[server]
listen      = ":8080"
storage_dir = "./interfaces"

# ── Identity & access control ───────────────────────────────────────────────
# The end-user identity is read from a header set by a trusted authenticating
# reverse proxy. Leave trusted_user_header empty for unproxied/dev/LAN use.
# SECURITY: only enable this when the proxy strips any client-supplied value of
# this header, otherwise it can be spoofed.
trusted_user_header = ""        # e.g. "X-Forwarded-User"
# Identity used when the trusted header is absent/empty. Empty = anonymous.
default_user        = ""

# Role-based access through group memberships. Each [[groups]] block lists
# members by role; a user's effective global capability is the highest role
# across all their memberships, along this ladder:
#   viewer < operator < logiceditor < auditor < admin
# Capabilities: operator+ may write signals; logiceditor+ may edit panel and
# control logic; auditor+ may view the audit log; admin may open the admin pane.
#
# The built-in "public" group is implicit (every user is a viewer of it). A
# config with NO roles assigned anywhere is fully open (everyone is admin), for
# trusted-LAN/dev use; assigning any role switches to strict mode where unlisted
# users are read-only viewers. Once changed at runtime via the admin pane,
# {storage_dir}/access.json supersedes the groups below.
#
# Groups may nest via "parent": a member of a parent group inherits its role on
# every descendant group too (unless overridden lower).
# [[groups]]
# name   = "public"
# admins = ["alice"]          # alice is a global admin
# [[groups]]
# name         = "operations"
# operators    = ["bob"]
# auditors     = ["carol"]
# [[groups]]
# name         = "engineers"
# parent       = "operations" # bob inherits operator here
# logiceditors = ["dave"]
# viewers      = ["erin"]

[datasource.epics]
enabled            = true
ca_addr_list       = ""   # overrides EPICS_CA_ADDR_LIST if set
archive_url        = ""   # EPICS Archive Appliance base URL
channel_finder_url = ""   # e.g. http://channelfinder:8080/ChannelFinder
auto_sync_filter   = ""   # e.g. area=StorageRing or tags=production

[datasource.synthetic]
enabled = true