auth:
  # Set false to require OIDC and disable username/password login.
  password_enabled: true
  username: "replace-me"
  # Generate with `docker compose run --rm starry-cloud gen-auth`.
  password_hash: "replace-me"
  # Set a long random value here or provide SECRET_KEY in the environment.
  secret_key: "replace-me"
  session_days: 30
  secure_cookie: true

  # Optional OpenID Connect provider. Set enabled: true and use the callback
  # URL https://your-dashboard.example.com/login/oidc/callback at the provider.
  oidc:
    enabled: false
    # Button label becomes "Continue with <provider_name>" (default: OIDC).
    provider_name: "Example Identity"
    discovery_url: "https://identity.example.com/.well-known/openid-configuration"
    client_id: "replace-me"
    client_secret: "replace-me"
    scope: "openid email profile"
    # When non-empty, only these verified email addresses may sign in.
    allowed_emails: []