NODE_ENV=development
SERVER_PORT=3301
PUBLIC_READ=false
ALLOW_PASSWORD_LOGIN=false
NAISYS_FOLDER=~/.naisys
HUB_URL=

# Optional alternate Supervisor password login. Passkeys remain the primary
# credential path; leave disabled unless you explicitly need password fallback.

# Optional WebAuthn hardening. When unset, the supervisor derives RP ID and
# expected origin from incoming request headers — fine for local dev but
# trusts the reverse proxy. Set these in production to lock the relying-party
# identity to fixed values, regardless of Host/Origin headers.
#
# SUPERVISOR_WEBAUTHN_RP_ID=supervisor.example.com
# SUPERVISOR_WEBAUTHN_ORIGIN=https://supervisor.example.com
#
# A comma-separated list is supported for the rare case where one deploy
# accepts assertions from more than one origin. In normal use, set a single
# value matching the deployment.
