# Copy this file to .env and replace both values before production use.
# Generate each value independently; never commit your real .env file.
JWT_SECRET=replace-with-a-unique-random-value-of-at-least-32-characters
SESSION_SECRET=replace-with-a-different-random-value-of-at-least-32-characters

# Optional: required before local accounts can enable authenticator-app 2FA.
# Generate and preserve a third independent value. Changing or losing it makes
# existing TOTP enrollments unusable; keep it with the deployment backup.
# TOTP_ENCRYPTION_KEY=replace-with-a-third-unique-random-value-of-at-least-32-characters

# Optional: force secure cookies when HTTPS terminates before the application.
# Leave unset for automatic detection, or set to true/false if required.
# AUTH_COOKIE_SECURE=true
# APP_ORIGIN=https://nodecast.example.com

# Optional: public URL path when reverse proxying below a subpath.
# NODECAST_BASE_PATH=/nodecast

# Optional: permit loopback media sources such as http://127.0.0.1.
# Private LAN addresses remain supported without this setting.
# ALLOW_LOCAL_MEDIA_URLS=true

# Optional: seconds to wait per transcoding attempt for the first HLS playlist.
# Accepts a whole number from 1 to 300. The default is 15.
# TRANSCODE_START_TIMEOUT_SECONDS=15

# Optional OpenID Connect / SSO settings.
# OIDC_ISSUER_URL=https://identity.example.com/application/o/nodecast/
# OIDC_CLIENT_ID=replace-with-client-id
# OIDC_CLIENT_SECRET=replace-with-client-secret
# OIDC_CALLBACK_URL=https://nodecast.example.com/api/auth/oidc/callback
# When NODECAST_BASE_PATH=/nodecast, use:
# OIDC_CALLBACK_URL=https://nodecast.example.com/nodecast/api/auth/oidc/callback

# Optional sign-in mode. Complete initial setup and verify an SSO administrator
# before disabling local sign-in. Automatic redirect can be used independently.
# DISABLE_LOCAL_AUTH=false
# OIDC_AUTO_REDIRECT=false