# resume stack secrets — injected into all services via env_file.
# Var names are exactly what each container reads (no ${VAR} interpolation).
# Components are duplicated into composites (DATABASE_URL embeds
# POSTGRES_PASSWORD; STORAGE_* mirror MINIO_*) — keep them in sync on rotation.

# postgres
POSTGRES_PASSWORD=postgres

# minio (resume-minio service)
MINIO_ROOT_USER=minioadmin
MINIO_ROOT_PASSWORD=minioadmin
MINIO_OIDC_CLIENT_ID=1jC2ChsCjdh7srOKtr9Jzv1l2RF8omrzshEpAESa
MINIO_IDENTITY_OPENID_CLIENT_ID=1jC2ChsCjdh7srOKtr9Jzv1l2RF8omrzshEpAESa
MINIO_OIDC_CLIENT_SECRET=66KML3RcsdcStPO6FIe04cCRyLTztfUDdHcpkIVImUO6WTTHkAFtao4GfZYu9yq4NvFGWxztTv7M8uGZBi4xaVUtJr3K3GU47pLaaWwF1WMsidsRTy760QUJxsUq3i9C
MINIO_IDENTITY_OPENID_CLIENT_SECRET=66KML3RcsdcStPO6FIe04cCRyLTztfUDdHcpkIVImUO6WTTHkAFtao4GfZYu9yq4NvFGWxztTv7M8uGZBi4xaVUtJr3K3GU47pLaaWwF1WMsidsRTy760QUJxsUq3i9C

# browserless chrome auth token (chrome reads TOKEN, the app reads PRINTER_TOKEN)
TOKEN=chrome_token
PRINTER_TOKEN=chrome_token

# reactive-resume app
DATABASE_URL=postgresql://postgres:postgres@postgres:5432/postgres
STORAGE_ACCESS_KEY=minioadmin
STORAGE_SECRET_KEY=minioadmin
# Auth/JWT signing secret for Reactive Resume.
# Pinned to the running value so recreating the container keeps sessions valid.
# Rotate with: openssl rand -hex 64
AUTH_SECRET=1b7e96f61f080d04d4bf673d9ea1d9349eb7693cddee5772b6c3f153c88032db5b97efd8570087bc6f340d2cd874aabc1e5c681bc22889921240d6a23738bc7f
OAUTH_CLIENT_ID=YpMFNp9q5mGbN8ADM5rUol0ERHmSiTDClJKIVOxK
OAUTH_CLIENT_SECRET=mzwjSt0Xtibo156km61T7VYerT48K6ZTa79cEek4mgdky6t1Sjaddlshw2QcJL8727N6qWzddi2ihxNGSpUVMXUBbjNgx4jtkHAy5xtmvqdk9ouIFclyhCgXh9fzjMCA