# Local configuration for `npm run dev`. deploy/zitadel/provision.ps1 fills in
# the Zitadel values; in Docker the same variables come from deploy/compose.yml.

# Zitadel OIDC (server-side auth)
ZITADEL_ISSUER=http://host.docker.internal:8080
ZITADEL_CLIENT_ID=your-web-app-client-id
ZITADEL_CLIENT_SECRET=your-web-app-client-secret

# Where Zitadel redirects back after login (must be registered in the app)
AUTH_REDIRECT_URI=http://localhost:5173/auth/callback
AUTH_POST_LOGOUT_URI=http://localhost:5173/

# Secret used to derive the session cookie encryption key (any long random string)
SESSION_SECRET=change-me-to-a-long-random-string

# Backend API base URL
API_BASE_URL=http://localhost:5111

# Optional session tuning (defaults shown)
# OIDC_SCOPE=openid profile email offline_access
# SESSION_TTL_SECONDS=604800
# SESSION_REFRESH_THRESHOLD_SECONDS=30
# AUTH_FLOW_TTL_SECONDS=600

# Dev already allows a plain-HTTP issuer. Set this only to allow it in a production build (never with a public issuer).
# AUTH_ALLOW_INSECURE_HTTP=true

# Where to send presigned S3 PUTs when the public S3 host is not reachable from
# the server (in Docker: http://seaweedfs:8333). The signed Host header is kept
# either way. Defaults to the host in the presigned URL.
# S3_UPLOAD_ENDPOINT=http://localhost:8333