# GWS Backup — Docker environment
#
# Copy to .env beside docker-compose.yml, fill in the two secrets, and keep a
# copy of this file somewhere safe. ENCRYPTION_KEY in particular is not
# recoverable: it decrypts every stored client credential, and without it those
# credentials cannot be read back by any means.

# Encrypts client credentials at rest. Generate ONCE and never change it on a
# live install:
#
#   openssl rand -hex 32
#
ENCRYPTION_KEY=

# Signs login sessions. Changing it only signs everyone out — it is not a data
# key, so it is safe to rotate:
#
#   openssl rand -base64 32
#
NEXTAUTH_SECRET=

# The public address this console is reached on, with https://. Only the Google
# Drive destination uses it (Google's sign-in comes back here), so leave it unset
# only if you reach the console directly on the address below.
#   NEXTAUTH_URL=https://vault-k7x93q.example.com
NEXTAUTH_URL=

# Host port to publish the console on. Change if 3000 is taken.
GWSB_PORT=3000

# Which release to run. Pin it to a version so an update is a decision you make,
# rather than something that happens the next time the container restarts. To
# update: change it to the new version, then docker compose pull && docker compose up -d.
GWSB_VERSION=1.00

# Only if you were given a different licence server address.
LICENSE_SERVER_URL=