.env.example

# Most non-bootstrap settings below can ALSO be managed at runtime from the
# admin UI (Dashboard → Integrations), which stores them in the DB. At startup
# the server hydrates DB-stored settings into the environment, but ENV WINS:
# any value set here is locked and takes precedence over the DB. Bootstrap vars
# (SECRET_KEY, DATABASE_URL, PORT, NODE_ENV) are env-only and not UI-managed.
# Changes made via the UI require a server restart to take effect.

# Required (bootstrap, env-only)
SECRET_KEY=generate_a_random_64_char_hex_string
BASE_URL=http://localhost:3000

# Auth provider selection (default: github) — UI-managed
# AUTH_PROVIDER=github|okta

# GitHub OAuth (when AUTH_PROVIDER=github)
GITHUB_CLIENT_ID=your_github_oauth_app_client_id
GITHUB_CLIENT_SECRET=your_github_oauth_app_client_secret
GITHUB_ORG=your_github_org_name

# Okta OIDC (when AUTH_PROVIDER=okta)
# OKTA_ISSUER=https://your-org.okta.com
# OKTA_CLIENT_ID=your_okta_client_id
# OKTA_CLIENT_SECRET=your_okta_client_secret
# INITIAL_ADMIN_EMAILS=admin1@example.com,admin2@example.com
# POST_LOGOUT_REDIRECT_URI=https://your-app.example.com (optional, defaults to BASE_URL)

# Session timeouts (optional)
# SESSION_IDLE_TIMEOUT=28800 (8h in seconds, rolling timeout on each request)
# SESSION_MAX_AGE=604800 (7d in seconds, absolute max lifespan)

# SCIM 2.0 provisioning (optional)
# SCIM_AUTH_TOKEN=your_scim_bearer_token

# Optional
# PORT=3000
# DATABASE_URL=postgres://user:password@host:5432/planpush
# SLACK_WEBHOOK_URL=https://hooks.slack.com/services/...