# Shared PostgreSQL on internal network (same at all sites)
DATABASE_URL=postgresql://noticeboard:CHANGE_ME@10.10.10.100:5432/noticeboard_db

# Shared HS256 secret — generate once, same value on all app LXCs
CENTRAL_AUTH_SECRET=CHANGE_ME

# Offsite access restriction — supports:
#   203.0.113.1          static public IP
#   203.0.113.0/28       CIDR range
#   hnf.dyndns.org       DDNS hostname (resolved + cached 5 min)
#   disabled             no restriction (use during setup/testing)
OFFICE_IP_CHECK=disabled

# Port the frontend nginx listens on (NPM proxies to this)
FRONTEND_PORT=3080