From f694a63518b32968aef13820ce6a99889f2c70d3 Mon Sep 17 00:00:00 2001
From: steffen <steffen@skui.io>
Date: Mon, 15 Jun 2026 19:44:21 +0200
Subject: [PATCH] use env vars for secrets (ETHICA_TOKEN/HOME/INTERVAL override
 config)

---
 .env.example               |  6 ++++++
 .gitignore                 |  1 +
 docker-compose.example.yml |  1 +
 ethica-agent.example.yml   | 12 ++++++++----
 ethica-agent.py            | 16 ++++++++++------
 5 files changed, 26 insertions(+), 10 deletions(-)
 create mode 100644 .env.example

diff --git a/.env.example b/.env.example
new file mode 100644
index 0000000..aea6aa6
--- /dev/null
+++ b/.env.example
@@ -0,0 +1,6 @@
+# Copy to .env and fill in your values.
+# Get your token: admin panel → Company → API tab → Company token
+
+ETHICA_TOKEN=paste-your-company-token-here
+ETHICA_HOME=https://ethica.no
+# ETHICA_INTERVAL=60
diff --git a/.gitignore b/.gitignore
index 025ddc6..4b8a2e0 100644
--- a/.gitignore
+++ b/.gitignore
@@ -1,3 +1,4 @@
 ethica-agent.yml
+.env
 __pycache__/
 *.pyc
diff --git a/docker-compose.example.yml b/docker-compose.example.yml
index 799dbed..6da3221 100644
--- a/docker-compose.example.yml
+++ b/docker-compose.example.yml
@@ -3,5 +3,6 @@ services:
     image: ethica-agent:latest
     build: .
     restart: unless-stopped
+    env_file: .env               # ETHICA_TOKEN, ETHICA_HOME, ETHICA_INTERVAL
     volumes:
       - ./ethica-agent.yml:/config/ethica-agent.yml:ro
diff --git a/ethica-agent.example.yml b/ethica-agent.example.yml
index e418888..6fedd3e 100644
--- a/ethica-agent.example.yml
+++ b/ethica-agent.example.yml
@@ -1,9 +1,13 @@
 # Ethica Agent configuration
-# Get your token from the admin panel: Company → API tab → Company token
+#
+# Token (required): set via ETHICA_TOKEN env var (recommended) or here.
+# Get it from: admin panel → Company → API tab → Company token
+#
+# token: REPLACE_ME          ← or set ETHICA_TOKEN in .env / environment
+# home: https://ethica.no   ← or set ETHICA_HOME  (default: https://ethica.no)
+# interval: 60               ← or set ETHICA_INTERVAL (seconds, default: 60)
 
-token: REPLACE_ME
-home: https://ethica.no
-interval: 60        # seconds between collection runs
+interval: 60
 
 widgets:
 
diff --git a/ethica-agent.py b/ethica-agent.py
index d1457ab..823a75c 100644
--- a/ethica-agent.py
+++ b/ethica-agent.py
@@ -309,14 +309,18 @@ def main():
         print(f"Config not found: {args.config}", file=sys.stderr)
         sys.exit(1)
 
-    token = cfg.get("token", "")
-    home = cfg.get("home", "https://ethica.no")
-    interval = int(cfg.get("interval", 60))
-    widgets = cfg.get("widgets", [])
+    # Env vars override config file — keeps secrets out of the yml.
+    # ETHICA_TOKEN  : company API token  (required)
+    # ETHICA_HOME   : home URL           (optional, default https://ethica.no)
+    # ETHICA_INTERVAL: collection interval in seconds (optional)
+    token    = os.environ.get("ETHICA_TOKEN")    or cfg.get("token", "")
+    home     = os.environ.get("ETHICA_HOME")     or cfg.get("home", "https://ethica.no")
+    interval = int(os.environ.get("ETHICA_INTERVAL") or cfg.get("interval", 60))
+    widgets  = cfg.get("widgets", [])
 
     if not token or token == "REPLACE_ME":
-        print("Set 'token' in your config (Company → API in the admin panel).",
-              file=sys.stderr)
+        print("Set ETHICA_TOKEN env var or 'token' in config "
+              "(Company → API tab in the admin panel).", file=sys.stderr)
         sys.exit(1)
     if not widgets:
         print("No widgets configured — nothing to do.", file=sys.stderr)