# Local development only. Copy to .env and set your own passwords.
DB_HOST=127.0.0.1
DB_PORT=3307
DB_NAME=model_delivery
DB_USER=model_app
DB_PASSWORD=change-me-local-app
DB_ROOT_PASSWORD=change-me-local-root
API_HOST=127.0.0.1
API_PORT=3001
LOG_LEVEL=info
# Local HTTP only; set true with trusted HTTPS deployment.
COOKIE_SECURE=false
APP_ORIGINS=http://localhost:5173,http://127.0.0.1:5173,http://localhost:4173,http://127.0.0.1:4173
# Generate locally: node -e "console.log(require('crypto').randomBytes(32).toString('base64'))"
TOKEN_ENCRYPTION_KEY=
# One-time setup code for /local-admin; choose a random long value. Never commit it.
LOCAL_ADMIN_SETUP_TOKEN=
# Optional initial SSO settings; the guarded local-admin UI can override these.
OIDC_ISSUER=
OIDC_DISCOVERY_URL=
OIDC_CLIENT_ID=
OIDC_CLIENT_SECRET=
OIDC_REDIRECT_URI=http://localhost:5173/api/auth/callback
OIDC_SCOPES=openid
# Only permits HTTP on loopback for the automated OIDC test provider.
OIDC_ALLOW_HTTP=false
# Optional AD display-name lookup is disabled by default. Configure its internal
# LDAPS URL, base DN, domain, read account/password and CA at /local-admin.
# Directory credentials use TOKEN_ENCRYPTION_KEY and are stored only in MariaDB.