# taler-monitoring — local secrets template
#
# Copy to secrets.env (gitignored) and fill values, OR export the same vars:
#   cp secrets.env.example secrets.env
#   $EDITOR secrets.env
#
# Never commit secrets.env. Prefer file paths under koopa-admin-secrets
# for long-term storage; this file is for workstation one-shots / overrides.
#
# Load order: env already set > secrets.env > SECRETS_ROOT files > SSH koopa

# --- Preferred: point at secrets tree (no passwords in this file) ---
# Sibling of admin-log on this machine:
# KOOPA_ADMIN_SECRETS=$HOME/src/koopa/koopa-admin-secrets
# Or host-root only:
# SECRETS_ROOT=$HOME/src/koopa/koopa-admin-secrets/koopa/host-root

# --- Or paste passwords / tokens (local GOA e2e) ---
# Bank admin (libeufin-bank admin) — funds / creates accounts in e2e
# E2E_BANK_ADMIN_PASS=
# BANK_ADMIN_PASS=          # alias, same meaning

# Merchant instance token for private orders (goa-demo-cp4zqk on hacktivism)
# Full "secret-token:…" or raw secret (Bearer prefix added by e2e)
# E2E_MERCHANT_TOKEN=
# MERCHANT_TOKEN=
# MERCHANT_INSTANCE_PASSWORD=

# --- FrancPaysan STAGE (TESTPAYSAN) e2e ---
# Default phases for -d stage.lefrancpaysan.ch: urls + inside + versions + e2e
# inside uses francpaysan-stage-user (stagepaysan); stats from public HTTPS.
# Admin credit (required for ATM withdraw ladder on stage):
# E2E_BANK_ADMIN_PASS=…   # or auto-load via SSH francpaysan-host
# FRANCPAYSAN_SSH=francpaysan-host
# FRANCPAYSAN_SECRETS=$HOME/francpaysan-secrets
# Public shop pays use E2E_USE_TEMPLATES=1 (default on TESTPAYSAN) — no merchant token.

# Optional overrides
# MERCHANT_INSTANCE=goa-demo-cp4zqk
# EXPECT_CURRENCY=GOA
# E2E_TIMEOUT=340
# PROGRESS_TOTAL=120
# PROGRESS_SHOW_EVERY=8
# PROGRESS_OFF=1

# --- Merchant SPA /webui/ fingerprints (urls phase, group www.webui) ---
# EXPECT_WEBUI_VERSION=1.6.11
# EXPECT_WEBUI_OVERLAY=selfbuild-v1.6.11
# WEBUI_OVERLAY_DENY=c778af04|master-11340
# CHECK_WEBUI_SPA=0

# --- auth401 phase (WebUI signup/login/pwchange/admin + case matrix) ---
# Default FULL=1 creates throwaway MIX instance + runs all groups.
# Stage also loads durable mon401 for extra durable.* checks:
# AUTH401_FULL=1
# AUTH401_CONTINUE=1         # optional: hard prereqs soft; full ERROR list always via EXIT trap
# CONTINUE_ON_ERROR=1        # alias for AUTH401_CONTINUE
# (auth401 no longer uses set -e — silent mid-run abort fixed)
# AUTH401_CREATE=1
# AUTH401_PREFER_DURABLE=0   # 1 = only mon401, skip throwaway signup
# AUTH401_INSTANCE=mon401
# AUTH401_PASSWORD=
# AUTH401_DURABLE_ID=mon401
# AUTH401_CREATE_PASSWORD=Mon401-Test-Pass!
# AUTH401_SKIP_IF_MFA=1
# AUTH401_BEARER=            # default-instance-token (not admin)
# AUTH401_ADMIN_TOKEN=       # required for admin-create group
# AUTH401_ADMIN_PASSWORD=    # or login as AUTH401_ADMIN_USER=admin
# AUTH401_ADMIN_USER=admin
# FRANCPAYSAN_SECRETS=$HOME/francpaysan-secrets

# --- Ladder (GOA withdraw ladder · explorer pool) ---
# Prefer SECRETS_ROOT / KOOPA_ADMIN_SECRETS (bank-explorer-password.txt).
# Overrides only if needed:
# EXP_USER=explorer
# EXP_PW=
# EXP_PW_FILE=$HOME/src/koopa/koopa-admin-secrets/koopa/host-root/taler-bank/bank-explorer-password.txt
# CLI_JS=$HOME/taler/src/taler-typescript-core/packages/taler-wallet-cli/bin/taler-wallet-cli.mjs

# Values that typically appear on a full stack (for orientation only):
#   bank-admin-password.txt
#   bank-explorer-password.txt
#   bank-exchange-password.txt
#   bank-goa-demo-cp4zqk-password.txt
#   merchant-goa-demo-cp4zqk-password.txt
#   exchange-attribute-encryption.secret.conf
#   (see ../SECRETS.md and koopa-admin-secrets/MAP.md)