# Cloudflare scoped API-Token — Vorlage. Echte Werte → .env (gitignored via mcp/**/.env)
# Token-Scopes (least-privilege): Cloudflare Tunnel:Edit, DNS:Edit (Zone emsenhuber.net),
# Access: Apps and Policies:Edit, Access: Organizations, Identity Providers, and Groups:Edit
CF_API_TOKEN=

# Feste IDs (kein Secret, hier als Referenz):
CF_ACCOUNT_ID=393c051f3accf51881d6c98fc5b66c36
CF_ZONE_ID=1b5bc02fdf61b6b989afde543f3f4134
CF_BF_TUNNEL_ID=70d6a4cf-aa1d-4a91-b918-91fab4fa7270

# --- OAuth-App-Secrets für Access-IdPs (von den jeweiligen Provider-Konsolen) ---
# Callback-URL überall: https://emsenhuber.cloudflareaccess.com/cdn-cgi/access/callback
GITHUB_CLIENT_ID=Ov23li2h96hAkGRPJXYV
GITHUB_CLIENT_SECRET=
GOOGLE_CLIENT_ID=
GOOGLE_CLIENT_SECRET=
FACEBOOK_APP_ID=
FACEBOOK_APP_SECRET=

# --- Geli ---
GELI_EMAIL=
GELI_PUBLIC_IP=     # optional, /32 — nur falls stabile öffentliche IPv4 (bei CGNAT leer lassen)