# Drone 2.24.0 server — copy to /etc/drone/server.env (mode 0600, root).
# scripts/20-install.sh creates it from this template and fills the secrets.
# Reference: https://docs.drone.io/server/provider/gitea/

# --- Public address of Drone (what users and Gitea webhooks use) ------------
DRONE_SERVER_HOST=drone.example.internal
DRONE_SERVER_PROTO=https

# --- Gitea OAuth2 application (Gitea > Settings > Applications) -------------
# Redirect URI in Gitea must be: ${DRONE_SERVER_PROTO}://${DRONE_SERVER_HOST}/login
DRONE_GITEA_SERVER=https://gitea.example.internal
DRONE_GITEA_CLIENT_ID=__FILL_ME__
DRONE_GITEA_CLIENT_SECRET=__FILL_ME__
# Keep false; trust your internal CA instead (GUIDE.md §4.4).
DRONE_GITEA_SKIP_VERIFY=false

# --- Shared secret between server and runners (openssl rand -hex 16) --------
DRONE_RPC_SECRET=__GENERATED__
# Encrypts repository secrets at rest (exactly 32 hex characters).
DRONE_DATABASE_SECRET=__GENERATED__
DRONE_COOKIE_SECRET=__GENERATED__

# --- Access control ---------------------------------------------------------
# First administrator = an existing Gitea login. Admins can mark repos Trusted.
DRONE_USER_CREATE=username:__GITEA_ADMIN_LOGIN__,admin:true
DRONE_REGISTRATION_CLOSED=true
# Optional: only these Gitea users/orgs may log in.
#DRONE_USER_FILTER=platform-team,app-team

# --- AIR-GAP: the image enables Datadog usage reporting by default ----------
DRONE_DATADOG_ENABLED=false

# --- Storage (SQLite inside the /data volume; PostgreSQL for HA) ------------
DRONE_DATABASE_DRIVER=sqlite3
DRONE_DATABASE_DATASOURCE=/data/database.sqlite
#DRONE_DATABASE_DRIVER=postgres
#DRONE_DATABASE_DATASOURCE=postgres://drone:PASSWORD@pg.example.internal:5432/drone?sslmode=verify-full

# --- TLS directly on the server (skip if a reverse proxy terminates TLS) ----
#DRONE_TLS_CERT=/etc/drone/tls/drone.crt
#DRONE_TLS_KEY=/etc/drone/tls/drone.key

# --- Logging ----------------------------------------------------------------
DRONE_LOGS_TEXT=true
DRONE_LOGS_PRETTY=false
DRONE_LOGS_COLOR=false