.env.security

# ============================================================================
# SECURITY CONFIGURATION - Generated on 2026-02-06T23:28:13.367667
# ============================================================================

# Database Encryption (AES-256-GCM)
# This key encrypts sensitive data in the database
# IMPORTANT: Store this securely! Use a proper secrets manager in production.
DB_ENCRYPTION_KEY=famZ1tBLs6CMx1yYn/WOJBto51hAfaMhfbO71aogq70=

# Flask Secret Key
# Used for session encryption and CSRF tokens
SECRET_KEY=G2IAIJ1q40enhXFh5y7YN2AegTj1UrZ/sdzCm3IDwcM=

# Security Settings
FLASK_ENV=development
DEBUG=False

# RBAC Settings
ENABLE_RBAC=True
RBAC_DEFAULT_ROLE=viewer

# Tamper Protection
ENABLE_TAMPER_PROTECTION=True
TAMPER_PROTECTION_TIMEOUT=300  # 5 minutes

# PKI Settings
PKI_ENABLED=True
PKI_CERT_DIR=certs
PKI_KEY_SIZE=2048

# Database
DATABASE_URL=sqlite:///instance/app.db

# Audit Logging
ENABLE_AUDIT_LOGGING=True
AUDIT_LOG_FILE=logs/audit.log
AUDIT_LOG_RETENTION_DAYS=365

# Email Configuration (optional)
MAIL_SERVER=localhost
MAIL_PORT=25
MAIL_USE_TLS=False

# ============================================================================
# IMPORTANT SECURITY NOTES:
# ============================================================================
# 1. Change the admin user password immediately
# 2. Rotate DB_ENCRYPTION_KEY in production
# 3. Use environment variables or secrets manager instead of .env in production
# 4. Ensure logs/ and certs/ directories have proper permissions
# 5. Regular security audits are recommended
# 6. Keep backups of encryption keys in a secure location