.env.example

# =============================================================================
# SSO Stack — Environment Variables
# Copy to .env and fill ALL required values before running.
# =============================================================================

# Shared domain (from root .env)
DOMAIN=yourdomain.com
TZ=Asia/Shanghai

# Authentik domain (default: auth.yourdomain.com)
AUTHENTIK_DOMAIN=auth.${DOMAIN}

# REQUIRED: Generate with: openssl rand -base64 32
AUTHENTIK_SECRET_KEY=

# REQUIRED: Strong random passwords
AUTHENTIK_POSTGRES_PASSWORD=
AUTHENTIK_REDIS_PASSWORD=

# Bootstrap admin account (created on first boot)
AUTHENTIK_BOOTSTRAP_EMAIL=admin@yourdomain.com
AUTHENTIK_BOOTSTRAP_PASSWORD=

# OAuth2 client credentials — filled by scripts/setup-authentik.sh
GRAFANA_OAUTH_CLIENT_ID=
GRAFANA_OAUTH_CLIENT_SECRET=
GITEA_OAUTH_CLIENT_ID=
GITEA_OAUTH_CLIENT_SECRET=
OUTLINE_OAUTH_CLIENT_ID=
OUTLINE_OAUTH_CLIENT_SECRET=