PENPOT_PUBLIC_URI=https://penpot.example.com

POSTGRES_DB=penpot
POSTGRES_USER=penpot
POSTGRES_PASSWORD=secure-password

PENPOT_DATABASE_URI=postgresql://penpot-postgres/penpot
PENPOT_DATABASE_USERNAME=penpot
# Must match POSTGRES_PASSWORD
PENPOT_DATABASE_PASSWORD=secure-password

PENPOT_REDIS_URI=redis://penpot-redis:6379

PENPOT_SECRET_KEY=secret-key

PENPOT_ASSETS_STORAGE_BACKEND=assets
PENPOT_STORAGE_ASSETS_DIRECTORY=/opt/data/assets

PENPOT_REGISTRATION_ENABLED=true

# Either 
PENPOT_FLAGS=enable-registration enable-login-with-password disable-email-verification enable-prepl-server

# Or
PENPOT_FLAGS=enable-login-with-password
PENPOT_REGISTRATION_ENABLED=false

# Stub out optional MCP/nitrate upstreams so nginx in the frontend image can
# resolve them at startup. We don't run these services; hitting /mcp/* or
# /control-center will 404, but the main app boots.
PENPOT_MCP_URI=http://penpot-backend:6060
PENPOT_MCP_URI_WS=http://penpot-backend:6060
PENPOT_NITRATE_URI=http://penpot-backend:6060