.env.example

# Runtime
APP_ENV=development
PIP_INDEX_URL=https://pypi.tuna.tsinghua.edu.cn/simple
LOGTO_PUBLIC_ENDPOINT=http://localhost:3001
LOGTO_INTERNAL_ENDPOINT=http://logto:3001
# Pinned custom image built from deployment/logto/Dockerfile.custom. To roll back
# to the official UI, set LOGTO_IMAGE=ghcr.io/logto-io/logto:1.33.0.
LOGTO_UPSTREAM_VERSION=1.33.0
LOGTO_IMAGE=lingxi-logto:1.33.0-experience
LOGTO_ISSUER=http://localhost:3001/oidc
LOGTO_MANAGEMENT_API_INDICATOR=https://default.logto.app/api
LOGTO_ADMIN_ENDPOINT=
LOGTO_TRUST_PROXY_HEADER=0

# PostgreSQL
POSTGRES_USER=lingxi
POSTGRES_PASSWORD=change-me-in-development
POSTGRES_DB=logto
POSTGRES_PORT=5432
LINGXI_DATABASE_URL=postgresql+asyncpg://lingxi:change-me-in-development@postgres:5432/lingxi

# BFF
BFF_PUBLIC_URL=http://localhost:8080
BFF_WEB_PUBLIC_URL=
BFF_DEFAULT_NEXT_PATH=/
BFF_HOST=0.0.0.0
# Host-published Docker Compose port only. The BFF container itself always
# listens on 8080; production may safely set this to 8081 to avoid a web-port clash.
BFF_PORT=8080
BFF_LOG_LEVEL=INFO
BFF_ALLOWED_ORIGINS=http://localhost:8080
# host.docker.internal is required when another Compose project reaches this
# BFF through the Docker host gateway. Keep the public identity host as well.
BFF_ALLOWED_HOSTS=localhost,127.0.0.1,host.docker.internal,identity.lingxilearn.cn
SESSION_COOKIE_NAME=lingxi_session
SESSION_COOKIE_SECURE=false
SESSION_TTL_SECONDS=28800
SESSION_REFRESH_SKEW_SECONDS=120
SESSION_COOKIE_DOMAIN=
SESSION_COOKIE_PATH=/
VERIFICATION_RECORD_TTL_SECONDS=600
# Generate with: python -c "from cryptography.fernet import Fernet; print(Fernet.generate_key().decode())"
SESSION_ENCRYPTION_KEY=MDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDA=

# OIDC web application created by bootstrap. Keep server-side only.
OIDC_CLIENT_ID=
OIDC_CLIENT_SECRET=
OIDC_SCOPES=openid profile email offline_access roles urn:logto:scope:organizations urn:logto:scope:organization_roles
OIDC_RESOURCE=https://id.lingxi.dev/admin
OIDC_REDIRECT_PATH=/auth/callback

# Management M2M. Never expose these values to a browser.
LOGTO_M2M_CLIENT_ID=
LOGTO_M2M_CLIENT_SECRET=
LOGTO_M2M_CLIENT_SECRET_FILE=
LOGTO_M2M_SCOPE=all

# Bootstrap-only seed credentials. Prefer *_FILE in production.
BOOTSTRAP_SEED_CLIENT_ID=
BOOTSTRAP_SEED_CLIENT_SECRET=
BOOTSTRAP_ADMIN_EMAIL=admin@example.com
BOOTSTRAP_ADMIN_PASSWORD=
BOOTSTRAP_OUTPUT_FILE=/out/bootstrap.env
BOOTSTRAP_ORGANIZATION_NAME=Lingxi

# Stable Lingxi claims namespace and API resource identifiers.
LINGXI_CLAIMS_NAMESPACE=https://lingxi.dev/claims/
LINGXI_ADMIN_RESOURCE=https://id.lingxi.dev/admin
LINGXI_GRAPH_RESOURCE=https://graph.lingxi.dev/api
LINGXI_LEARN_RESOURCE=https://learn.lingxi.dev/api
# Optional exact redirect URI for the public LingxiLearn SPA.
LINGXI_LEARN_WEB_REDIRECT_URI=