# Copy to deploy/.env, restrict it (chmod 600), and fill in. deploy/.env is git-ignored
# and never goes into an image. How it reaches sahaquiel is decided when the server is
# set up (e.g. rendered from Proton Pass on the deploying machine and copied over SSH,
# so the server itself never holds Proton credentials).

# `http://localhost` for the local rehearsal; `learn.halkyon.eu` on sahaquiel.
DOMAIN=http://localhost

# Postgres password, shared by the postgres and server services.
# Generate: openssl rand -base64 32
POSTGRES_PASSWORD=

# Pepper for hashing session keys (server-side sessions). NEVER change it once
# sessions exist: everyone would be signed out, and anonymous accounts can't sign
# back in. Rotation only via fallbackSessionKeyHashPeppers.
# Generate: openssl rand -base64 32
SESSION_KEY_HASH_PEPPER=