# Optional secrets only. Copy to .env when credentials are needed.
# Process variables from your deployment/secret store take precedence.
# .env is ignored by Git and Docker. Never commit real credentials.
# Normal settings belong in AppConfig.toml.
# DATABASE_URL=postgres://user:password@localhost/app
# JWT_SECRET=replace-with-a-strong-secret
# SENTRY_DSN=your-private-dsn
# S3 credentials are optional when using workload roles or a deployment credential provider.
# AWS_ACCESS_KEY_ID=your-access-key
# AWS_SECRET_ACCESS_KEY=your-secret-key
# AWS_SESSION_TOKEN=optional-temporary-session-token