# Enter these variables in Container Manager when creating the container.
# Use the NAS LAN IP (or a reachable bridge gateway), never container localhost.
DB_HOST=10.0.0.200
DB_PORT=3306
DB_NAME=model_delivery
DB_USER=model_app
DB_PASSWORD=REPLACE_WITH_DATABASE_PASSWORD

# Your final Web Station HTTPS origin; no subdirectory.
APP_URL=https://deliveries.example.com
# Separate HTTPS admin origin, restricted to your LAN, targeting port 38081.
ADMIN_URL=https://deliveries-admin.example.com
COOKIE_SECURE=true

# Generate two independent secrets. Preserve the encryption key with DB backups.
TOKEN_ENCRYPTION_KEY=REPLACE_WITH_32_RANDOM_BYTES_IN_BASE64
LOCAL_ADMIN_SETUP_TOKEN=REPLACE_WITH_RANDOM_SETUP_CODE

# Optional: configure SSO here, or through the guarded administration page.
OIDC_ISSUER=
OIDC_DISCOVERY_URL=
OIDC_CLIENT_ID=
OIDC_CLIENT_SECRET=
OIDC_SCOPES=openid groups
# OIDC_REDIRECT_URI defaults to APP_URL + /api/auth/callback.
# APP_ORIGINS defaults to APP_URL and ADMIN_URL. Both can be overridden explicitly.
# Stored SSO settings in MariaDB take precedence over initial OIDC_* variables.