# Public URL the app is reachable at (used for OIDC redirect_uri and cookie behavior).
APP_BASE_URL=https://schedule.example.lan

# Random long string used to sign session cookies. Generate with:
#   node -e "console.log(require('crypto').randomBytes(32).toString('hex'))"
SESSION_SECRET=change-me-to-a-random-64-char-hex-string

# Port docker-compose publishes on the host (container always listens on 3000).
HOST_PORT=3000

# --- Authentik OIDC application/provider ---
# Create an OAuth2/OIDC "Provider" in Authentik with:
#   Redirect URI: <APP_BASE_URL>/auth/callback
#   Scopes: openid, email, profile
# then create an "Application" using that provider, and assign the users/groups
# who should be able to sign in. Copy the provider's values below.
AUTHENTIK_ISSUER_URL=https://authentik.example.lan/application/o/schedule-task-manager/
AUTHENTIK_CLIENT_ID=
AUTHENTIK_CLIENT_SECRET=