42 lines
1.4 KiB
Text
42 lines
1.4 KiB
Text
|
# Copy to .env and fill in. .env is gitignored.
|
||
|
|
# Local-dev values shown; for production use the https URLs.
|
||
|
|
|
||
|
|
# OIDC issuer (Authelia)
|
||
|
|
ISSUER_URL=https://auth.maisym.com
|
||
|
|
|
||
|
|
# OIDC client — must match the client registered in Authelia
|
||
|
|
OIDC_CLIENT_ID=hsa-tracker
|
||
|
|
OIDC_CLIENT_SECRET=<plaintext from secret.sh — the one you saved>
|
||
|
|
|
||
|
|
# Where Authelia redirects back. Must be registered in the client's redirect_uris.
|
||
|
|
# Local dev:
|
||
|
|
REDIRECT_URL=http://localhost:8080/callback
|
||
|
|
# Production would be: https://hsa.maisym.com/callback
|
||
|
|
|
||
|
|
# Group that gates access (403 if the user isn't in it)
|
||
|
|
REQUIRED_GROUP=hsa-users
|
||
|
|
|
||
|
|
# Any random string; used to derive the session-cookie encryption key.
|
||
|
|
# Generate one with: openssl rand -base64 32
|
||
|
|
SESSION_SECRET=
|
||
|
|
|
||
|
|
# Listen address
|
||
|
|
LISTEN_ADDR=:8080
|
||
|
|
|
||
|
|
# Storage (defaults shown; relative paths are resolved from the app's working dir).
|
||
|
|
# For the LXC deployment use absolute paths under /var/lib/hsa.
|
||
|
|
DB_PATH=./data/hsa.db
|
||
|
|
STORAGE_DIR=./data/receipts
|
||
|
|
|
||
|
|
# Max upload size in megabytes (reject larger). Camera photos can be ~10MB.
|
||
|
|
MAX_UPLOAD_MB=32
|
||
|
|
|
||
|
|
# People + categories catalog (seeded into the DB on startup).
|
||
|
|
CONFIG_PATH=./config.json
|
||
|
|
|
||
|
|
# Receipt auto-classification (Anthropic). Leave CLAUDE_API_KEY empty to disable.
|
||
|
|
# Tests never need this: they use a mock endpoint (or the cheapest model when
|
||
|
|
# HSA_CLASSIFY_IT=1 is set explicitly).
|
||
|
|
CLAUDE_API_KEY=
|
||
|
|
CLASSIFY_MODEL=claude-opus-4-8
|