[REQUIRED] Environment: production, staging, development, or test The database settings will automatically apply to the RAILS_ENV defined here.

set to true for production, false for development

[OPTIONAL] Logging level: debug, info, warn, error, fatal (default: info)

[OPTIONAL] Initial setup wizard: Enable this to force first-run setup in the web app until a banking_admin exists.

Optional token required to access /setup while wizard is active.

[OPTIONAL] Intercept outgoing emails and redirect to INTERCEPTOR_EMAIL without delivering to participants (defaults to DEMO_MODE value if un-set)

[OPTIONAL] Intercept outgoing SMS and redirect to SMS_INTERCEPTOR_NUMBER or log without delivering to recipients (defaults to DEMO_MODE value if un-set)

[OPTIONAL] Intercept Web Push browser notifications and suppress live delivery to participant devices (defaults to DEMO_MODE value if un-set)

[REQUIRED] Internal app port

[OPTIONAL] Subpath if hroot is served from a subdirectory (e.g. /hroot). Otherwise leave empty.

mail where logs are send to

Mail for System errors

[OPTIONAL] Non-production Interceptor (Redirect all mails to this address if Rails.env != production)

[REQUIRED] Database Names If these are empty, hroot uses the environment name (e.g. hroot_production)

[OPTIONAL] Test Database Credentials, if it deviates from Production-DB-User

[OPTIONAL] Root password if using Internal MySQL container

[OPTIONAL] Set to true to use Mockup Shibboleth login instead of real IdP (defaults to DEMO_MODE value if un-set)

Enrollment Verification Fallback: Ask for an identity document upload before booking a session if a user cannot verify via Shibboleth.

Discovery Service Mode: 'direct' (Single IdP), 'embedded' (In-page search / SeamlessAccess), 'redirect' (DFN WAYF) See documentation in wiki (Shibboleth-Integration.md) for full setup details.

Preferred Home Institution Name for Login Buttons & Autofill (e.g. "UHH", "Uni Köln", "LMU München"): - If SET: Login button will display "Login via <Name>" and route directly to this institution. In 'redirect' mode, a secondary link "Andere Hochschule / eduGAIN wählen" is shown below. - If UNSET / EMPTY: HRoot runs in pure Discovery / Federation mode. The main login button will show a generic label ("Login / Registrierung via Hochschul-Account") and redirect directly to the DFN WAYF / Discovery Service where users can choose from all participating universities.

Optional discovery service URL when SHIBBOLETH_DISCOVERY_MODE=redirect (defaults to DFN-AAI WAYF)

SERVICE PROVIDER (SP) & IDENTITY PROVIDER (IdP) SETTINGS Entity ID identifying this hroot instance in federation metadata (must match the URL registered at DFN/eduGAIN):

Public base URL of this hroot instance (used for SAML ACS callback generation):

Primary Identity Provider (Home Institution or Test-IdP): For UHH (Production):

[OPTIONAL] Fetch IdP endpoints and certificate automatically from remote IdP Metadata XML:

Security & Verification settings: Set to true if IdP explicitly signs inner Assertions separately

CERTIFICATES & KEYS Paths to your SP certificate & private key, and the IdP certificate:

Alternative: Inline PEM strings (useful in Docker secrets or cloud PaaS):

ATTRIBUTE MAPPING (OIDs & FriendlyNames) Unique User Identifier OID (Defaults to eduPersonPrincipalName):

Mapping of hroot User model attributes to Shibboleth SAML attribute names/OIDs. Format: SHIBBOLETH_MAP_<USER_FIELD>=<Shibboleth Attribute Name or OID> You can also provide multiple fallback OIDs comma-separated (e.g. schacHomeOrganization, o). Default standard OIDs (eduPerson, SCHAC, DFN): mail

givenName

sn

schacPersonalUniqueCode

schacHomeOrganization, fallback: o

schacDateOfBirth

schacGender

dfnEduPersonFieldOfStudyString, fallback: HIS

dfnEduPersonBranchAndDegree

eduPersonAffiliation

Comma-separated list of affiliation values that confirm student/verified status:

Generate VAPID keys with: bundle exec rails runner "puts WebPush.generate_key" Leave empty or omit if you do not want Web Push notifications.

Prevent spam registrations on public sign-up pages using hCaptcha - see their Website to obtain Keys.

send SMS reminders

# Settings for 'email' mode (only relevant if SMS_SEND_MODE=email)

# Settings for 'api' mode (sms-gate.app) (only relevant if SMS_SEND_MODE=api) Domain for the SMS Gateway (only relevant if using Docker and SMS_SEND_MODE=api) - default will be "sms"+your domain name, e.g "sms.hrootdomainname.com" This will be used as VIRTUAL_HOST and for SSL (Let's Encrypt)

[OPTIONAL] Settings for 'api' mode (sms-gate.app) (only relevant if SMS_SEND_MODE=api) If left empty, it automatically defaults to: - http://localhost:3001/api/3rdparty/v1/messages (if APP_DOMAIN is localhost) - https://sms.${APP_DOMAIN}/api/3rdparty/v1/messages (otherwise)

Important: This password is used as API password in hroot

Private Token used in sms-gateway to register/couple the device

SMS Interceptor (Redirect all API-SMS to this number if Rails.env != production)

[OPTIONAL] Let's Encrypt Email (for SSL renewal notifications in Docker setup)

[REQUIRED] External ports for the Nginx Proxy (Standard 80 and 443)

[OPTIONAL] Path to custom logo Can be a file in assets (mainlogo.png), a file in /public/ (/logo.png) or a full URL

Kimai Integration (time, cost & budget tracking)

[OPTIONAL] Docker Image source (defaults to official image on GitHub Packages)

[OPTIONAL] GitHub repository used for version checks and updates (e.g. wiso-forschungslabor/hroot or your-lab/hroot)

[OPTIONAL] Branch to track for updates (defaults to master)

[OPTIONAL] Personal Access Token (PAT with repo read scope) for private repositories

[OPTIONAL] Webhook URL / Secret if using an external updater daemon (e.g. adnanh/webhook)