.env.example

# DATABASE
POSTGRES_USER=servasec
POSTGRES_PASSWORD=servasec
POSTGRES_DB=servasec-db
SSC_SEED_DATABASE=true
POSTGRES_VERSION=17

# IMAGES
# Containers are pulled from registry.gitlab.com by default (no local build).
# SSC_IMAGE_TAG: image tag to pull. "latest" tracks the main branch, or pin a
# release (e.g. 2.4.3). The install script sets this from the release it ships.
SSC_IMAGE_TAG=latest
# Pro:
# `docker login registry.gitlab.com`
#   registry.gitlab.com/servasec/servasec-pro/backend
SSC_BACKEND_IMAGE=registry.gitlab.com/servasec/servasec/backend

# APP CONFIG
SSC_SITE_NAME="servasec"
SSC_PUBLIC_URL="https://servasec.local"
SSC_PUBLIC_DOMAIN="servasec.local"
SSC_REGISTRATION_ENABLED=true
SSC_DEBUG_ENABLED=false
SSC_ADMIN_PASSWORD="Admin1234!"
SSC_LICENSE_KEY=

# MULTI-TENANT / EDGE
SSC_CONTAINER_PREFIX=
SSC_EDGE_MODE=false
CADDY_HTTP_BIND=0.0.0.0:80
CADDY_HTTPS_BIND=0.0.0.0:443
SSC_NETWORK_PUBLIC_SUBNET=172.70.1.0/24
SSC_NETWORK_PRIVATE_SUBNET=172.70.2.0/24
TRUSTED_PROXIES_CIDR=

# SECURITY
# All secrets must be at least 32 bytes (256 bits).
# Use: openssl rand -base64 32  (generates a 44-char base64 string)
JWT_SECRET=changeme-jwt-secret-min-32-bytes-long
REFRESH_SECRET=changeme-refresh-secret-min-32-bytes
CSRF_SECRET=XdVef60a020AETD9043f00514c598fcP
SSC_FEATURES_ENCRYPTION_KEY=changeme-encryption-key-min-32-bytes

# DOCKER USER (set to your host UID:GID to avoid root-owned files)
# USER_UID=1000
# USER_GID=1000
# Or use: make dev (handles it automatically)



# SSO / SOCIAL LOGIN (leave empty to disable each provider)
# SSO_GITHUB_CLIENT_ID=
# SSO_GITHUB_CLIENT_SECRET=
# SSO_GITLAB_CLIENT_ID=
# SSO_GITLAB_CLIENT_SECRET=
# SSO_GITLAB_BASE_URL=              # optional, for self-hosted GitLab
# SSO_OIDC_CLIENT_ID=
# SSO_OIDC_CLIENT_SECRET=
# SSO_OIDC_ISSUER_URL=              # ex: https://my-keycloak.example.com/realms/master
# SSO_OIDC_SCOPES=openid profile email