config-example.yaml

http:
  port: 8080
  logs: true
  # Comma-separated list of allowed CORS origins.
  # Use * for local dev only. Set to your frontend URL in production.
  cors_allow_origins: "*"

logger:
  level: info
  pretty: false

database:
  dialect: sqlite
  dsn: ./database.sqlite
  # PostgreSQL example:
  # dialect: postgres
  # dsn: "host=localhost user=nexo password=nexo dbname=nexo sslmode=disable"

session:
  # Required — must be at least 32 characters.
  # Generate: openssl rand -base64 48
  # Can also be set via SESSION_SECRET_KEY env var (recommended in production).
  secret_key: "CHANGE_ME_USE_openssl_rand_base64_48"
  expiration_minutes: 43200  # 30 days
  issuer: nexo

sso:
  enabled: false
  # client_id and client_secret from your OIDC provider
  client_id: ""
  client_secret: ""
  # issuer_url: base URL of the OIDC provider (must expose /.well-known/openid-configuration)
  # Examples:
  #   Keycloak:  https://keycloak.example.com/realms/myrealm
  #   Google:    https://accounts.google.com
  #   Okta:      https://dev-xxxxx.okta.com
  issuer_url: ""
  # redirect_url: must match what is registered in the provider
  redirect_url: "http://localhost:5173/auth/callback"
  # scopes: additional scopes beyond openid (email and profile are always requested)
  scopes: []