first commit

.env.example

@@ -0,0 +1,19 @@
+# Public URL the app is reachable at (used for OIDC redirect_uri and cookie behavior).
+APP_BASE_URL=https://schedule.example.lan
+
+# Random long string used to sign session cookies. Generate with:
+#   node -e "console.log(require('crypto').randomBytes(32).toString('hex'))"
+SESSION_SECRET=change-me-to-a-random-64-char-hex-string
+
+# Port docker-compose publishes on the host (container always listens on 3000).
+HOST_PORT=3000
+
+# --- Authentik OIDC application/provider ---
+# Create an OAuth2/OIDC "Provider" in Authentik with:
+#   Redirect URI: <APP_BASE_URL>/auth/callback
+#   Scopes: openid, email, profile
+# then create an "Application" using that provider, and assign the users/groups
+# who should be able to sign in. Copy the provider's values below.
+AUTHENTIK_ISSUER_URL=https://authentik.example.lan/application/o/schedule-task-manager/
+AUTHENTIK_CLIENT_ID=
+AUTHENTIK_CLIENT_SECRET=