# Copy to .env and replace example hosts and provider values. No administrator or token is preconfigured.
APPOPS_AUTH_PUBLIC_URL=https://app.example.com
APPOPS_FRONTEND_ORIGIN=https://app.example.com
# Set one explicit first-admin bootstrap only; see the Human access section in README.md.
APPOPS_AUTH_ADMIN_EMAILS=
APPOPS_AUTH_ADMIN_SUBJECTS=

# Native Authentik OIDC; register https://app.example.com/api/auth/callback/authentik.
APPOPS_AUTHENTIK_ISSUER=https://auth.example.com/application/o/appops/
APPOPS_AUTHENTIK_ENTRA_SOURCE=
APPOPS_AUTHENTIK_CLIENT_ID=
APPOPS_AUTHENTIK_CLIENT_SECRET_FILE=/data/authentik-oidc-secret

# Optional direct Entra OIDC; the tenant value must be a specific tenant UUID.
APPOPS_ENTRA_TENANT_ID=
APPOPS_ENTRA_CLIENT_ID=
APPOPS_ENTRA_CLIENT_SECRET_FILE=/data/entra-oidc-secret

# Optional Authentik outpost identity; trust only its exact peer network and protect the backend port.
APPOPS_OPERATOR_PROXY_AUTH=false
APPOPS_OPERATOR_PROXY_TRUSTED_NETWORKS=

# Create these protected files under ./data before production use.
APPOPS_SECRET_KEY_FILE=/data/secret-key