.env.example

# Copy to .env and change the secret before deploying.
# Generate one with:  openssl rand -base64 48
SESSION_SECRET=change-me-to-a-long-random-string

# Where the SQLite database and uploaded SCORM packages live.
# Local dev: ./data     In Docker: /data (mapped to /mnt/user/appdata/simple-lms)
LMS_DATA_DIR=./data

# The session cookie is marked `Secure` only when the connection is really
# HTTPS, detected from the x-forwarded-proto header your proxy sets. Override
# only if you know you need to:
#   COOKIE_SECURE=true   always mark Secure
#   COOKIE_SECURE=false  never mark Secure

# Diagnostic endpoints (/api/session-debug, /api/cookie-test) are disabled unless
# this is set, and then require ?token=<value>. Leave unset in normal operation.
# DEBUG_TOKEN=some-long-random-string

# --- Email reminders (optional; without these nothing is sent) ---
# Resend API key from https://resend.com
# RESEND_API_KEY=re_...
# The From address, on a domain verified in Resend.
# MAIL_FROM=Training <training@example.org>
# MAIL_REPLY_TO=someone@example.org
# The public URL, used for links in emails.
# APP_URL=https://training.example.org
# Hour (UTC) for the daily reminder pass. 13 is roughly 8-9am US Eastern.
# NOTIFY_HOUR_UTC=13