sync job per zone per burst (Redis SETNX marker; a crash backstop only,
# since the job clears the marker when it starts).
IPAM_DNS_SYNC_COALESCE_TTL_S=300

# PowerDNS sync backend connection (used when IPAM_DNS_SYNC_BACKEND=powerdns)
IPAM_PDNS_API_URL=https://pdns.example:8081/api/v1
IPAM_PDNS_API_KEY=change-me
IPAM_PDNS_SERVER_ID=localhost
IPAM_PDNS_TIMEOUT_S=10
# Set false for self-signed certs in lab environments
IPAM_PDNS_VERIFY_TLS=true

# BIND sync backend (used when IPAM_DNS_SYNC_BACKEND=bind): where
# <zone>.zone master files are written. named-checkzone validates each file
# before the rndc reload; both steps are gate-able for labs/tests without
# named installed.
IPAM_BIND_ZONE_DIR=/var/lib/openipam/zones
IPAM_BIND_CHECKZONE_COMMAND=named-checkzone
IPAM_BIND_CHECKZONE_ENABLED=true
IPAM_BIND_RNDC_COMMAND=rndc
IPAM_BIND_RNDC_ENABLED=true

# RFC2136 sync backend (used when IPAM_DNS_SYNC_BACKEND=rfc2136): the
# nameserver to send TSIG-signed dynamic UPDATEs to (the zone must already
# exist there). The TSIG secret is base64-encoded (dns.tsigkeyring format);
# TSIG is required — an unsigned UPDATE would let anyone rewrite the zone.
IPAM_RFC2136_NAMESERVER=127.0.0.1
IPAM_RFC2136_PORT=53
IPAM_RFC2136_TSIG_KEY_NAME=openipam
IPAM_RFC2136_TSIG_SECRET=base64-secret-here
IPAM_RFC2136_TSIG_ALGORITHM=hmac-sha256
IPAM_RFC2136_TIMEOUT_S=10

# DHCP config generator used by POST /dhcp/scopes/{id}/generate and the scope
# page's "Generate config" button. "noop" records the generation intent
# without producing config; "isc" renders dhcpd.conf subnet blocks; "kea"
# renders Kea JSON subnet objects; "kea_push" additionally pushes each scope
# to a Kea control agent over HTTP (settings below).
IPAM_DHCP_GENERATOR=noop

# Kea control-agent push generator (used when IPAM_DHCP_GENERATOR=kea_push):
# the control agent's HTTP endpoint and a file path to the operator's
# complete dhcp4 config JSON — the agent requires a full config for
# config-test/config-set, and the IPAM only owns the subnet4 list (replaced
# per scope on push). Optional basic auth; apply can be gated off to run
# validation-only (config-test, no config-set) for labs.
IPAM_KEA_CONTROL_URL=http://127.0.0.1:8000/
IPAM_KEA_CONTROL_USER=
IPAM_KEA_CONTROL_PASSWORD=
IPAM_KEA_CONTROL_TIMEOUT_S=10
# Set false for self-signed certs in lab environments
IPAM_KEA_VERIFY_TLS=true
IPAM_KEA_BASE_CONFIG=/etc/openipam/kea-dhcp4.json
IPAM_KEA_APPLY_ENABLED=true