.env-template

# Local development environment for `docker compose`.
# Copy this file to `.env` (gitignored) and fill in real values before
# running `docker compose up`. The api and oauth2 services load it via
# `env_file: .env` (see docker-compose.yml).

# --- API auth toggle -------------------------------------------------------
# 1 = enforce JWT validation against the Entra ID tenant below.
# 0 = bypass auth entirely; the API treats every request as the built-in
#     `nologin` user. Handy for offline dev, never for shared envs.
AUTH_ENABLED=1

# --- Entra ID (Azure AD) tenant + app registration ------------------------
# Provisioned by IaC/app-registration.bicep — run:
#     mise run iac:appreg <env>     # env = dev | test | prod
# The task creates two app registrations (API + oauth2-proxy BFF) and
# prints the GUIDs to paste below.
AZURE_TENANT_ID=00000000-0000-0000-0000-000000000000
OAUTH_CLIENT_ID=00000000-0000-0000-0000-000000000000
OAUTH_AUDIENCE=api://00000000-0000-0000-0000-000000000000
OAUTH_AUTH_SCOPE=api://00000000-0000-0000-0000-000000000000/user_impersonation

# --- Entra ID endpoints (derived from AZURE_TENANT_ID) --------------------
# Standard Microsoft v2.0 endpoints. Override only for non-public clouds.
OAUTH_WELL_KNOWN=https://login.microsoftonline.com/${AZURE_TENANT_ID}/v2.0/.well-known/openid-configuration
OAUTH_TOKEN_ENDPOINT=https://login.microsoftonline.com/${AZURE_TENANT_ID}/oauth2/v2.0/token
OAUTH_AUTH_ENDPOINT=https://login.microsoftonline.com/${AZURE_TENANT_ID}/oauth2/v2.0/authorize

# --- oauth2-proxy (BFF) ----------------------------------------------------
# Comma-separated allowlist of email domains accepted at sign-in. Use `*`
# to allow any verified email; leave restrictive for shared deployments.
OAUTH2_PROXY_EMAIL_DOMAINS=example.com

# --- Application Insights (optional) --------------------------------------
# Full connection string (`InstrumentationKey=...;IngestionEndpoint=...`)
# from the Azure Monitor / App Insights resource. Leave empty to disable
# telemetry locally; the OpenTelemetry exporter is a no-op when unset.
APPINSIGHTS_CONSTRING=