Publish curated Unraid-AppOps-Gateway source from 034c9f844d2455850ba37b31379b7edaa786583e

.env.example

@@ -1,3 +1,24 @@
-APPOPS_OPERATOR_TOKEN=
-APPOPS_SECRET_KEY=
-# Generate both independently: python -c "import secrets; print(secrets.token_urlsafe(48))"
+# Copy to .env and replace example hosts and provider values. No administrator or token is preconfigured.
+APPOPS_AUTH_PUBLIC_URL=https://app.example.com
+APPOPS_FRONTEND_ORIGIN=https://app.example.com
+# Set one explicit first-admin bootstrap only; see the Human access section in README.md.
+APPOPS_AUTH_ADMIN_EMAILS=
+APPOPS_AUTH_ADMIN_SUBJECTS=
+
+# Native Authentik OIDC; register https://app.example.com/api/auth/callback/authentik.
+APPOPS_AUTHENTIK_ISSUER=https://auth.example.com/application/o/appops/
+APPOPS_AUTHENTIK_ENTRA_SOURCE=
+APPOPS_AUTHENTIK_CLIENT_ID=
+APPOPS_AUTHENTIK_CLIENT_SECRET_FILE=/data/authentik-oidc-secret
+
+# Optional direct Entra OIDC; the tenant value must be a specific tenant UUID.
+APPOPS_ENTRA_TENANT_ID=
+APPOPS_ENTRA_CLIENT_ID=
+APPOPS_ENTRA_CLIENT_SECRET_FILE=/data/entra-oidc-secret
+
+# Optional Authentik outpost identity; trust only its exact peer network and protect the backend port.
+APPOPS_OPERATOR_PROXY_AUTH=false
+APPOPS_OPERATOR_PROXY_TRUSTED_NETWORKS=
+
+# Create these protected files under ./data before production use.
+APPOPS_SECRET_KEY_FILE=/data/secret-key