# domains
CMS_DOMAIN=cms.local.nodedc
CMS_AUTH_DOMAIN=cms-auth.local.nodedc
CMS_AUTH_ADMIN_DOMAIN=cms-auth-admin.local.nodedc
CMS_PUBLIC_URL=http://cms.local.nodedc:8210
CMS_AUTH_PUBLIC_URL=http://cms-auth.local.nodedc:8210
CMS_AUTH_ADMIN_PUBLIC_URL=http://cms-auth-admin.local.nodedc:8210
CMS_HTTP_BIND=127.0.0.1:8210
CMS_AUTH_HTTP_BIND=127.0.0.1:8211
CMS_AUTH_ADMIN_HTTP_BIND=127.0.0.1:8212
CMS_EXTERNAL_SCHEME=http

# mounted NODE.DC site for local development
CMS_NODEDC_SITE_PATH=../../NODEDC_SITE

# authentik image
AUTHENTIK_IMAGE=ghcr.io/goauthentik/server
AUTHENTIK_TAG=2026.2.2
AUTHENTIK_ERROR_REPORTING__ENABLED=false
AUTHENTIK_LISTEN__TRUSTED_PROXY_CIDRS=127.0.0.0/8,172.16.0.0/12

# authentik database
PG_DB=authentik
PG_USER=authentik
PG_PASS=replace-with-random-secret

# authentik first-start bootstrap
AUTHENTIK_SECRET_KEY=replace-with-random-secret
AUTHENTIK_BOOTSTRAP_EMAIL=dcctouch@gmail.com
AUTHENTIK_BOOTSTRAP_PASSWORD=replace-with-temporary-password
AUTHENTIK_BOOTSTRAP_TOKEN=replace-with-random-token

# CMS bootstrap user. Applied automatically by the authentik-bootstrap compose service.
CMS_BOOTSTRAP_ADMIN_EMAIL=dcctouch@gmail.com
CMS_BOOTSTRAP_ADMIN_PASSWORD=replace-with-temporary-password
CMS_BOOTSTRAP_ADMIN_NAME=DCTOUCH CMS Admin
CMS_BOOTSTRAP_FORCE_PASSWORD=false

# CMS OIDC application. The authentik-bootstrap compose service creates the matching provider.
CMS_AUTH_ENABLED=true
CMS_BASE_URL=http://cms.local.nodedc:8210
CMS_OIDC_ISSUER=http://cms-auth.local.nodedc:8210/application/o/dc-cms/
CMS_OIDC_INTERNAL_BASE_URL=http://authentik-server:9000
CMS_OIDC_CLIENT_ID=dc-cms
CMS_OIDC_CLIENT_SECRET=replace-with-random-secret
CMS_OIDC_REDIRECT_URI=http://cms.local.nodedc:8210/auth/callback
CMS_OIDC_LOGGED_OUT_REDIRECT_URI=http://cms.local.nodedc:8210/auth/logged-out
CMS_LOGOUT_URI=http://cms.local.nodedc:8210/auth/logout
CMS_REQUIRED_GROUPS=dc-cms:owner,dc-cms:admin,dc-cms:editor,dc-cms:publisher

# CMS app session
CMS_SESSION_SECRET=replace-with-random-secret
COOKIE_DOMAIN=
COOKIE_SECURE=false