# Copy to /opt/stacks/myapp/.env ON THE HOST. Never commit the real .env -
# the deploy rsyncs this repo over the host with --delete and excludes .env
# precisely so the host copy survives.

# The WireGuard address every service publishes on. A published port with no
# host_ip binds 0.0.0.0, and ufw cannot close it (Docker's iptables chain runs
# first). The deploy refuses to start if this is unset.
WG_IP=127.0.0.1

# puhososik JWT signing key. app.py falls back to a hardcoded default if this
# is missing, which lets anyone forge a session - so the deploy fails instead.
# Generate with: openssl rand -hex 32
SECRET_KEY=024d71dd6f09c48e60603d3b9b299e53dd532b9d6a7b2a93e7e3c8c697d17457