# Server
LISTEN_ADDR=:8080
SESSION_SECRET=change-me-to-a-long-random-secret-at-least-32-chars
DATABASE_PATH=data/migaduadmin.db
COOKIE_SECURE=false

# Migadu API (https://www.migadu.com/api/)
# Username is your Migadu account email; password is the API key ("app-key").
# `make dev` creates .env automatically; replace these before loading domains.
MIGADU_USER=you@example.com
MIGADU_API_KEY=your-migadu-api-key
MIGADU_BASE_URL=https://api.migadu.com/v1

# Auth: local | pangolin | both
AUTH_MODE=both

# Comma-separated CIDRs allowed to supply Pangolin SSO headers
# (Remote-Email, Remote-User, Remote-Name, Remote-Role).
TRUSTED_PROXIES=127.0.0.1/32,::1/128

# After the first admin exists, registration stays closed unless true.
REGISTRATION_OPEN=false

# When true, unknown Pangolin SSO emails are auto-created as role=user.
# First-ever user is always admin regardless of this setting.
SSO_AUTO_PROVISION=false