# floci-api config (packages/api)
FLOCI_ENDPOINT=http://localhost:4566
FLOCI_AZURE_ENDPOINT=http://localhost:4577
FLOCI_AZURE_ACCOUNT_NAME=devstoreaccount1
FLOCI_AZURE_SUBSCRIPTION_ID=00000000-0000-0000-0000-000000000000
FLOCI_AZURE_RESOURCE_GROUP=floci-local
VITE_MOCK_MODE=false
AWS_REGION=us-east-1
AWS_ACCESS_KEY_ID=test
AWS_SECRET_ACCESS_KEY=test
PORT=4501

# Console authentication. Generate a hash with:
#   cd packages/api && bun run scripts/hash-password.ts 'choose-a-long-password'
FLOCI_UI_ADMIN_USER=admin
FLOCI_UI_ADMIN_PASSWORD_HASH=
# At least 32 random characters, for example: openssl rand -base64 48
FLOCI_UI_SESSION_SECRET=
FLOCI_UI_SESSION_IDLE_TIMEOUT_SECONDS=1800
FLOCI_UI_SESSION_ABSOLUTE_TIMEOUT_SECONDS=28800
# Set false only for local HTTP development. Keep true behind HTTPS reverse proxies.
FLOCI_UI_SECURE_COOKIES=true
# Reverse proxies (IPs or CIDRs, comma-separated) allowed to report the client address
# via X-Forwarded-For. Required behind Nginx Proxy Manager, otherwise every visitor
# shares the proxy's address for sign-in throttling. Leave empty when exposed directly.
# FLOCI_UI_TRUSTED_PROXIES=192.168.1.10

# Optional Authentik / OIDC mode. These are server-only values.
# FLOCI_UI_AUTH_MODE=oidc
# FLOCI_UI_OIDC_ISSUER=https://authentik.example.com/application/o/the-cloud
# FLOCI_UI_OIDC_CLIENT_ID=
# FLOCI_UI_OIDC_CLIENT_SECRET=
# FLOCI_UI_PUBLIC_BASE_URL=https://thecloud.example.com
# OIDC mode refuses to start without an allow-list (comma-separated). Group names come
# from the `groups` claim; emails must also be verified by the identity provider.
# FLOCI_UI_OIDC_ALLOWED_GROUPS=thecloud-admins
# FLOCI_UI_OIDC_ALLOWED_EMAILS=
# FLOCI_UI_OIDC_ALLOW_ALL_USERS=false