APP_NAME=NexaMFA
ENVIRONMENT=prod
PUBLIC_BASE_URL=https://mfa.example.com
CORS_ORIGINS=https://mfa-admin.example.com

POSTGRES_DB=nexamfa
POSTGRES_USER=nexamfa
POSTGRES_PASSWORD=replace-with-a-long-random-password
DATABASE_URL=postgresql+asyncpg://nexamfa:replace-with-a-long-random-password@postgres:5432/nexamfa
REDIS_URL=redis://redis:6379/0

ADMIN_TOKEN=replace-with-a-long-random-admin-token

OIDC_ISSUER=https://mfa.example.com
OIDC_CLIENT_ID=authentik
OIDC_CLIENT_SECRET=replace-with-a-long-random-oidc-secret
OIDC_REDIRECT_URIS=https://authentik.example.com/application/o/nexamfa/callback/
# Generate a persistent RSA key and paste the PEM as a single-line escaped value or Docker secret.
# OIDC_SIGNING_KEY_PEM=

CHALLENGE_TTL_SECONDS=60
ENROLLMENT_TTL_SECONDS=600
ACCESS_TOKEN_TTL_SECONDS=300
AUTH_CODE_TTL_SECONDS=120
RATE_LIMIT_DEFAULT=120/minute
RATE_LIMIT_APPROVE=12/minute

FCM_PROJECT_ID=your-firebase-project-id
# Store the Firebase service account JSON as a secret in production.
FCM_SERVICE_ACCOUNT_JSON=