# Copy to .env. Never commit real secrets. Generate each secret independently.
MEMBERSHIP_SECRET_KEY=
MEMBERSHIP_PUBLIC_URL=https://eom.dev
MEMBERSHIP_ALLOW_HTTP=0
# Safe only while membership:8000 is private and Apache overwrites headers.
MEMBERSHIP_TRUST_PROXY=1
WWW_BIND_ADDRESS=127.0.0.1
WWW_PORT=8080
POSTGRES_DB=membership
POSTGRES_USER=membership
POSTGRES_PASSWORD=
POSTGRES_HOST=membership-db
# Compose's local database is on an isolated network. For a remote database use
# verify-full and mount its trusted root certificate via PGSSLROOTCERT.
POSTGRES_SSLMODE=prefer
DEX_ISSUER=https://dex.eom.dev
DEX_CLIENT_ID=www-membership
DEX_CLIENT_SECRET=
DEX_CONNECTOR_ID=www-ldap
LDAP_URL=ldaps://ldap.eom.dev
LDAP_BIND_DN=
LDAP_BIND_PASSWORD=
LDAP_CA_CERT_FILE=
LDAP_ACCOUNT_BASE_DN=ou=www,ou=people,dc=eom,dc=dev
LDAP_SEARCH_BASE_DN=ou=people,dc=eom,dc=dev
# Set ONLY after independently verifying slapd olcPasswordHash and password policy.
LDAP_PASSWORD_SCHEME=
LDAP_GROUP_PLACEHOLDER_DN=cn=membership-sentinel,ou=system,dc=eom,dc=dev
EMAIL_HOST=
EMAIL_PORT=587
EMAIL_HOST_USER=
EMAIL_HOST_PASSWORD=
EMAIL_USE_TLS=1
DEFAULT_FROM_EMAIL=accounts@eom.dev
STRIPE_SECRET_KEY=
STRIPE_WEBHOOK_SECRET=
STRIPE_LIVE_MODE=1
STRIPE_PORTAL_CONFIGURATION=
# Set real recurring Stripe Price IDs and pre-created dedicated LDAP groups.
# The display price is informational; Stripe Checkout is authoritative.
MEMBERSHIP_TIERS_FILE=/app/tiers.eom.json
# These are existing LIVE-mode prices; use separate test-mode prices in sandbox.
# Set MEMBERSHIP_TIERS_JSON instead to override the file ({} disables paid tiers).
# Example shape (names/prices/group DNs are your choice, not created by the app):
# MEMBERSHIP_TIERS_JSON={"supporter":{"label":"Supporter","price_id":"price_REPLACE","price_label":"$5 / month","group_dn":"cn=www-supporter,ou=groups,dc=eom,dc=dev","description":"Support independent projects and community services."}}