###> symfony/framework-bundle ###
APP_ENV=dev
APP_SECRET=changeme_generate_with_php_bin_console_secrets_generate_keys
###< symfony/framework-bundle ###

###> keycloak ###
# Keycloak client registered for the BFF only (confidential client,
# "Standard flow" + PKCE enabled, redirect URI = KEYCLOAK_REDIRECT_URI).
# Apps never register their own Keycloak client — they all go through this one.
KEYCLOAK_BASE_URL=https://keycloak.corp.internal
KEYCLOAK_REALM=corp
KEYCLOAK_CLIENT_ID=bff
KEYCLOAK_CLIENT_SECRET=changeme
KEYCLOAK_REDIRECT_URI=https://bff.corp.internal/auth/callback
KEYCLOAK_POST_LOGOUT_REDIRECT=https://appsmith.corp.internal
###< keycloak ###

###> backend ###
BACKEND_BASE_URL=https://backend.corp.internal/api
# One env var per additional named backend, matching config/services.yaml's
# `backends` map — requests select a non-default backend via the
# X-Backend header, e.g.:
# BACKEND_CRM_API_URL=https://crm-api.corp.internal
###< backend ###

###> appsmith apps ###
# One line per Appsmith app you register — add more as you build more apps,
# and add a matching line in config/services.yaml under appsmith.apps.
APP_SANDBOX_URL=https://appsmith.corp.internal/app/app-sandbox/login-1234567890abcdef
###< appsmith apps ###