25 lines
1.1 KiB
Bash
25 lines
1.1 KiB
Bash
# Copy to .env and replace example hosts and provider values. No administrator or token is preconfigured.
|
|
APPOPS_AUTH_PUBLIC_URL=https://app.example.com
|
|
APPOPS_FRONTEND_ORIGIN=https://app.example.com
|
|
# Set one explicit first-admin bootstrap only; see the Human access section in README.md.
|
|
APPOPS_AUTH_ADMIN_EMAILS=
|
|
APPOPS_AUTH_ADMIN_SUBJECTS=
|
|
|
|
# Native Authentik OIDC; register https://app.example.com/api/auth/callback/authentik.
|
|
APPOPS_AUTHENTIK_ISSUER=https://auth.example.com/application/o/appops/
|
|
APPOPS_AUTHENTIK_ENTRA_SOURCE=
|
|
APPOPS_AUTHENTIK_CLIENT_ID=
|
|
APPOPS_AUTHENTIK_CLIENT_SECRET_FILE=/data/authentik-oidc-secret
|
|
|
|
# Optional direct Entra OIDC; the tenant value must be a specific tenant UUID.
|
|
APPOPS_ENTRA_TENANT_ID=
|
|
APPOPS_ENTRA_CLIENT_ID=
|
|
APPOPS_ENTRA_CLIENT_SECRET_FILE=/data/entra-oidc-secret
|
|
|
|
# Optional Authentik outpost identity; trust only its exact peer network and protect the backend port.
|
|
APPOPS_OPERATOR_PROXY_AUTH=false
|
|
APPOPS_OPERATOR_PROXY_TRUSTED_NETWORKS=
|
|
|
|
# Create these protected files under ./data before production use.
|
|
APPOPS_SECRET_KEY_FILE=/data/secret-key
|