NODE_ENV=production
PORT=3000

# Postgres — the app connects with these discrete fields (not a DATABASE_URL),
# so POSTGRES_PASSWORD can safely contain any character without needing
# URL-encoding. Only POSTGRES_PASSWORD needs to be set; the rest already
# match the "postgres" service in docker-compose.yml.
POSTGRES_PASSWORD=changeme
# PGHOST=postgres
# PGPORT=5432
# PGDATABASE=octane
# PGUSER=octane

# Sessions
SESSION_SECRET=change-me-to-a-long-random-string

# Set to true to test locally without a real Authentik instance:
# /auth/login shows a simple form to pick a test name instead of redirecting to OIDC.
# NEVER set this to true outside local development.
DEV_BYPASS_AUTH=false

# Authentik OIDC (not needed if DEV_BYPASS_AUTH=true)
# Prefer Authentik's internal container name/port over traefik-proxy (avoids a
# round trip through Traefik); falls back to the public URL if you don't know it.
AUTHENTIK_ISSUER_URL=http://authentik-server:9000/application/o/octane-website/
OIDC_CLIENT_ID=
OIDC_CLIENT_SECRET=
OIDC_REDIRECT_URI=https://octane.dandrove.com/auth/callback
ADMIN_GROUP_NAME=octane-admins

# Docker networking: external network shared with Traefik and Authentik
TRAEFIK_NETWORK_NAME=traefik-proxy

# Public hostname Traefik routes to this app (used in docker-compose.yml labels)
APP_DOMAIN=octane.dandrove.com

# Only used by docker-compose.dev.yml (local testing without Traefik)
APP_PORT=3000

# Optional — auto-fill YouTube/Spotify links when adding a song from the
# title/artist autocomplete (which itself needs no key, it uses Apple's free
# iTunes Search API). Leave blank to skip auto-fill and enter links by hand;
# see README "Recherche automatique de morceaux" for how to obtain these.
SPOTIFY_CLIENT_ID=
SPOTIFY_CLIENT_SECRET=
YOUTUBE_API_KEY=