ADMIN_PASSWORD=change-me
SESSION_SECRET=generate-with-openssl-rand-hex-32
BASE_URL=https://artifacto.hubris.network

# Optional: when set, a reverse proxy forwarding Authentik headers can auto-login
# without the admin password. The proxy must inject `X-Artifacto-Gateway: <this
# value>` on every request it proxies; Artifacto rejects SSO headers from
# requests missing that header so peers that can reach the container directly
# can't spoof Authentik identities.
# SSO_GATEWAY_SECRET=generate-with-openssl-rand-hex-32