.env.example

# Copy this file to .env and fill in real values.
# .env is gitignored — never commit it.
#
# Generate secrets with:   openssl rand -hex 32

# PostgreSQL superuser password (used by Docker Compose and the app user)
POSTGRES_PASSWORD=

# Keycloak admin console password
KEYCLOAK_ADMIN_PASSWORD=

# Keycloak OIDC client secret — injected into both Keycloak (realm import) and the API
KEYCLOAK_CLIENT_SECRET=

# M2M ingestion (statement-generator) service-account secret. Leave blank to reuse
# KEYCLOAK_CLIENT_SECRET in local dev; set a distinct value in production.
KEYCLOAK_INGEST_CLIENT_SECRET=

# Download-token signing key (HS256) — minimum 32 characters
DOWNLOAD_TOKEN_SECRET=

# Field-encryption key for customer SA ID numbers (AES-256-GCM) — base64 of exactly 32 bytes.
# Generate with:   openssl rand -base64 32
# WARNING: losing this key makes stored ID numbers unrecoverable.
FIELD_ENCRYPTION_KEY=