.env.example

# Copy this file to ".env" and adjust for your setup, then: docker compose up -d
#
# ── Local testing (default) ────────────────────────────────────────────────
# Works out of the box on the machine running Docker. Open http://localhost:8080
RP_ID=localhost
ORIGIN=http://localhost:8080
WEB_PORT=8080
RP_NAME=openGym

# ── Real deployment behind your own HTTPS domain ───────────────────────────
# Passkeys are bound to the exact hostname, and browsers only allow them over
# HTTPS (localhost is the one exception). Put openGym behind a reverse proxy /
# tunnel that terminates TLS for your domain, then set:
#
#   RP_ID=gym.example.com
#   ORIGIN=https://gym.example.com
#   WEB_PORT=8080
#   RP_NAME=openGym
#
# (Point your proxy at the web container's WEB_PORT. See docs/SELF_HOSTING.md.)

# ── Admin dashboard & invite-only signup (optional) ────────────────────────
# Both off by default — a fresh instance has open signup and no admin.
#
# Make yourself an admin: register your own passkey profile first, find your
# user id in ./data/db.json ("users"[].id), then list it here (comma-separated
# for several admins). Admins get an "Admin dashboard" link in Settings to see
# users, disable accounts, generate invite codes and view workout history.
#
#   ADMIN_UIDS=youruserid,anotheradmin
#
# Require an invite code to create new profiles (existing accounts keep working;
# generate the codes from the admin dashboard):
#
#   INVITE_ONLY=1

# ── Session length (optional) ──────────────────────────────────────────────
# How long a sign-in lasts, in days. Default 90 — long enough that people who
# train regularly never see a login screen, short enough that a stolen cookie
# doesn't stay good forever. Lower it for an instance on the open internet,
# raise it for a private one. Only affects new sign-ins; cookies already handed
# out keep the lifetime they were issued with. Users can end every session on
# every device themselves with "Sign out everywhere" in Settings.
#
#   SESSION_DAYS=90

# ── Notifications (optional) ───────────────────────────────────────────────
# Push works out of the box — nothing to set. VAPID keys are generated on first
# run and saved to ./data/vapid.json. Each user's browser reports its own
# timezone automatically, so the workout-day reminder fires at their local
# time regardless of where the server runs or where they're travelling.

# ── AI Coach (optional) ────────────────────────────────────────────────────
# Nothing to set. Claude's Agent SDK and the OpenAI Codex CLI are built into the api image;
# neither path needs an API key. Enable one from Settings → Admin → AI Coach.
#
# Claude: on a trusted computer where Claude Code is installed, run `claude setup-token`, then
# paste its value into "Add CLI token". Codex: choose "Sign in with ChatGPT" and complete the
# device-code flow in a trusted browser. Codex keeps its refreshable CLI cache in ./data/codex;
# treat that directory like a password-bearing backup. The app never handles a browser OAuth
# callback. It stays off until an admin turns it on, and each profile has to consent separately.
#
# The one knob here is a kill switch: set this and the Coach reports as disabled
# everywhere regardless of what is stored, which is useful for a fleet of
# instances you do not want the feature on for.
#
#   COACH_DISABLED=1