# Copy to ../.env next to docker-compose.yml and fill in.
# Back this file up together with the database: without ENCRYPTION_KEY the
# stored notes cannot be read again.

# Signs session tokens. Changing it logs everyone out.
#   openssl rand -hex 32
JWT_SECRET=

# Encrypts note bodies at rest. LOSING THIS MEANS LOSING THE NOTES.
# Must be exactly 32 bytes as hex.
#   openssl rand -hex 32
ENCRYPTION_KEY=

# The first administrator.
#
# There is no public sign-up — accounts are created by an admin inside the app
# under Account → Administration. These two settle who the first one is:
#
#   empty database   → the account is created from both values
#   existing users,  → INKNOTE_ADMIN_USER names which of them becomes admin.
#   no admin yet       Without it, the oldest account is promoted.
#   an admin exists  → both are ignored entirely
#
# So they can never reset an existing password or take rights away; the worst
# they can do on a running instance is nothing.
INKNOTE_ADMIN_USER=
INKNOTE_ADMIN_PASSWORD=

# ── Optional ──
# PORT=4000
# ALLOWED_ORIGINS=            # only if the UI is served from another host
# MAX_VERSIONS_PER_NOTE=50
# VERSION_RETENTION_DAYS=90
# VERSION_COALESCE_MINUTES=5