# 32 caracteres exactos. Ejemplo: openssl rand -base64 24 | tr -d '=+/[:space:]' | cut -c1-32
HEADPLANE_COOKIE_SECRET=CHANGE_ME_WITH_32_CHARS

# Si usas OIDC en Headplane (opcional, cuando no lo pones detrás de Authentik)
# HEADPLANE_OIDC__ISSUER=https://auth.example.com/application/o/headplane/
# HEADPLANE_OIDC__CLIENT_ID=headplane-public
# HEADPLANE_OIDC__CLIENT_SECRET=CHANGE_ME
# HEADPLANE_OIDC__REDIRECT_URI=https://headplane.example.com/oidc/callback
# HEADPLANE_OIDC__DISABLE_API_KEY_LOGIN=true
# HEADPLANE_OIDC__HEADSCALE_API_KEY=CHANGE_ME   # API key creada en Headscale si la necesitas
