# Template for deploy/prod/.env
# Copy to .env and fill in the values:  cp .env-template .env
# The .env file itself is git-ignored (it holds secrets).

# --- Database / Keycloak passwords ---
REMSLY_PSQL_PASSWORD=
REMSLY_PSQL_ADMIN_PASSWORD=
KC_PSQL_PASSWORD=
KC_ADMIN_PASSWORD=

# --- Tailscale ---
# Reusable, tag:server pre-authorized auth key from the Tailscale admin console.
TS_AUTHKEY=
TS_DNS_NAME=

# --- Apache OIDC (mod_auth_openidc) ---
OIDC_CRYPTO_PASSPHRASE=
OIDC_CLIENT_SECRET=

# --- Elasticsearch ---
ELASTIC_PASSWORD=

# --- Backend ---
# Keycloak client id (resource) the bearer-only backend expects.
KEYCLOAK_RESOURCE=

# --- Gitea registry (used by deploy.sh to download config.tar.gz) ---
# User + access token with package read scope for gitea.tail276105.ts.net.
GITEA_USER=
GITEA_TOKEN=
