NODE_ENV=production
PORT=3000

# Postgres
DATABASE_URL=postgres://octane:changeme@postgres:5432/octane
POSTGRES_PASSWORD=changeme

# Sessions
SESSION_SECRET=change-me-to-a-long-random-string

# Set to true to test locally without a real Authentik instance:
# /auth/login shows a simple form to pick a test name instead of redirecting to OIDC.
# NEVER set this to true outside local development.
DEV_BYPASS_AUTH=false

# Authentik OIDC (not needed if DEV_BYPASS_AUTH=true)
# Prefer Authentik's internal container name/port over traefik-proxy (avoids a
# round trip through Traefik); falls back to the public URL if you don't know it.
AUTHENTIK_ISSUER_URL=http://authentik-server:9000/application/o/octane-website/
OIDC_CLIENT_ID=
OIDC_CLIENT_SECRET=
OIDC_REDIRECT_URI=https://octane.dandrove.com/auth/callback
ADMIN_GROUP_NAME=octane-admins

# Docker networking: external network shared with Traefik and Authentik
TRAEFIK_NETWORK_NAME=traefik-proxy

# Public hostname Traefik routes to this app (used in docker-compose.yml labels)
APP_DOMAIN=octane.dandrove.com

# Only used by docker-compose.dev.yml (local testing without Traefik)
APP_PORT=3000