# Penpot secrets — copy to `penpot.env` (gitignored) and fill real values.
# docker compose auto-loads `.env`; this deployment expects `penpot.env`, so run with:
#   docker compose --env-file penpot.env up -d
#
# Generate fresh values:
#   PENPOT_SECRET_KEY / PENPOT_DB_PASSWORD:  openssl rand -hex 32   (or -hex 16 for the db pw)
#   PENPOT_OIDC_CLIENT_SECRET:               must match oidc_clients.client_secret
#                                            (client_id=penpot) in godcrm_prod.

# Session/crypto key for penpot (backend + exporter must share the SAME value).
PENPOT_SECRET_KEY=

# OAuth2/OIDC client secret registered in CRM oidc_clients (client_id=penpot).
PENPOT_OIDC_CLIENT_SECRET=

# Penpot's own postgres password (used by both penpot-backend and penpot-postgres).
PENPOT_DB_PASSWORD=