From 5a550e45940f76c908e802e76d5ade936a48cf88 Mon Sep 17 00:00:00 2001
From: lilly <li@lly.sh>
Date: Fri, 15 May 2026 08:39:59 +0200
Subject: [PATCH] document configuration variables in README.md

---
 README.md                      | 19 +++++++++++++++++++
 api/src/dooris_api/__init__.py |  2 +-
 2 files changed, 20 insertions(+), 1 deletion(-)

diff --git a/README.md b/README.md
index c152cf1..f83e55d 100644
--- a/README.md
+++ b/README.md
@@ -10,6 +10,25 @@ Project structure:
 └── app # Web UI
 ```
 
+## Configuration
+
+The final application can be configured either via CLI arguments or via environment variables.
+If both are given, the CLI flag takes precedence.
+
+THe following table lists all available configuration parameters:
+
+| CLI Flag | Environment Variable | Required? | Default Value |
+| -------- | -------------------- | :-------: | ------------- |
+| `--openid-issuer` | `DOORIS_OPENID_ISSUER` | Yes | *None*   |
+| `--openid-scope`  | `DOORIS_OPENID_SCOPE`  | No  | `openid profile` |
+| `--openid-client-id` | `DOORIS_OPENID_CLIENT_ID` | Yes | *None* |
+| `--openid-client-secret` | `DOORIS_OPENID_CLIENT_SECRET` | Yes | *None* |
+| `--base-url` | `DOORIS_BASE_URL` | Yes | *None* |
+| `--serve-static` | `DOORIS_SERVE_STATIC` | No | *None* |
+| `--ccujack-url` | `DOORIS_CCUJACK_URL` | No | `https://hmdooris-ccu.ccchh.net:2122` |
+| `--ccujack-user` | `DOORIS_CCUJACK_USER` | Yes | *None* |
+| `--ccujack-password` | `DOORIS_CCUJACK_PASSWORD` | Yes | *None* |
+
 ## API Development
 
 Most things should automatically be set up with the included [direnv script](./.envrc.dist) but if you don't use that, take the following steps:
diff --git a/api/src/dooris_api/__init__.py b/api/src/dooris_api/__init__.py
index c155426..cd488a6 100644
--- a/api/src/dooris_api/__init__.py
+++ b/api/src/dooris_api/__init__.py
@@ -19,7 +19,7 @@ def main():
     )
     argp.add_argument(
         "--openid-scope",
-        default=os.environ.get("DOORIS_OPENID_SCOPE", "openid profile ccchh-roles"),
+        default=os.environ.get("DOORIS_OPENID_SCOPE", "openid profile"),
         help="The Keycloak OpenID isser to use for authentication",
     )
     argp.add_argument(