# Copy to .env on the monitoring host (beta) before `docker compose up`.
# .env is gitignored — never commit real secrets.

# The public hostname beta's Caddy serves Grafana at (see caddy-grafana.conf).
GRAFANA_DOMAIN=dashboard.thermograph.org

# Break-glass local admin (Google SSO below is the primary login). Keep this
# strong; it's the fallback if OAuth ever breaks.
GF_ADMIN_USER=admin
GF_SECURITY_ADMIN_PASSWORD=change-me-to-something-strong

# --- Google SSO ------------------------------------------------------------------
# Create a Google Cloud "OAuth 2.0 Client ID" (type: Web application) and set:
#   Authorized redirect URI:  https://dashboard.thermograph.org/login/google
# Then paste the client id/secret here and flip OAUTH_ENABLED=true.
# Login is locked to pre-provisioned accounts (allow_sign_up=false) — provision
# your email as an admin (see README) so only you can sign in.
OAUTH_ENABLED=false
GOOGLE_CLIENT_ID=
GOOGLE_CLIENT_SECRET=