.env.example

# Copy to `.env` and fill in real values. `.env` is gitignored.

# Bearer token shared between zvg-immo and haex-claude-proxy so the /settings
# page can drive the proxy's browser-based OAuth flow.
#   openssl rand -hex 32
PROXY_SETUP_TOKEN=

# Password protecting the /settings page (single-user, no email/reset flow).
SETTINGS_PASSWORD=

# HMAC secret for the /settings session cookie. Rotating this logs everyone out.
#   openssl rand -hex 32
SETTINGS_SESSION_SECRET=

# Set to `1` only when this app is unreachable directly and a trusted reverse
# proxy (Traefik, nginx) sits in front — it makes the /settings login rate
# limit key off `x-forwarded-for`. When left empty, the socket peer IP is used
# instead (safer default: a client can't rotate rate-limit buckets by sending
# a spoofed header). If the compose port 3000 is exposed publicly, leave this
# unset.
# NUXT_TRUST_FORWARDED_FOR=1