# Copy to .env and adjust. .env is git-ignored; this file is not.

# ─── Required ───────────────────────────────────────────────────────
# Web UI password. There is no default and no "first run" setup: if neither
# PASSWORD nor HASHED_PASSWORD is set, code-server serves an editor and a
# terminal with NO authentication whatsoever.
PASSWORD=

# Instead of the plaintext above, you can store only a hash. It overrides
# PASSWORD when set. Generate one with:
#
#   echo -n "yourpassword" | npx argon2-cli -e
#
# Then uncomment HASHED_PASSWORD in compose.yaml.
#HASHED_PASSWORD=

# ─── Sudo inside the container ──────────────────────────────────────
# Set this if you want to install things from the built-in terminal. The image
# is deliberately minimal -- no python, no pip, no compilers -- so anything
# beyond editing needs apt:
#
#   sudo apt update && sudo apt install -y python3-pip
#
# Leaving it empty is safe and simply disables sudo; the init script tests for
# a non-empty value, so empty is not an enabled blank password. It can be the
# same as PASSWORD or different -- it only guards `sudo` inside the container.
#
# Be aware of what it grants: root in the container. That is a container, not
# your host, but it is still root over anything you have mounted.
SUDO_PASSWORD=

# Store a hash instead of the plaintext. Takes priority over SUDO_PASSWORD.
# Format is $type$salt$hash. Uncomment the matching line in compose.yaml.
#SUDO_PASSWORD_HASH=

# ─── Identity ───────────────────────────────────────────────────────
# Files you create in the editor are owned by this user. `id -u` / `id -g`.
# Defaulted to 1000/1000 in compose.yaml.
#PUID=1000
#PGID=1000
#TZ=Europe/Paris

# ─── Paths ──────────────────────────────────────────────────────────
# Settings, installed extensions, and the default workspace.
#CONFIG_PATH=./config

# Optional: existing code on the host to expose in the editor. Uncomment the
# matching volume line in compose.yaml too.
#PROJECTS_PATH=/srv/projects

# ─── Ports and proxying ─────────────────────────────────────────────
#PORT=8443
#DEFAULT_WORKSPACE=/config/workspace

# Only for subdomain port-forwarding (3000.code.example.com). Needs wildcard
# DNS and a wildcard certificate; skip it if you don't need that.
#PROXY_DOMAIN=code.example.com