.env.example

# Core runtime settings
DATABASE_URL=file:./data/choreography.db
# Public URL of your app — required for SvelteKit CSRF protection and better-auth callbacks/redirects.
ORIGIN=http://localhost:3000
PORT=3000
LOG_LEVEL=info

# Container runtime ownership for bind-mounted files (Unraid/Linux hosts)
PUID=1000
PGID=1000

# ── Better Auth ────────────────────────────────────────────────────────────
# Required for all auth modes. Must be at least 32 characters.
BETTER_AUTH_SECRET=change-me-in-production-must-be-at-least-32-chars!!

# Authentication mode: local | oidc | both  (default: local)
AUTH_MODE=local

# ── OIDC / Generic SSO (required when AUTH_MODE=oidc or AUTH_MODE=both) ───
# OIDC_ISSUER=https://your-idp.example.com
# OIDC_CLIENT_ID=your-client-id
# OIDC_CLIENT_SECRET=your-client-secret

# Claim from the OIDC user-info response used to match existing local accounts.
# Default: email
# OIDC_ACCOUNT_CLAIM=email

# Display label shown on the OIDC sign-in button.
# Default: Single Sign-On
# OIDC_ISSUER_LABEL=Single Sign-On

# Policy when an OIDC sign-in has no matching local account:
#   deny     — block sign-in and show guidance (default, recommended)
#   provision — create a new auth user/account and complete sign-in
# OIDC_ZERO_MATCH_POLICY=deny

# ── Optional build-time inputs (Docker builder stage only) ──────────────────
# Use only when the build environment needs non-default SSR bootstrap values.
# Do NOT put real production secrets in build args.
# BUILD_ORIGIN=http://localhost:3000
# BUILD_AUTH_MODE=local
# BUILD_BETTER_AUTH_SECRET=build-time-placeholder-secret-at-least-32-characters