From f72f830b36116e1c4bfadeffa92a4ed336ed93fd Mon Sep 17 00:00:00 2001
From: lilly <li@lly.sh>
Date: Fri, 15 May 2026 08:36:49 +0200
Subject: [PATCH 1/2] api: configure ccujack connection via established config
 mechanism

---
 .dev.env                       |  1 +
 api/src/dooris_api/__init__.py | 18 ++++++++++++++++++
 api/src/dooris_api/app.py      |  4 ++--
 3 files changed, 21 insertions(+), 2 deletions(-)

diff --git a/.dev.env b/.dev.env
index a1a7c4d..eb77b35 100644
--- a/.dev.env
+++ b/.dev.env
@@ -2,3 +2,4 @@ DOORIS_OPENID_ISSUER=https://id.hamburg.ccc.de/realms/test/
 DOORIS_OPENID_CLIENT_ID=dooris
 DOORIS_OPENID_CLIENT_SECRET=dp9HhnvUhAtKm3pRnxfGA7q8Nwrd1td8
 DOORIS_BASE_URL=http://localhost:8000
+DOORIS_CCUJACK_USER=dooris
diff --git a/api/src/dooris_api/__init__.py b/api/src/dooris_api/__init__.py
index 5e684af..c155426 100644
--- a/api/src/dooris_api/__init__.py
+++ b/api/src/dooris_api/__init__.py
@@ -46,6 +46,24 @@ def main():
         default=os.environ.get("DOORIS_SERVE_STATIC", None),
         help="In addition to the API functionality, serve static files from this path",
     )
+    argp.add_argument(
+        "--ccujack-url",
+        required=False,
+        default=os.environ.get("DOORIS_CCUJACK_URL", "https://hmdooris-ccu.ccchh.net:2122"),
+        help="The URL under which a CCUJACK instance is hosted that actually operates the locks",
+    )
+    argp.add_argument(
+        "--ccujack-user",
+        required="DOORIS_CCUJACK_USER" not in os.environ,
+        default=os.environ.get("DOORIS_CCUJACK_USER", None),
+        help="The username used to authenticate against the CCUJACK",
+    )
+    argp.add_argument(
+        "--ccujack-password",
+        required="DOORIS_CCUJACK_PASSWORD" not in os.environ,
+        default=os.environ.get("DOORIS_CCUJACK_PASSWORD", None),
+        help="The password used to authenticate against the CCUJACK"
+    )
     args = argp.parse_args()
 
     app_config.set(args)
diff --git a/api/src/dooris_api/app.py b/api/src/dooris_api/app.py
index f4b54ee..3bcd848 100644
--- a/api/src/dooris_api/app.py
+++ b/api/src/dooris_api/app.py
@@ -37,8 +37,8 @@ async def lifespan(app: FastAPI):
     )
 
     app.extra["ccujack"] = CCUJackClient(
-        "https://hmdooris-ccu.ccchh.net:2122",
-        auth=BasicAuth("dooris", os.environ["HMDOORIS_PW"]),
+        base_uri=app_cfg.ccujack_url,
+        auth=BasicAuth(app_cfg.ccujack_user, app_cfg.ccujack_password)
     )
     await app.extra["ccujack"].find_locks()
 

From 5a550e45940f76c908e802e76d5ade936a48cf88 Mon Sep 17 00:00:00 2001
From: lilly <li@lly.sh>
Date: Fri, 15 May 2026 08:39:59 +0200
Subject: [PATCH 2/2] document configuration variables in README.md

---
 README.md                      | 19 +++++++++++++++++++
 api/src/dooris_api/__init__.py |  2 +-
 2 files changed, 20 insertions(+), 1 deletion(-)

diff --git a/README.md b/README.md
index c152cf1..f83e55d 100644
--- a/README.md
+++ b/README.md
@@ -10,6 +10,25 @@ Project structure:
 └── app # Web UI
 ```
 
+## Configuration
+
+The final application can be configured either via CLI arguments or via environment variables.
+If both are given, the CLI flag takes precedence.
+
+THe following table lists all available configuration parameters:
+
+| CLI Flag | Environment Variable | Required? | Default Value |
+| -------- | -------------------- | :-------: | ------------- |
+| `--openid-issuer` | `DOORIS_OPENID_ISSUER` | Yes | *None*   |
+| `--openid-scope`  | `DOORIS_OPENID_SCOPE`  | No  | `openid profile` |
+| `--openid-client-id` | `DOORIS_OPENID_CLIENT_ID` | Yes | *None* |
+| `--openid-client-secret` | `DOORIS_OPENID_CLIENT_SECRET` | Yes | *None* |
+| `--base-url` | `DOORIS_BASE_URL` | Yes | *None* |
+| `--serve-static` | `DOORIS_SERVE_STATIC` | No | *None* |
+| `--ccujack-url` | `DOORIS_CCUJACK_URL` | No | `https://hmdooris-ccu.ccchh.net:2122` |
+| `--ccujack-user` | `DOORIS_CCUJACK_USER` | Yes | *None* |
+| `--ccujack-password` | `DOORIS_CCUJACK_PASSWORD` | Yes | *None* |
+
 ## API Development
 
 Most things should automatically be set up with the included [direnv script](./.envrc.dist) but if you don't use that, take the following steps:
diff --git a/api/src/dooris_api/__init__.py b/api/src/dooris_api/__init__.py
index c155426..cd488a6 100644
--- a/api/src/dooris_api/__init__.py
+++ b/api/src/dooris_api/__init__.py
@@ -19,7 +19,7 @@ def main():
     )
     argp.add_argument(
         "--openid-scope",
-        default=os.environ.get("DOORIS_OPENID_SCOPE", "openid profile ccchh-roles"),
+        default=os.environ.get("DOORIS_OPENID_SCOPE", "openid profile"),
         help="The Keycloak OpenID isser to use for authentication",
     )
     argp.add_argument(