---
# Documentation for this file can be found here:
# https://reactor.toggledbits.com/docs/Access-Control/
# Version 24127

users:
  # This section defines your valid users. The format is:
  # username: password (one per line).
  #
  # For each username, you may provide the password as cleartext, or as
  # a secure password hash produced by OpenSSL. If you don't have OpenSSL
  # installed, you can run `node tools/gen_enc_pass.js`. For OpenSSL,
  # use: openssl passwd -5 -stdin    (or -6 for SHA512)
  # Using password hashes allows you to store your passwords in a
  # (presumably) difficult to reverse form, preventing potential exposure
  # if the host is cracked and this file is discovered (but, you use
  # different passwords for everything anyway, right?).
  #
  # If the right-side value (password or hash) contains any non-alpha
  # characters, it's best to enclose it in quotes (this includes hashed
  # passwords).
  #
  # There are no required or special usernames. These are just examples.
  # You may remove all of these and replace them with your own.
  #
  admin: admin
  guest: guest
  john: $5$4CxEup.TT8DAB2Ym$pnfxYn.O2RIckFy6/bNNfqrgd.5xDVBPiYBUUjcDFG8
  jane: $6$mYI/d5POjy3zm8Pw$ZF1IHp6n8ocZ9RdRpxfUKIC.IpLk9pBjNd1akU4Ov1OSXA0rdB95FP/j5B9iyIyn8g6Il40XoCBX5Wwgn0qJh1

groups:
  # This section defines your user groups. Optionally, it defines application
  # access restrictions for the group. Users may belong to  more than one group.
  # Again, no required or special groups here.
  admin:
    users:
      - admin
    applications: true  # special form allows access to ALL applications

  house:
    # The house group has two users who can use the dashboard and have
    # access to the API when authenticated (see ACL below).
    users:
      - john
      - jane
    applications:
      - dashboard

  guests:
    # The guests group can use the dashboard, but has no API access.
    users:
      - guest
    applications:
      - dashboard

api_acls:
  # Any user that can access the Reactor management UI needs access to this
  # API endpoint for the "Restart Reactor" button to work.
  - url: "/api/v1/reload"
    group: admin
    allow: true
    log: true
  # This ACL allows users in the "house" group to access the API.
  - url: "/api"
    group: house
    allow: true
    log: true
  # This ACL allows anyone/thing to access the /api/v1/alive API endpoint
  - url: "/api/v1/alive"
    allow: true

session:
  timeout: 7200  # (seconds) default is 7200 (2 hours)
  rolling: false  # activity extends timeout when true

# If log_acls is true, the selected ACL for every API access is logged.
log_acls: true
# If debug_acls is true, even more information about ACL selection is logged.
debug_acls: false
