# The shared secret users type into the login form. Compared with a
# constant-time check - not stored as a hash since it's a single app-wide
# gate, not a per-user credential store.
ACCESS_PASSWORD=change-me

# Signing key for the session JWT. Deliberately separate from
# ACCESS_PASSWORD - reusing the login password as the signing key would let a
# JWT-signing weakness leak the login secret itself. Generate one with:
#   openssl rand -base64 32
AUTH_SECRET=change-me-too-at-least-16-chars

# Path to the SQLite database file. In Docker this should point inside the
# ./data bind mount so it survives container restarts.
DATABASE_PATH=./data/app.db

# debug | info | warn | error (default: debug in development, info in production)
LOG_LEVEL=info

# --- Compose-level only ---
# Docker Compose reads this same file for ${...} substitution in
# docker-compose.yml (Traefik labels, network name) - these aren't read by
# the app itself.
TRAEFIK_HOST=sexy.example.com
NETWORK_NAME=compose_network