# public domains routed by Synology Reverse Proxy to 172.22.0.222:9918
CMS_DOMAIN=cms.dcserve.ru
CMS_AUTH_DOMAIN=auth.dcserve.ru
CMS_AUTH_ADMIN_DOMAIN=auth-admin.dcserve.ru
CMS_PUBLIC_URL=https://cms.dcserve.ru
CMS_AUTH_PUBLIC_URL=https://auth.dcserve.ru
CMS_AUTH_ADMIN_PUBLIC_URL=https://auth-admin.dcserve.ru
CMS_HTTP_BIND=172.22.0.222:9918
CMS_AUTH_HTTP_BIND=172.22.0.222:9919
CMS_AUTH_ADMIN_HTTP_BIND=127.0.0.1:9920
CMS_EXTERNAL_SCHEME=https

# mounted NODE.DC site root on Synology
CMS_NODEDC_SITE_PATH=/volume1/docker/dc-cms/sites/nodedc

# authentik image
AUTHENTIK_IMAGE=ghcr.io/goauthentik/server
AUTHENTIK_TAG=2026.2.2
AUTHENTIK_ERROR_REPORTING__ENABLED=false
AUTHENTIK_LISTEN__TRUSTED_PROXY_CIDRS=127.0.0.0/8,172.16.0.0/12

# authentik database
PG_DB=authentik
PG_USER=authentik
PG_PASS=replace-with-random-secret

# authentik first-start bootstrap
AUTHENTIK_SECRET_KEY=replace-with-random-secret
AUTHENTIK_BOOTSTRAP_EMAIL=dcctouch@gmail.com
AUTHENTIK_BOOTSTRAP_PASSWORD=replace-with-temporary-password
AUTHENTIK_BOOTSTRAP_TOKEN=replace-with-random-token

# CMS bootstrap user. Used by infra/scripts/bootstrap-authentik.sh.
CMS_BOOTSTRAP_ADMIN_EMAIL=dcctouch@gmail.com
CMS_BOOTSTRAP_ADMIN_PASSWORD=replace-with-temporary-password
CMS_BOOTSTRAP_ADMIN_NAME=DCTOUCH CMS Admin

# CMS OIDC application. bootstrap-authentik.sh creates the matching provider.
CMS_AUTH_ENABLED=true
CMS_BASE_URL=https://cms.dcserve.ru
CMS_OIDC_ISSUER=https://auth.dcserve.ru/application/o/dc-cms/
CMS_OIDC_CLIENT_ID=dc-cms
CMS_OIDC_CLIENT_SECRET=replace-with-random-secret
CMS_OIDC_REDIRECT_URI=https://cms.dcserve.ru/auth/callback
CMS_OIDC_LOGGED_OUT_REDIRECT_URI=https://cms.dcserve.ru/auth/logged-out
CMS_LOGOUT_URI=https://cms.dcserve.ru/auth/logout
CMS_REQUIRED_GROUPS=dc-cms:owner,dc-cms:admin,dc-cms:editor,dc-cms:publisher

# CMS app session
CMS_SESSION_SECRET=replace-with-random-secret
COOKIE_DOMAIN=
COOKIE_SECURE=true