add auth + remote nrepl

.env-template

@@ -0,0 +1,33 @@
+# Copy to .env and fill in:  cp .env-template .env
+# script/server loads .env automatically; with Docker pass it via `docker run --env-file .env`
+# (so keep values unquoted). .env is git-ignored and excluded from the image; never commit it.
+
+# --- Server ---------------------------------------------------------------
+# PORT=3000
+
+# --- Gitea OAuth login ------------------------------------------------------
+# Register an OAuth2 application in Gitea (Settings > Applications) as a confidential
+# client, with the redirect URI  <BASE_URL>/auth/callback
+GITEA_URL=https://gitea.example.com
+GITEA_CLIENT_ID=
+GITEA_CLIENT_SECRET=
+
+# Public URL of this app, as the browser reaches it. Use https in production: that also
+# marks the session cookie Secure.
+BASE_URL=http://localhost:3000
+
+# Signs and encrypts session cookies. Generate with: openssl rand -hex 32
+# Unset = a random key per start, so everyone is logged out on every restart.
+SESSION_SECRET=
+
+# --- Admin API --------------------------------------------------------------
+# Comma-separated Gitea usernames allowed to use the admin API (POST /nrepl).
+# Empty = nobody can.
+ADMIN_USERS=
+
+# --- nREPL debug server (POST /nrepl) -----------------------------------------
+# nREPL has no authentication and evaluates arbitrary code, so it listens on loopback
+# only by default. Changing NREPL_BIND to 0.0.0.0 exposes it to the network: only do that
+# behind a firewall or an SSH tunnel.
+# NREPL_PORT=7888
+# NREPL_BIND=127.0.0.1