# Copy to .env. Never commit real secrets. Generate each secret independently.
MEMBERSHIP_SECRET_KEY=
MEMBERSHIP_PUBLIC_URL=https://eom.dev
MEMBERSHIP_ALLOW_HTTP=0
# Safe only while membership:8000 is private and Apache overwrites headers.
MEMBERSHIP_TRUST_PROXY=1
WWW_BIND_ADDRESS=127.0.0.1
WWW_PORT=8080
POSTGRES_DB=membership
POSTGRES_USER=membership
POSTGRES_PASSWORD=
POSTGRES_HOST=membership-db
# Compose's local database is on an isolated network. For a remote database use
# verify-full and mount its trusted root certificate via PGSSLROOTCERT.
POSTGRES_SSLMODE=prefer
# Must match discovery's issuer exactly, including its trailing slash.
DEX_ISSUER=https://dex.eom.dev/
DEX_CLIENT_ID=www-membership
DEX_CLIENT_SECRET=
DEX_CONNECTOR_ID=www-ldap
LDAP_URL=ldaps://ldap.eom.dev
LDAP_BIND_DN=
LDAP_BIND_PASSWORD=
LDAP_CA_CERT_FILE=
LDAP_ACCOUNT_BASE_DN=ou=www,ou=people,dc=eom,dc=dev
LDAP_SEARCH_BASE_DN=ou=people,dc=eom,dc=dev
# Set ONLY after independently verifying slapd olcPasswordHash and password policy.
LDAP_PASSWORD_SCHEME=
LDAP_GROUP_PLACEHOLDER_DN=cn=membership-sentinel,ou=system,dc=eom,dc=dev
EMAIL_HOST=
EMAIL_PORT=587
EMAIL_HOST_USER=
EMAIL_HOST_PASSWORD=
EMAIL_USE_TLS=1
DEFAULT_FROM_EMAIL=accounts@eom.dev
STRIPE_SECRET_KEY=
STRIPE_WEBHOOK_SECRET=
STRIPE_LIVE_MODE=1
STRIPE_PORTAL_CONFIGURATION=
# Optional SHKeeper prepaid crypto. Leave empty to hide/disable new invoices.
# HTTPS only; use your actual origin (not an API path or a user-supplied URL).
SHKEEPER_URL=
SHKEEPER_API_KEY=
# Comma-separated API crypto identifiers actually enabled on your instance:
# SHKEEPER_CURRENCIES=BTC,LTC,XMR,ETH-USDT
SHKEEPER_CURRENCIES=
# Mount a private CA read-only into web + worker if needed. Never disable TLS.
SHKEEPER_CA_CERT_FILE=
# Set real recurring Stripe Price IDs and pre-created dedicated LDAP groups.
# The display price is informational; Stripe Checkout is authoritative.
MEMBERSHIP_TIERS_FILE=/app/tiers.eom.json
# These are existing LIVE-mode prices; use separate test-mode prices in sandbox.
# Set MEMBERSHIP_TIERS_JSON instead to override the file ({} disables paid tiers).
# Example shape (names/prices/group DNs are your choice, not created by the app):
# MEMBERSHIP_TIERS_JSON={"supporter":{"label":"Supporter","price_id":"price_REPLACE","price_label":"$5 / month","group_dn":"cn=www-supporter,ou=groups,dc=eom,dc=dev","description":"Support independent projects and community services."}}