# monitoring stack secrets — injected via env_file; container-exact var names.
# Homarr config encryption key. Generate with: openssl rand -hex 32
SECRET_ENCRYPTION_KEY=98989838bf06c9e42d77944ce848963a22ab316b55a09b0d199652ef0934394f
# Auth.js session/state signing — required for OIDC (openssl rand -base64 32)
AUTH_SECRET=7Kp2mN9xQvR4sT6wY8zA1bC3dE5fG0hJ2kL4nM6pS8uV0xZ=

# Homarr native OIDC via Authentik (replaces forward_auth + credentials login)
AUTH_PROVIDERS=oidc
AUTH_OIDC_ISSUER=https://auth.ginnoir.com/application/o/homarr/
AUTH_OIDC_CLIENT_ID=u5XiQcEenMoo3cViXOw3OWt644m2AMsbUXNpInqu
AUTH_OIDC_CLIENT_SECRET=PTnXULynOv7HreiqnCmAWOc9vy81gyA57NIS7rxJnBc8g6WeD7fo4d5kWoK54U3QodMrTXVAtT6GoTcqJznEONQDzeZXGe25fZAbcQNtOdgpLakoLKHP1aVU2jJ2nkOR
AUTH_OIDC_CLIENT_NAME=Authentik
AUTH_OIDC_AUTO_LOGIN=true
AUTH_OIDC_ENABLE_DANGEROUS_ACCOUNT_LINKING=true
AUTH_OIDC_SCOPE_OVERWRITE=openid email profile
AUTH_OIDC_GROUPS_ATTRIBUTE=groups
AUTH_OIDC_FORCE_USERINFO=true
AUTH_OIDC_NAME_ATTRIBUTE_OVERWRITE=name
AUTH_LOGOUT_REDIRECT_URL=https://auth.ginnoir.com/application/o/homarr/end-session/