Configuration and security

Configure the deployment using the main repository's .env.example.

Use strong independent database, JWT, and TOTP secrets, replace initial administrator credentials, enable HTTPS, and restrict access to database and administrative services.

For public passkey authentication, set the public base URL and WebAuthn relying-party hostname and origin to match your HTTPS domain.

Optional Swagger UI can be enabled with SHOW_API_UI=true. When enabled, API documentation is exposed at /api and /api/docs. Avoid exposing administrative tooling unnecessarily.