.env.example

# Generated by setup.sh — do not commit the real .env file
# Copy this to .env and fill in values, or run ./setup.sh to auto-generate.

# === Auth Service ===
PORT=8080
NATS_JWT_EXPIRY=2h

# === NATS ===
# Account scoped signing key seed (starts with SA). Signs user JWTs; the scope
# template on this key supplies per-user permissions via the account tag.
AUTH_SCOPED_SIGNING_KEY=SAXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX

# === OIDC / Keycloak ===
# Uses Docker service name (auth-service runs inside Docker network).
# For host-based dev, change to http://localhost:9090/realms/chatapp
OIDC_ISSUER_URL=http://keycloak:8080/realms/chatapp
# Comma-separated list of acceptable `aud` values.
OIDC_AUDIENCES=nats-chat

# Skip TLS cert verification for OIDC issuer (dev only — self-signed certs)
TLS_SKIP_VERIFY=false