example.env

# Step-CA Configuration
CA_URL=https://ca.home:9000
CA_ROOT_FINGERPRINT=your-ca-root-fingerprint-here
PROVISIONER_NAME=ui-admin
PROVISIONER_PASSWORD=your-provisioner-password-here

# Application Configuration
DB_PATH=./data/certs.db
PORT=8080

# Security (both optional, but recommended for anything reachable beyond
# localhost -- see the README's Security Notes section)
#
# API_AUTH_TOKEN: if set, every /api/* request to the backend must send it
# as `Authorization: Bearer <token>`. Generate one with, e.g.:
#   openssl rand -hex 32
# Leave blank to leave the API unauthenticated (the previous behavior).
# NOTE: the frontend needs the SAME value in NEXT_PUBLIC_API_AUTH_TOKEN
# below to keep working. Like NEXT_PUBLIC_API_URL, this is a genuine
# runtime variable -- changing it and recreating the frontend container is
# enough, no rebuild required (frontend/docker-entrypoint.sh substitutes
# it in at container start). It's also shipped in the frontend's
# client-side JS bundle, so treat it as a shared secret between the two
# containers, not as real user authentication.
API_AUTH_TOKEN=
# CORS_ALLOWED_ORIGIN: the one origin the backend accepts browser requests
# from. Defaults to http://localhost:3000 if unset; change this if you
# access the frontend at a different host/port.
CORS_ALLOWED_ORIGIN=http://localhost:3000

# Frontend Configuration
# Both of these are genuine runtime variables -- changing either one and
# recreating the frontend container (docker compose up -d, or Dockhand's
# "save and redeploy"/"force recreate") is enough. No rebuild required.
NEXT_PUBLIC_API_URL=http://localhost:8080
NEXT_PUBLIC_API_AUTH_TOKEN=