# cp .env.example .env — Compose reads it from this directory.
# Back the finished .env up with the database: without ENCRYPTION_KEY the
# stored notes cannot be read again.

# Both:  openssl rand -hex 32
JWT_SECRET=
ENCRYPTION_KEY=

# The first administrator. There is no public sign-up — every other account is
# created in the app under Account → Administration. Used only until an admin
# exists, then ignored, so they can never reset anything later.
INKNOTE_ADMIN_USER=
INKNOTE_ADMIN_PASSWORD=

# Where the notes are kept on the host. Defaults to /srv/inknote in production
# and ./data for development — leave it commented unless you want another path,
# since one .env serves both. Create the directory first, or Docker creates it
# as root and the server (uid 1000) cannot write:
#   mkdir -p /srv/inknote/{db,uploads} && chown -R 1000:1000 /srv/inknote
# INKNOTE_DATA_DIR=/srv/inknote
#
# Under /root also run "chmod o+x /root", or the server cannot reach it at all.
# That and the alternative: readme.md → Where the data lives.

# ── Optional ── unset keeps the default shown
# INKNOTE_MAX_IMAGE_MB=25           # pasted images
# INKNOTE_MAX_PDF_MB=200            # imported PDFs, limited separately
# INKNOTE_UID=1000                  # must own INKNOTE_DATA_DIR
# INKNOTE_GID=1000
# MAX_VERSIONS_PER_NOTE=50           # default; each notebook can set its own
# VERSION_RETENTION_DAYS=            # off: versions expire by count, not by age
# VERSION_COALESCE_MINUTES=5
# ALLOWED_ORIGINS=                  # only if the UI is on another host

# ── Signing in through an identity provider (OpenID Connect) ──
# Optional. Leave the four empty and the app is password-only; set all four and
# the sign-in screen offers the provider as well. The password login stays in
# either case — an unreachable provider must not lock anybody out of their own
# notes. Somebody who signs in this way and has no account here yet gets one
# (never an administrator: that is granted in the app, on purpose).
#
# In PocketID: a new OIDC client, redirect URI exactly
#   https://<your-inknote-host>/api/auth/oidc/callback
# The *server container* has to reach the issuer itself, not just your browser.
#
# The first sign-in binds an identity to an account of the same name here, so
# this trusts the provider's usernames. Right for a provider whose names are set
# by its own administrator; wrong for one where people pick their own.
# INKNOTE_PUBLIC_URL=https://notes.example.com
# INKNOTE_OIDC_ISSUER=https://id.example.com
# INKNOTE_OIDC_CLIENT_ID=
# INKNOTE_OIDC_CLIENT_SECRET=
# INKNOTE_OIDC_LABEL=PocketID        # what the button says: "Continue with …"
# INKNOTE_OIDC_SCOPES=openid profile email
# INKNOTE_OIDC_REDIRECT_URI=         # only if it is not <public url>/api/auth/oidc/callback