# talos-iam/.env.example
# Copy to talos-iam/.env and fill in. The real .env is gitignored — never commit it.
# These are ADMIN credentials for the homelab identity provider; use strong values.

# Authentik's signing/encryption key. SET ONCE — rotating it invalidates all
# existing sessions, tokens, and encrypted fields. Generate:
#   openssl rand -base64 60 | tr -d '\n'
AUTHENTIK_SECRET_KEY=

# Initial password for the built-in admin user 'akadmin'. Change after first login.
#   openssl rand -base64 24
AUTHENTIK_BOOTSTRAP_PASSWORD=

# Initial API token for 'akadmin' (used for automation / blueprints).
#   openssl rand -hex 32
AUTHENTIK_BOOTSTRAP_TOKEN=

# Password for the bundled PostgreSQL 'authentik' user (system of record).
#   openssl rand -base64 24
PG_PASSWORD=

# OAuth2 client secrets for downstream OIDC integrations.
# These are registered with Authentik and injected as K8s secrets
# into the logging and storage namespaces by this bootstrap script.
#   openssl rand -hex 32
GRAFANA_OIDC_CLIENT_SECRET=
MINIO_OIDC_CLIENT_SECRET=