.env.docker

# MiniPACS Docker Configuration
# Copy to .env and fill in values: cp .env.docker .env

SECRET_KEY=CHANGE-ME-GENERATE-RANDOM-STRING
ORTHANC_USERNAME=orthanc
ORTHANC_PASSWORD=CHANGE-ME-IN-PRODUCTION
# Base64 of username:password — generate with: printf 'orthanc:YOUR_PASSWORD' | base64
ORTHANC_BASIC_AUTH=b3J0aGFuYzpDSEFOR0UtTUUtSU4tUFJPRFVDVElPTg==

# PostgreSQL for Orthanc index (storage stays on disk). Any strong password OK
# — service is not exposed outside the docker-compose network.
POSTGRES_PASSWORD=CHANGE-ME-ORTHANC-PG

# Ports (defaults shown)
HTTP_PORT=48920
HTTPS_PORT=48921

AUTO_LOGOUT_MINUTES=15
DEFAULT_SHARE_EXPIRY_DAYS=30

# Shared secret between Orthanc Python plugin and backend for live-worklist events.
# Any long random string is fine — internal to the docker network, not exposed.
INTERNAL_EVENT_TOKEN=CHANGE-ME-RANDOM-INTERNAL-EVENT-TOKEN

# AES-256 passphrase for backup encryption — generated by setup.sh.
# HIPAA §164.312(a)(2)(iv) (encryption of PHI at rest). DO NOT rotate without
# re-encrypting existing backups, or you lose the ability to restore them.
# Generate manually: openssl rand -base64 32 | tr -d '/+=' | head -c 40
BACKUP_PASSPHRASE=CHANGE-ME-BACKUP-ENCRYPTION-PASSPHRASE