.env.example

# Database
DATABASE_URL="postgresql://chorus:chorus@localhost:5432/chorus"

# NextAuth
NEXTAUTH_URL="http://localhost:3000"
NEXTAUTH_SECRET="your-secret-key-change-in-production"

# Super Admin (bootstrap config for managing Companies and global settings)
# Super admin email
SUPER_ADMIN_EMAIL="admin@example.com"
# Super admin password hash (bcrypt), generate with:
# node -e "console.log(require('bcrypt').hashSync('your-password', 10))"
SUPER_ADMIN_PASSWORD_HASH="$2b$10$..."

# Note: OIDC configuration has been moved to the database (Company table).
# Each Company has its own OIDC config. Only PKCE is supported (no Client Secret).
# Super admin configures OIDC for each Company via the admin panel.

# Redis (optional — falls back to in-memory EventBus when unset)
# Required for multi-instance SSE event propagation
# Format: redis://[username:password@]host:port
REDIS_URL="redis://default:chorus-redis@localhost:6379"

# Default User Auth (simple login without OIDC)
DEFAULT_USER="dev@chorus.local"
DEFAULT_PASSWORD="chorus123"

# Cookie Security
# Set to "false" to disable secure cookies (for HTTP-only deployments)
# WARNING: Only use in trusted internal networks, as cookies will be sent over unencrypted HTTP
# COOKIE_SECURE="false"