idk

ansible/plays/machine_setup/templates/grist.env.j2

@@ -0,0 +1,19 @@
+# Managed by Ansible (grist.yml) - secrets sourced from Infisical via
+# `infisical run -- ansible-playbook ...`.
+#
+# Consumed by docker compose for variable substitution in docker-compose.yml,
+# and loaded directly into the Grist container via env_file.
+
+APP_HOME_URL=https://{{ grist_hostname }}
+GRIST_IN_SERVICE=true
+GRIST_SESSION_SECRET={{ grist_session_secret }}
+
+# OIDC via Authelia - client must be registered there with redirect URI
+# https://{{ grist_hostname }}/oauth2/callback
+GRIST_OIDC_IDP_ISSUER=https://{{ grist_oidc_issuer_host }}
+GRIST_OIDC_IDP_CLIENT_ID={{ grist_oidc_client_id }}
+GRIST_OIDC_IDP_CLIENT_SECRET={{ grist_oidc_client_secret }}
+
+# Authelia's OIDC discovery doc doesn't advertise end_session_endpoint, so
+# Grist must be told not to call it on logout.
+GRIST_OIDC_IDP_SKIP_END_SESSION_ENDPOINT=true