# Nextcloud secrets + host-local binds — copy to .env (gitignored) next to
# docker-compose.yml and fill in real values. Never commit .env.

# LAN IP of the node Nextcloud lands on. Host decided: PIHA (see
# kb/decisions/kb-dokumenty-otwarte.md #1). The web port (8220) binds ONLY
# to this interface — never 0.0.0.0.
LAN_BIND_IP=192.168.31.5

# Reverse proxy (npm@PIHA) as seen from THIS node's containers. Nextcloud
# runs on PIHA (same host as npm) -> npm reaches it as a local container, so
# the source IP is the docker bridge gateway, not PIHA's LAN IP. 172.16.0.0/12
# covers Docker's default bridge allocation range; narrow it to the exact
# /24 (docker network inspect <project>_default) once the stack is up on the
# live host.
TRUSTED_PROXIES=172.16.0.0/12

# Postgres password for the nextcloud DB (app reads the same var).
POSTGRES_PASSWORD=change-me-very-strong

# Bootstrap admin — auto-provisioned on FIRST start only. Used to install and
# configure the user_oidc app (see README), day-to-day login is Forgejo OIDC.
NEXTCLOUD_ADMIN_USER=oskar
NEXTCLOUD_ADMIN_PASSWORD=change-me-bootstrap-only