# Managed by Ansible (grist.yml) - secrets sourced from Infisical via
# `infisical run -- ansible-playbook ...`.
#
# Consumed by docker compose for variable substitution in docker-compose.yml,
# and loaded directly into the Grist container via env_file.

APP_HOME_URL=https://{{ grist_hostname }}
GRIST_IN_SERVICE=true
GRIST_SESSION_SECRET={{ grist_session_secret }}

# OIDC via Authelia - client must be registered there with redirect URI
# https://{{ grist_hostname }}/oauth2/callback
GRIST_OIDC_IDP_ISSUER=https://{{ grist_oidc_issuer_host }}
GRIST_OIDC_IDP_CLIENT_ID={{ grist_oidc_client_id }}
GRIST_OIDC_IDP_CLIENT_SECRET={{ grist_oidc_client_secret }}

# Authelia's OIDC discovery doc doesn't advertise end_session_endpoint, so
# Grist must be told not to call it on logout.
GRIST_OIDC_IDP_SKIP_END_SESSION_ENDPOINT=true