# Copy to deploy/.env on the host and fill in. Never commit the real file:
# this repository is public, and a password hash in git can be attacked offline.
#
# CHUCODATA_SECRET_KEY signs the admin session cookie. Keep it stable, or every
# signed-in device is signed out on the next deploy:
#   python3 -c "import secrets; print(secrets.token_hex(32))"
CHUCODATA_SECRET_KEY=
# The password hash does NOT go here. A Werkzeug hash uses '$' as its field
# separator, and Compose interpolates $VAR inside a project .env file, which
# removes the salt from the middle of the hash and leaves a value that is
# well-formed, non-empty and wrong. It goes in a file in the data volume:
#
#   printf %s 'the-password' | docker exec -i chucodata python -c \
#     "import sys; from werkzeug.security import generate_password_hash as g; print(g(sys.stdin.read()))" \
#     > /home/ben/chucodata-data/admin_password_hash
#   chmod 600 /home/ben/chucodata-data/admin_password_hash
#
# Override the location with CHUCODATA_ADMIN_HASH_FILE. CHUCODATA_ADMIN_PASSWORD_HASH is
# still honoured as a fallback for non-Compose deployments.