.env.example

# Copy this file to .env before running `docker compose up`:
#   cp .env.example .env
# .env is gitignored -- never commit it.
#
# These values seed the MariaDB container on its first boot AND are passed
# into the app container as environment variables, which config.php reads
# directly -- so your real DB password never has to be typed into a literal
# PHP file. Changing them after the DB volume already exists does NOT change
# the database's actual password (MariaDB only applies these on first init of
# an empty data directory) -- see readme/DEPLOYMENT.md if you need to rotate it.

# Generate strong values, e.g.: openssl rand -base64 24
WORKFLOW_DB_ROOT_PASSWORD=CHANGE_ME
WORKFLOW_DB_PASSWORD=CHANGE_ME

# ---- App-level field encryption (Note Keeper + Team Chat content) ----
# AES-256 key, base64-encoded. Generate one with:
#   php -r "echo base64_encode(random_bytes(32));"
# Leave blank and the setup wizard will generate one for you on first run and
# write it back into this file. Losing this key makes every encrypted note/
# message permanently unreadable -- there is no recovery path. Back up
# whatever value ends up here somewhere outside this repo.
WORKFLOW_ENCRYPTION_KEY=