.env.example

# If passed this will setup the marketplace to load into Nexus on startup
#
# Review the README on the Marketplace section for more details.
NEXUS_MARKETPLACES=/path/to/marketplace,git@git.example.org/repo.git,git@git.example.org/another-repo.git#ref

# Auto-refresh interval for marketplace data.
# Accepts durations: "1h", "30m", "90s", "500ms", or raw milliseconds.
# Default: 1h. Set to 0 to disable periodic refresh.
NEXUS_MARKETPLACE_REFRESH_INTERVAL=1h

# Persistent Brain storage directory. Defaults to ./.nexus-brain when unset.
NEXUS_BRAIN_DATA_DIR=/path/to/nexus-brain-data

# Secret used to sign Brain workspace/share tokens.
NEXUS_BRAIN_TOKEN_SECRET=change-me

# Persistent collaboration room state directory. Defaults to ./.nexus-collab when unset.
NEXUS_COLLAB_DATA_DIR=/path/to/nexus-collab-data

# Hocuspocus WebSocket server port.
NEXUS_COLLAB_SERVER_PORT=1234

# Public WebSocket URL that browsers use to connect to the collab server.
NEXT_PUBLIC_COLLAB_SERVER_URL=ws://localhost:1234

# ── Authentication (OIDC/OAuth2) ─────────────────────────────────────────────
# When all four AUTH_* variables below are set, Nexus requires SSO login.
# When absent, the app is open (no authentication).
#
# AUTH_ISSUER — OIDC issuer URL (auto-discovers endpoints via .well-known)
#   Microsoft Entra ID: https://login.microsoftonline.com/{tenant-id}/v2.0
#   Google:             https://accounts.google.com
#   Okta:               https://{domain}.okta.com
#
# AUTH_ISSUER=https://login.microsoftonline.com/your-tenant-id/v2.0
# AUTH_CLIENT_ID=your-client-id
# AUTH_CLIENT_SECRET=your-client-secret
# AUTH_SECRET=generate-with-openssl-rand-base64-33
# AUTH_PROVIDER_NAME=Microsoft
#
# NEXTAUTH_URL — Canonical public URL of your deployment.
# Not required in local dev (NextAuth auto-detects localhost:3000).
# Required in any deployed environment, especially behind a reverse proxy or
# load balancer, so NextAuth constructs correct OAuth callback URLs.
# Must match exactly the redirect URI registered with your OAuth provider.
#
# NEXTAUTH_URL=https://nexus.example.com