Authentication

Leave OIDC_ISSUER_URL empty to use local username/password authentication. Local passwords are hashed with bcrypt and can be changed from profile settings.

Set OIDC_ISSUER_URL, client credentials, and the callback URL to delegate authentication to an OpenID Connect provider. The authorization flow uses state and PKCE. Optional GitHub and Google sign-in can also be enabled in local-auth mode.

Sessions are stored in Redis and delivered through HTTP-only cookies. Production deployments must use HTTPS and a unique SESSION_SECRET of at least 32 characters.