# FamilySync — environment variable reference
# Copy to .env and fill in real values. .env is gitignored and must never be committed.
#
# Deployment: these vars are injected into the Docker Compose `api` service via
# the `environment:` block in docker-compose.yml. All values are resolved at
# container start time from the host .env file.

# ── MariaDB ───────────────────────────────────────────────────────────────────
DB_PASSWORD=change_me_strong_password
DB_ROOT_PASSWORD=change_me_root_password

# ── OIDC / Authelia ───────────────────────────────────────────────────────────
# Authorization code + PKCE flow (client_secret_basic). See CLAUDE.md §Authelia.
OIDC_AUTH_SECRET=change_me_32_char_secret_minimum
OIDC_ISSUER=https://auth.example.com
OIDC_CLIENT_ID=familysync
OIDC_CLIENT_SECRET=change_me_client_secret
OIDC_REDIRECT_URI=https://familysync.example.com/callback
OIDC_AUTH_EXTERNAL_URL=https://auth.example.com
# Scopes granted by the Authelia client definition (must include offline_access for
# refresh-token session persistence).
OIDC_SCOPES=openid profile email offline_access

# ── App-password encryption ───────────────────────────────────────────────────
# 32-byte hex key used to AES-256-GCM encrypt Fastmail app passwords at rest.
# Generate: node -e "console.log(require('crypto').randomBytes(32).toString('hex'))"
APP_PASSWORD_ENCRYPTION_KEY=change_me_64_hex_chars

# ── VAPID — Web Push notifications (Phase 5) ─────────────────────────────────
# Generate a keypair (one-time, per deployment):
#   npx web-push generate-vapid-keys --json
# VAPID_PUBLIC_KEY  is served to the PWA at GET /api/push/vapid-public-key (no secret).
# VAPID_PRIVATE_KEY signs push messages — treat as a secret; never commit it.
# VAPID_SUBJECT     is a contact URL (mailto: or https:) sent to push services.
VAPID_PUBLIC_KEY=replace_with_url_safe_base64_public_key
VAPID_PRIVATE_KEY=replace_with_url_safe_base64_private_key
VAPID_SUBJECT=mailto:admin@familysync.example.com