AUTH_SECRET=change-me-to-a-long-random-string

# Public URL of this app (important behind reverse proxies / Docker)
# Example: http://localhost:3000 or https://rfid.example.com
# AUTH_URL=http://localhost:3000
# AUTH_TRUST_HOST=true

# Optional: path to SQLite file (default ./data/rfid.db)
# RFID_DB_PATH=./data/rfid.db

# Docker Compose published port (default 3000)
# RFID_PORT=3000

# Optional first-boot user when using Docker entrypoint
# CREATE_USER_EMAIL=admin@lab.local
# CREATE_USER_PASSWORD=changeme
# CREATE_USER_NAME=Admin

# Optional OIDC (Authentik, Keycloak, Authelia, Google, etc.)
# Setting these three enables the "Sign in with SSO" button automatically
# (no NEXT_PUBLIC_* flag needed).
#
# In your IdP, create a confidential OIDC client with redirect URI:
#   {AUTH_URL}/api/auth/callback/oidc
# e.g. http://localhost:3000/api/auth/callback/oidc
#
# AUTH_OIDC_ISSUER must be the issuer that serves
#   {issuer}/.well-known/openid-configuration
# Authentik example: https://sso.example.com/application/o/rfid/
# Keycloak example:  https://sso.example.com/realms/myrealm
#
# AUTH_OIDC_ISSUER=https://sso.example.com/application/o/rfid/
# AUTH_OIDC_CLIENT_ID=
# AUTH_OIDC_CLIENT_SECRET=
# AUTH_OIDC_NAME=Authentik