# Copy this file to .env and fill in the values.
# .env is gitignored — never commit secrets.

# ── UOA (UnlikeOtherAuthenticator) ──────────────────────────────────────────
UOA_BASE_URL=https://authentication.unlikeotherai.com
UOA_DOMAIN=<this server's public domain>
UOA_SHARED_SECRET=<from UOA dashboard — HS256 signing key for config JWT and token verification>
UOA_AUDIENCE=auth.unlikeotherai.com
UOA_CONFIG_URL=https://<domain>/auth/uoa-config
UOA_REDIRECT_URL=https://<domain>/auth/callback

# Set automatically on first login — do not set manually.
# UOA_OWNER_SUB=<first user's UOA sub, persisted to DB after first login>

# ── PostgreSQL ───────────────────────────────────────────────────────────────
POSTGRES_PASSWORD=<postgres-password-if-you-run-compose-local-postgres>
DATABASE_URL=postgres://silkie:password@localhost:5432/silkie?sslmode=disable

# ── Redis ────────────────────────────────────────────────────────────────────
REDIS_URL=redis://localhost:6379

# ── Internal session signing ─────────────────────────────────────────────────
# Separate from UOA_SHARED_SECRET. Generate: openssl rand -base64 64
INTERNAL_SESSION_SECRET=<hs256-key-for-internal-jwts>

# ── coturn (TURN relay) ──────────────────────────────────────────────────────
TURN_HOST=<coturn host>
TURN_PORT=3478
# HMAC secret shared with coturn (use-auth-secret mode). Generate: openssl rand -base64 32
COTURN_SECRET=<coturn-static-auth-secret>

# ── WireGuard overlay ────────────────────────────────────────────────────────
WG_OVERLAY_CIDR=10.100.0.0/16
WG_INTERFACE_NAME=wg0
WG_SERVER_PUBLIC_KEY=<server wg public key — wg genkey | wg pubkey>
WG_SERVER_ENDPOINT=<server public IP or hostname>
WG_SERVER_PORT=51820

# ── Server ───────────────────────────────────────────────────────────────────
SERVER_PORT=8080
LOG_LEVEL=info

# ── Policy (optional) ───────────────��───────────────────────────────────────��
# OPA endpoint for policy evaluation. Leave empty for allow-all mode.
# OPA_ENDPOINT=http://localhost:8181

# ── Observability (optional) ─────────────────────────────────────���───────────
# OTLP gRPC endpoint. Leave empty to disable telemetry.
# OTEL_EXPORTER_OTLP_ENDPOINT=localhost:4317