# Copy to .env and fill in. Never commit .env.

# Password for the organizer desk at /admin. Required unless TRUST_CF_ACCESS=true.
ADMIN_PASSWORD=change-me

# Random string used to sign the organizer session cookie. Generate one with:
#   openssl rand -hex 32
# If left empty a random secret is generated at startup (organizers must sign in again after each restart).
SESSION_SECRET=

# Optional. If "true", requests carrying the Cf-Access-Authenticated-User-Email header
# (set by Cloudflare after an Access policy on /admin*) are treated as organizers.
# Only enable when the app is reachable exclusively through the tunnel.
TRUST_CF_ACCESS=false

# Cloudflare Tunnel token from Zero Trust → Networks → Tunnels → (your tunnel) → Install connector.
# The tunnel's public hostname should route to http://app:3000.
CLOUDFLARE_TUNNEL_TOKEN=