# Copy to .env and fill in.

# 32 random bytes in base64, e.g.: node -e "console.log(require('crypto').randomBytes(32).toString('base64'))"
# Losing it makes all stored access keys unreadable.
KEY_ENCRYPTION_SECRET=

# Created (or promoted) as superadmin on start.
SUPERADMIN_EMAIL=
# Group of that superadmin if it has to be created.
SUPERADMIN_GROUP=default

# The reverse proxy strips /api and sends X-Forwarded-Prefix: /api.
#   public /api/admin/*  (Authelia)  ->  /admin/*
#   public /api/*        (no auth)   ->  /*
# Public API URL for key QR codes. Optional: derived from X-Forwarded-Proto/Host/Prefix when empty.
# PUBLIC_API_URL=https://dev.aggtaa.com/api

# Optional extra protection: when set, /admin/* requires the header X-Cardy-Proxy-Secret with this value.
# Configure the reverse proxy to add it on the /api/admin route. Recommended if HOST is not loopback.
# ADMIN_PROXY_SECRET=

DATA_DIR=./data
# Loopback by default: /admin/* trusts Remote-Email, so only the local reverse proxy may connect.
HOST=127.0.0.1
PORT=10002