<rss version="2.0" xmlns:atom="http://www.w3.org/2005/Atom">
  <channel>
    <title>cavaliba.com – Configuration</title>
    <link>http://localhost:1313/docs/70configuration/</link>
    <description>Recent content in Configuration on cavaliba.com</description>
    <generator>Hugo -- gohugo.io</generator>
    <language>en-us</language>
    
	  <atom:link href="http://localhost:1313/docs/70configuration/index.xml" rel="self" type="application/rss+xml" />
    
    
      
        
      
    
    
    <item>
      <title>System Configuration</title>
      <link>http://localhost:1313/docs/70configuration/system_configuration/</link>
      <pubDate>Mon, 01 Jan 0001 00:00:00 +0000</pubDate>
      
      <guid>http://localhost:1313/docs/70configuration/system_configuration/</guid>
      <description>
        
        
        &lt;p&gt;The &lt;code&gt;.env&lt;/code&gt; docker file holds several important system parameters. It is used at startup when issuing the &lt;code&gt;docker compose up -d&lt;/code&gt; startup command. You must restart the application when modifications to &lt;em&gt;env&lt;/em&gt; occur.&lt;/p&gt;
&lt;hr&gt;
&lt;h2&gt;Docker Image Configuration&lt;span class=&#34;hx-absolute -hx-mt-20&#34; id=&#34;docker-image-configuration&#34;&gt;&lt;/span&gt;
    &lt;a href=&#34;#docker-image-configuration&#34; class=&#34;subheading-anchor&#34; aria-label=&#34;Permalink for this section&#34;&gt;&lt;/a&gt;&lt;/h2&gt;&lt;h3&gt;CAVALIBA_DOCKER_IMAGE&lt;span class=&#34;hx-absolute -hx-mt-20&#34; id=&#34;cavaliba_docker_image&#34;&gt;&lt;/span&gt;
    &lt;a href=&#34;#cavaliba_docker_image&#34; class=&#34;subheading-anchor&#34; aria-label=&#34;Permalink for this section&#34;&gt;&lt;/a&gt;&lt;/h3&gt;&lt;div class=&#34;hextra-code-block hx-relative hx-mt-6 first:hx-mt-0 hx-group/code&#34;&gt;

&lt;div&gt;&lt;pre&gt;&lt;code&gt;CAVALIBA_DOCKER_IMAGE=cavaliba/cavaliba:3.21.0&lt;/code&gt;&lt;/pre&gt;&lt;/div&gt;&lt;div class=&#34;hextra-code-copy-btn-container hx-opacity-0 hx-transition group-hover/code:hx-opacity-100 hx-flex hx-gap-1 hx-absolute hx-m-[11px] hx-right-0 hx-top-0&#34;&gt;
  &lt;button
    class=&#34;hextra-code-copy-btn hx-group/copybtn hx-transition-all active:hx-opacity-50 hx-bg-primary-700/5 hx-border hx-border-black/5 hx-text-gray-600 hover:hx-text-gray-900 hx-rounded-md hx-p-1.5 dark:hx-bg-primary-300/10 dark:hx-border-white/10 dark:hx-text-gray-400 dark:hover:hx-text-gray-50&#34;
    title=&#34;Copy code&#34;
  &gt;
    &lt;div class=&#34;copy-icon group-[.copied]/copybtn:hx-hidden hx-pointer-events-none hx-h-4 hx-w-4&#34;&gt;&lt;/div&gt;
    &lt;div class=&#34;success-icon hx-hidden group-[.copied]/copybtn:hx-block hx-pointer-events-none hx-h-4 hx-w-4&#34;&gt;&lt;/div&gt;
  &lt;/button&gt;
&lt;/div&gt;
&lt;/div&gt;
&lt;p&gt;Name of the docker registry, docker image and version for the Cavaliba Application. The default value displayed above queries Docker Hub, for the public cavaliba repository, cavaliba image object, with a version 3.21.0. You can use any public/private image repository that can be accessed from your docker host. You can build your own cavaliba image from source code with the provided dockerfile.&lt;/p&gt;
&lt;hr&gt;
&lt;h2&gt;Internationalization&lt;span class=&#34;hx-absolute -hx-mt-20&#34; id=&#34;internationalization&#34;&gt;&lt;/span&gt;
    &lt;a href=&#34;#internationalization&#34; class=&#34;subheading-anchor&#34; aria-label=&#34;Permalink for this section&#34;&gt;&lt;/a&gt;&lt;/h2&gt;&lt;h3&gt;CAVALIBA_LANGUAGE_CODE&lt;span class=&#34;hx-absolute -hx-mt-20&#34; id=&#34;cavaliba_language_code&#34;&gt;&lt;/span&gt;
    &lt;a href=&#34;#cavaliba_language_code&#34; class=&#34;subheading-anchor&#34; aria-label=&#34;Permalink for this section&#34;&gt;&lt;/a&gt;&lt;/h3&gt;&lt;div class=&#34;hextra-code-block hx-relative hx-mt-6 first:hx-mt-0 hx-group/code&#34;&gt;

&lt;div&gt;&lt;pre&gt;&lt;code&gt;CAVALIBA_LANGUAGE_CODE=&amp;#34;en-us&amp;#34;&lt;/code&gt;&lt;/pre&gt;&lt;/div&gt;&lt;div class=&#34;hextra-code-copy-btn-container hx-opacity-0 hx-transition group-hover/code:hx-opacity-100 hx-flex hx-gap-1 hx-absolute hx-m-[11px] hx-right-0 hx-top-0&#34;&gt;
  &lt;button
    class=&#34;hextra-code-copy-btn hx-group/copybtn hx-transition-all active:hx-opacity-50 hx-bg-primary-700/5 hx-border hx-border-black/5 hx-text-gray-600 hover:hx-text-gray-900 hx-rounded-md hx-p-1.5 dark:hx-bg-primary-300/10 dark:hx-border-white/10 dark:hx-text-gray-400 dark:hover:hx-text-gray-50&#34;
    title=&#34;Copy code&#34;
  &gt;
    &lt;div class=&#34;copy-icon group-[.copied]/copybtn:hx-hidden hx-pointer-events-none hx-h-4 hx-w-4&#34;&gt;&lt;/div&gt;
    &lt;div class=&#34;success-icon hx-hidden group-[.copied]/copybtn:hx-block hx-pointer-events-none hx-h-4 hx-w-4&#34;&gt;&lt;/div&gt;
  &lt;/button&gt;
&lt;/div&gt;
&lt;/div&gt;
&lt;p&gt;Sets the default language for the user interface. Examples: &lt;code&gt;en-us&lt;/code&gt; (English), &lt;code&gt;fr-FR&lt;/code&gt; (French), &lt;code&gt;de-DE&lt;/code&gt; (German). Users can override this in their profile settings.&lt;/p&gt;
&lt;h3&gt;CAVALIBA_TIME_ZONE&lt;span class=&#34;hx-absolute -hx-mt-20&#34; id=&#34;cavaliba_time_zone&#34;&gt;&lt;/span&gt;
    &lt;a href=&#34;#cavaliba_time_zone&#34; class=&#34;subheading-anchor&#34; aria-label=&#34;Permalink for this section&#34;&gt;&lt;/a&gt;&lt;/h3&gt;&lt;div class=&#34;hextra-code-block hx-relative hx-mt-6 first:hx-mt-0 hx-group/code&#34;&gt;

&lt;div&gt;&lt;pre&gt;&lt;code&gt;CAVALIBA_TIME_ZONE=&amp;#34;Europe/Paris&amp;#34;&lt;/code&gt;&lt;/pre&gt;&lt;/div&gt;&lt;div class=&#34;hextra-code-copy-btn-container hx-opacity-0 hx-transition group-hover/code:hx-opacity-100 hx-flex hx-gap-1 hx-absolute hx-m-[11px] hx-right-0 hx-top-0&#34;&gt;
  &lt;button
    class=&#34;hextra-code-copy-btn hx-group/copybtn hx-transition-all active:hx-opacity-50 hx-bg-primary-700/5 hx-border hx-border-black/5 hx-text-gray-600 hover:hx-text-gray-900 hx-rounded-md hx-p-1.5 dark:hx-bg-primary-300/10 dark:hx-border-white/10 dark:hx-text-gray-400 dark:hover:hx-text-gray-50&#34;
    title=&#34;Copy code&#34;
  &gt;
    &lt;div class=&#34;copy-icon group-[.copied]/copybtn:hx-hidden hx-pointer-events-none hx-h-4 hx-w-4&#34;&gt;&lt;/div&gt;
    &lt;div class=&#34;success-icon hx-hidden group-[.copied]/copybtn:hx-block hx-pointer-events-none hx-h-4 hx-w-4&#34;&gt;&lt;/div&gt;
  &lt;/button&gt;
&lt;/div&gt;
&lt;/div&gt;
&lt;p&gt;Specifies the server timezone for all timestamps and scheduled tasks. Examples: &lt;code&gt;UTC&lt;/code&gt;, &lt;code&gt;Europe/Paris&lt;/code&gt;, &lt;code&gt;America/New_York&lt;/code&gt;, &lt;code&gt;Asia/Tokyo&lt;/code&gt;. This affects when daily housekeeping tasks run.&lt;/p&gt;
&lt;hr&gt;
&lt;h2&gt;Authentication and Admin Account&lt;span class=&#34;hx-absolute -hx-mt-20&#34; id=&#34;authentication-and-admin-account&#34;&gt;&lt;/span&gt;
    &lt;a href=&#34;#authentication-and-admin-account&#34; class=&#34;subheading-anchor&#34; aria-label=&#34;Permalink for this section&#34;&gt;&lt;/a&gt;&lt;/h2&gt;&lt;h3&gt;CAVALIBA_AUTH_MODE&lt;span class=&#34;hx-absolute -hx-mt-20&#34; id=&#34;cavaliba_auth_mode&#34;&gt;&lt;/span&gt;
    &lt;a href=&#34;#cavaliba_auth_mode&#34; class=&#34;subheading-anchor&#34; aria-label=&#34;Permalink for this section&#34;&gt;&lt;/a&gt;&lt;/h3&gt;&lt;div class=&#34;hextra-code-block hx-relative hx-mt-6 first:hx-mt-0 hx-group/code&#34;&gt;

&lt;div&gt;&lt;pre&gt;&lt;code&gt;CAVALIBA_AUTH_MODE=local&lt;/code&gt;&lt;/pre&gt;&lt;/div&gt;&lt;div class=&#34;hextra-code-copy-btn-container hx-opacity-0 hx-transition group-hover/code:hx-opacity-100 hx-flex hx-gap-1 hx-absolute hx-m-[11px] hx-right-0 hx-top-0&#34;&gt;
  &lt;button
    class=&#34;hextra-code-copy-btn hx-group/copybtn hx-transition-all active:hx-opacity-50 hx-bg-primary-700/5 hx-border hx-border-black/5 hx-text-gray-600 hover:hx-text-gray-900 hx-rounded-md hx-p-1.5 dark:hx-bg-primary-300/10 dark:hx-border-white/10 dark:hx-text-gray-400 dark:hover:hx-text-gray-50&#34;
    title=&#34;Copy code&#34;
  &gt;
    &lt;div class=&#34;copy-icon group-[.copied]/copybtn:hx-hidden hx-pointer-events-none hx-h-4 hx-w-4&#34;&gt;&lt;/div&gt;
    &lt;div class=&#34;success-icon hx-hidden group-[.copied]/copybtn:hx-block hx-pointer-events-none hx-h-4 hx-w-4&#34;&gt;&lt;/div&gt;
  &lt;/button&gt;
&lt;/div&gt;
&lt;/div&gt;
&lt;p&gt;Determines the authentication mechanism used for user login. Options: &lt;code&gt;local&lt;/code&gt; (Cavaliba internal user database), &lt;code&gt;basic&lt;/code&gt; (HTTP Basic Auth), &lt;code&gt;oauth2&lt;/code&gt; (external identity provider), &lt;code&gt;forced&lt;/code&gt; (automatic login). Default to &lt;code&gt;local&lt;/code&gt; for initial deployment. &lt;code&gt;oauth2&lt;/code&gt; is recommended for enterprise or large user-base deployment.&lt;/p&gt;
&lt;h3&gt;CAVALIBA_FORCE_LOGIN&lt;span class=&#34;hx-absolute -hx-mt-20&#34; id=&#34;cavaliba_force_login&#34;&gt;&lt;/span&gt;
    &lt;a href=&#34;#cavaliba_force_login&#34; class=&#34;subheading-anchor&#34; aria-label=&#34;Permalink for this section&#34;&gt;&lt;/a&gt;&lt;/h3&gt;&lt;div class=&#34;hextra-code-block hx-relative hx-mt-6 first:hx-mt-0 hx-group/code&#34;&gt;

&lt;div&gt;&lt;pre&gt;&lt;code&gt;CAVALIBA_FORCE_LOGIN=admin&lt;/code&gt;&lt;/pre&gt;&lt;/div&gt;&lt;div class=&#34;hextra-code-copy-btn-container hx-opacity-0 hx-transition group-hover/code:hx-opacity-100 hx-flex hx-gap-1 hx-absolute hx-m-[11px] hx-right-0 hx-top-0&#34;&gt;
  &lt;button
    class=&#34;hextra-code-copy-btn hx-group/copybtn hx-transition-all active:hx-opacity-50 hx-bg-primary-700/5 hx-border hx-border-black/5 hx-text-gray-600 hover:hx-text-gray-900 hx-rounded-md hx-p-1.5 dark:hx-bg-primary-300/10 dark:hx-border-white/10 dark:hx-text-gray-400 dark:hover:hx-text-gray-50&#34;
    title=&#34;Copy code&#34;
  &gt;
    &lt;div class=&#34;copy-icon group-[.copied]/copybtn:hx-hidden hx-pointer-events-none hx-h-4 hx-w-4&#34;&gt;&lt;/div&gt;
    &lt;div class=&#34;success-icon hx-hidden group-[.copied]/copybtn:hx-block hx-pointer-events-none hx-h-4 hx-w-4&#34;&gt;&lt;/div&gt;
  &lt;/button&gt;
&lt;/div&gt;
&lt;/div&gt;
&lt;p&gt;Username to automatically log in when using &lt;code&gt;forced&lt;/code&gt; authentication mode. When set, all requests are authenticated as this user without requiring credentials. Only used when &lt;code&gt;CAVALIBA_AUTH_MODE=forced&lt;/code&gt;. Useful for individual use, demo / tests.&lt;/p&gt;
&lt;h3&gt;CAVALIBA_ADMIN_PASSWORD&lt;span class=&#34;hx-absolute -hx-mt-20&#34; id=&#34;cavaliba_admin_password&#34;&gt;&lt;/span&gt;
    &lt;a href=&#34;#cavaliba_admin_password&#34; class=&#34;subheading-anchor&#34; aria-label=&#34;Permalink for this section&#34;&gt;&lt;/a&gt;&lt;/h3&gt;&lt;div class=&#34;hextra-code-block hx-relative hx-mt-6 first:hx-mt-0 hx-group/code&#34;&gt;

&lt;div&gt;&lt;pre&gt;&lt;code&gt;CAVALIBA_ADMIN_PASSWORD=change_again&lt;/code&gt;&lt;/pre&gt;&lt;/div&gt;&lt;div class=&#34;hextra-code-copy-btn-container hx-opacity-0 hx-transition group-hover/code:hx-opacity-100 hx-flex hx-gap-1 hx-absolute hx-m-[11px] hx-right-0 hx-top-0&#34;&gt;
  &lt;button
    class=&#34;hextra-code-copy-btn hx-group/copybtn hx-transition-all active:hx-opacity-50 hx-bg-primary-700/5 hx-border hx-border-black/5 hx-text-gray-600 hover:hx-text-gray-900 hx-rounded-md hx-p-1.5 dark:hx-bg-primary-300/10 dark:hx-border-white/10 dark:hx-text-gray-400 dark:hover:hx-text-gray-50&#34;
    title=&#34;Copy code&#34;
  &gt;
    &lt;div class=&#34;copy-icon group-[.copied]/copybtn:hx-hidden hx-pointer-events-none hx-h-4 hx-w-4&#34;&gt;&lt;/div&gt;
    &lt;div class=&#34;success-icon hx-hidden group-[.copied]/copybtn:hx-block hx-pointer-events-none hx-h-4 hx-w-4&#34;&gt;&lt;/div&gt;
  &lt;/button&gt;
&lt;/div&gt;
&lt;/div&gt;
&lt;p&gt;Initial password for the default admin user account used to access the Cavaliba web interface. The login is &lt;code&gt;admin&lt;/code&gt;. Set this value immediately before first start. To change the password later, use the database admin tool or Django manage tool with &lt;code&gt;createsuperuser&lt;/code&gt; command.&lt;/p&gt;
&lt;h3&gt;CAVALIBA_ADMIN_EMAIL&lt;span class=&#34;hx-absolute -hx-mt-20&#34; id=&#34;cavaliba_admin_email&#34;&gt;&lt;/span&gt;
    &lt;a href=&#34;#cavaliba_admin_email&#34; class=&#34;subheading-anchor&#34; aria-label=&#34;Permalink for this section&#34;&gt;&lt;/a&gt;&lt;/h3&gt;&lt;div class=&#34;hextra-code-block hx-relative hx-mt-6 first:hx-mt-0 hx-group/code&#34;&gt;

&lt;div&gt;&lt;pre&gt;&lt;code&gt;CAVALIBA_ADMIN_EMAIL=admin@mydomain.com&lt;/code&gt;&lt;/pre&gt;&lt;/div&gt;&lt;div class=&#34;hextra-code-copy-btn-container hx-opacity-0 hx-transition group-hover/code:hx-opacity-100 hx-flex hx-gap-1 hx-absolute hx-m-[11px] hx-right-0 hx-top-0&#34;&gt;
  &lt;button
    class=&#34;hextra-code-copy-btn hx-group/copybtn hx-transition-all active:hx-opacity-50 hx-bg-primary-700/5 hx-border hx-border-black/5 hx-text-gray-600 hover:hx-text-gray-900 hx-rounded-md hx-p-1.5 dark:hx-bg-primary-300/10 dark:hx-border-white/10 dark:hx-text-gray-400 dark:hover:hx-text-gray-50&#34;
    title=&#34;Copy code&#34;
  &gt;
    &lt;div class=&#34;copy-icon group-[.copied]/copybtn:hx-hidden hx-pointer-events-none hx-h-4 hx-w-4&#34;&gt;&lt;/div&gt;
    &lt;div class=&#34;success-icon hx-hidden group-[.copied]/copybtn:hx-block hx-pointer-events-none hx-h-4 hx-w-4&#34;&gt;&lt;/div&gt;
  &lt;/button&gt;
&lt;/div&gt;
&lt;/div&gt;
&lt;p&gt;Email address associated with the default admin user account. Used for password recovery and administrative notifications. Can be modified through the UI after login.&lt;/p&gt;
&lt;h3&gt;CAVALIBA_SESSION_DURATION&lt;span class=&#34;hx-absolute -hx-mt-20&#34; id=&#34;cavaliba_session_duration&#34;&gt;&lt;/span&gt;
    &lt;a href=&#34;#cavaliba_session_duration&#34; class=&#34;subheading-anchor&#34; aria-label=&#34;Permalink for this section&#34;&gt;&lt;/a&gt;&lt;/h3&gt;&lt;div class=&#34;hextra-code-block hx-relative hx-mt-6 first:hx-mt-0 hx-group/code&#34;&gt;

&lt;div&gt;&lt;pre&gt;&lt;code&gt;CAVALIBA_SESSION_DURATION=3600&lt;/code&gt;&lt;/pre&gt;&lt;/div&gt;&lt;div class=&#34;hextra-code-copy-btn-container hx-opacity-0 hx-transition group-hover/code:hx-opacity-100 hx-flex hx-gap-1 hx-absolute hx-m-[11px] hx-right-0 hx-top-0&#34;&gt;
  &lt;button
    class=&#34;hextra-code-copy-btn hx-group/copybtn hx-transition-all active:hx-opacity-50 hx-bg-primary-700/5 hx-border hx-border-black/5 hx-text-gray-600 hover:hx-text-gray-900 hx-rounded-md hx-p-1.5 dark:hx-bg-primary-300/10 dark:hx-border-white/10 dark:hx-text-gray-400 dark:hover:hx-text-gray-50&#34;
    title=&#34;Copy code&#34;
  &gt;
    &lt;div class=&#34;copy-icon group-[.copied]/copybtn:hx-hidden hx-pointer-events-none hx-h-4 hx-w-4&#34;&gt;&lt;/div&gt;
    &lt;div class=&#34;success-icon hx-hidden group-[.copied]/copybtn:hx-block hx-pointer-events-none hx-h-4 hx-w-4&#34;&gt;&lt;/div&gt;
  &lt;/button&gt;
&lt;/div&gt;
&lt;/div&gt;
&lt;p&gt;Maximum session timeout in seconds for inactive users (default: 3600 = 1 hour). After this period of inactivity, users are automatically logged out for security. Example: Set to &lt;code&gt;7200&lt;/code&gt; for 2 hours.&lt;/p&gt;
&lt;hr&gt;
&lt;h2&gt;Network and Security&lt;span class=&#34;hx-absolute -hx-mt-20&#34; id=&#34;network-and-security&#34;&gt;&lt;/span&gt;
    &lt;a href=&#34;#network-and-security&#34; class=&#34;subheading-anchor&#34; aria-label=&#34;Permalink for this section&#34;&gt;&lt;/a&gt;&lt;/h2&gt;&lt;h3&gt;CAVALIBA_PORT&lt;span class=&#34;hx-absolute -hx-mt-20&#34; id=&#34;cavaliba_port&#34;&gt;&lt;/span&gt;
    &lt;a href=&#34;#cavaliba_port&#34; class=&#34;subheading-anchor&#34; aria-label=&#34;Permalink for this section&#34;&gt;&lt;/a&gt;&lt;/h3&gt;&lt;div class=&#34;hextra-code-block hx-relative hx-mt-6 first:hx-mt-0 hx-group/code&#34;&gt;

&lt;div&gt;&lt;pre&gt;&lt;code&gt;CAVALIBA_PORT=8000&lt;/code&gt;&lt;/pre&gt;&lt;/div&gt;&lt;div class=&#34;hextra-code-copy-btn-container hx-opacity-0 hx-transition group-hover/code:hx-opacity-100 hx-flex hx-gap-1 hx-absolute hx-m-[11px] hx-right-0 hx-top-0&#34;&gt;
  &lt;button
    class=&#34;hextra-code-copy-btn hx-group/copybtn hx-transition-all active:hx-opacity-50 hx-bg-primary-700/5 hx-border hx-border-black/5 hx-text-gray-600 hover:hx-text-gray-900 hx-rounded-md hx-p-1.5 dark:hx-bg-primary-300/10 dark:hx-border-white/10 dark:hx-text-gray-400 dark:hover:hx-text-gray-50&#34;
    title=&#34;Copy code&#34;
  &gt;
    &lt;div class=&#34;copy-icon group-[.copied]/copybtn:hx-hidden hx-pointer-events-none hx-h-4 hx-w-4&#34;&gt;&lt;/div&gt;
    &lt;div class=&#34;success-icon hx-hidden group-[.copied]/copybtn:hx-block hx-pointer-events-none hx-h-4 hx-w-4&#34;&gt;&lt;/div&gt;
  &lt;/button&gt;
&lt;/div&gt;
&lt;/div&gt;
&lt;p&gt;Network port the Cavaliba nginx container will expose and listen to on the host. This is the port users use to access the application. Must not conflict with other services. Example: Set to &lt;code&gt;80&lt;/code&gt; for HTTP, &lt;code&gt;8080&lt;/code&gt; for alternative port.&lt;/p&gt;
&lt;h3&gt;CAVALIBA_CSRF_TRUSTED_ORIGINS&lt;span class=&#34;hx-absolute -hx-mt-20&#34; id=&#34;cavaliba_csrf_trusted_origins&#34;&gt;&lt;/span&gt;
    &lt;a href=&#34;#cavaliba_csrf_trusted_origins&#34; class=&#34;subheading-anchor&#34; aria-label=&#34;Permalink for this section&#34;&gt;&lt;/a&gt;&lt;/h3&gt;&lt;div class=&#34;hextra-code-block hx-relative hx-mt-6 first:hx-mt-0 hx-group/code&#34;&gt;

&lt;div&gt;&lt;pre&gt;&lt;code&gt;CAVALIBA_CSRF_TRUSTED_ORIGINS=&amp;#34;http://127.0.0.1:8000 https://mycavaliba.mydomain.com&amp;#34;&lt;/code&gt;&lt;/pre&gt;&lt;/div&gt;&lt;div class=&#34;hextra-code-copy-btn-container hx-opacity-0 hx-transition group-hover/code:hx-opacity-100 hx-flex hx-gap-1 hx-absolute hx-m-[11px] hx-right-0 hx-top-0&#34;&gt;
  &lt;button
    class=&#34;hextra-code-copy-btn hx-group/copybtn hx-transition-all active:hx-opacity-50 hx-bg-primary-700/5 hx-border hx-border-black/5 hx-text-gray-600 hover:hx-text-gray-900 hx-rounded-md hx-p-1.5 dark:hx-bg-primary-300/10 dark:hx-border-white/10 dark:hx-text-gray-400 dark:hover:hx-text-gray-50&#34;
    title=&#34;Copy code&#34;
  &gt;
    &lt;div class=&#34;copy-icon group-[.copied]/copybtn:hx-hidden hx-pointer-events-none hx-h-4 hx-w-4&#34;&gt;&lt;/div&gt;
    &lt;div class=&#34;success-icon hx-hidden group-[.copied]/copybtn:hx-block hx-pointer-events-none hx-h-4 hx-w-4&#34;&gt;&lt;/div&gt;
  &lt;/button&gt;
&lt;/div&gt;
&lt;/div&gt;
&lt;p&gt;Space-separated list of allowed origins (schema, FQDN and port) for CSRF protection. CSRF protection will be valid only for the listed entries. &lt;strong&gt;You must set this entry according to your environment&lt;/strong&gt;. Example: &lt;code&gt;https://cavaliba.company.com&lt;/code&gt; for production.&lt;/p&gt;
&lt;h3&gt;CAVALIBA_ALLOWED_HOSTS&lt;span class=&#34;hx-absolute -hx-mt-20&#34; id=&#34;cavaliba_allowed_hosts&#34;&gt;&lt;/span&gt;
    &lt;a href=&#34;#cavaliba_allowed_hosts&#34; class=&#34;subheading-anchor&#34; aria-label=&#34;Permalink for this section&#34;&gt;&lt;/a&gt;&lt;/h3&gt;&lt;div class=&#34;hextra-code-block hx-relative hx-mt-6 first:hx-mt-0 hx-group/code&#34;&gt;

&lt;div&gt;&lt;pre&gt;&lt;code&gt;CAVALIBA_ALLOWED_HOSTS=&amp;#34;localhost 127.0.0.1 *&amp;#34;&lt;/code&gt;&lt;/pre&gt;&lt;/div&gt;&lt;div class=&#34;hextra-code-copy-btn-container hx-opacity-0 hx-transition group-hover/code:hx-opacity-100 hx-flex hx-gap-1 hx-absolute hx-m-[11px] hx-right-0 hx-top-0&#34;&gt;
  &lt;button
    class=&#34;hextra-code-copy-btn hx-group/copybtn hx-transition-all active:hx-opacity-50 hx-bg-primary-700/5 hx-border hx-border-black/5 hx-text-gray-600 hover:hx-text-gray-900 hx-rounded-md hx-p-1.5 dark:hx-bg-primary-300/10 dark:hx-border-white/10 dark:hx-text-gray-400 dark:hover:hx-text-gray-50&#34;
    title=&#34;Copy code&#34;
  &gt;
    &lt;div class=&#34;copy-icon group-[.copied]/copybtn:hx-hidden hx-pointer-events-none hx-h-4 hx-w-4&#34;&gt;&lt;/div&gt;
    &lt;div class=&#34;success-icon hx-hidden group-[.copied]/copybtn:hx-block hx-pointer-events-none hx-h-4 hx-w-4&#34;&gt;&lt;/div&gt;
  &lt;/button&gt;
&lt;/div&gt;
&lt;/div&gt;
&lt;p&gt;A space-separated list of strings representing the host/domain names that this Django site can serve. This is a security measure to prevent HTTP Host header attacks, which are possible even under many seemingly-safe web server configurations. Example: &lt;code&gt;cavaliba.example.com cavaliba-backup.example.com&lt;/code&gt; for specific hosts.&lt;/p&gt;
&lt;h3&gt;CAVALIBA_SECRET_KEY&lt;span class=&#34;hx-absolute -hx-mt-20&#34; id=&#34;cavaliba_secret_key&#34;&gt;&lt;/span&gt;
    &lt;a href=&#34;#cavaliba_secret_key&#34; class=&#34;subheading-anchor&#34; aria-label=&#34;Permalink for this section&#34;&gt;&lt;/a&gt;&lt;/h3&gt;&lt;div class=&#34;hextra-code-block hx-relative hx-mt-6 first:hx-mt-0 hx-group/code&#34;&gt;

&lt;div&gt;&lt;pre&gt;&lt;code&gt;CAVALIBA_SECRET_KEY=changeme_with_a_long_string&lt;/code&gt;&lt;/pre&gt;&lt;/div&gt;&lt;div class=&#34;hextra-code-copy-btn-container hx-opacity-0 hx-transition group-hover/code:hx-opacity-100 hx-flex hx-gap-1 hx-absolute hx-m-[11px] hx-right-0 hx-top-0&#34;&gt;
  &lt;button
    class=&#34;hextra-code-copy-btn hx-group/copybtn hx-transition-all active:hx-opacity-50 hx-bg-primary-700/5 hx-border hx-border-black/5 hx-text-gray-600 hover:hx-text-gray-900 hx-rounded-md hx-p-1.5 dark:hx-bg-primary-300/10 dark:hx-border-white/10 dark:hx-text-gray-400 dark:hover:hx-text-gray-50&#34;
    title=&#34;Copy code&#34;
  &gt;
    &lt;div class=&#34;copy-icon group-[.copied]/copybtn:hx-hidden hx-pointer-events-none hx-h-4 hx-w-4&#34;&gt;&lt;/div&gt;
    &lt;div class=&#34;success-icon hx-hidden group-[.copied]/copybtn:hx-block hx-pointer-events-none hx-h-4 hx-w-4&#34;&gt;&lt;/div&gt;
  &lt;/button&gt;
&lt;/div&gt;
&lt;/div&gt;
&lt;p&gt;A random long string used to protect session cookies in Cavaliba. Must be changed from the default for security. If you change the value and restart Cavaliba, all users will be signed-out of the application. Example: Use a 50+ character random string.&lt;/p&gt;
&lt;h3&gt;CAVALIBA_CIPHER_KEY&lt;span class=&#34;hx-absolute -hx-mt-20&#34; id=&#34;cavaliba_cipher_key&#34;&gt;&lt;/span&gt;
    &lt;a href=&#34;#cavaliba_cipher_key&#34; class=&#34;subheading-anchor&#34; aria-label=&#34;Permalink for this section&#34;&gt;&lt;/a&gt;&lt;/h3&gt;&lt;div class=&#34;hextra-code-block hx-relative hx-mt-6 first:hx-mt-0 hx-group/code&#34;&gt;

&lt;div&gt;&lt;pre&gt;&lt;code&gt;CAVALIBA_CIPHER_KEY=&amp;#34;a_very_secret_string&amp;#34;&lt;/code&gt;&lt;/pre&gt;&lt;/div&gt;&lt;div class=&#34;hextra-code-copy-btn-container hx-opacity-0 hx-transition group-hover/code:hx-opacity-100 hx-flex hx-gap-1 hx-absolute hx-m-[11px] hx-right-0 hx-top-0&#34;&gt;
  &lt;button
    class=&#34;hextra-code-copy-btn hx-group/copybtn hx-transition-all active:hx-opacity-50 hx-bg-primary-700/5 hx-border hx-border-black/5 hx-text-gray-600 hover:hx-text-gray-900 hx-rounded-md hx-p-1.5 dark:hx-bg-primary-300/10 dark:hx-border-white/10 dark:hx-text-gray-400 dark:hover:hx-text-gray-50&#34;
    title=&#34;Copy code&#34;
  &gt;
    &lt;div class=&#34;copy-icon group-[.copied]/copybtn:hx-hidden hx-pointer-events-none hx-h-4 hx-w-4&#34;&gt;&lt;/div&gt;
    &lt;div class=&#34;success-icon hx-hidden group-[.copied]/copybtn:hx-block hx-pointer-events-none hx-h-4 hx-w-4&#34;&gt;&lt;/div&gt;
  &lt;/button&gt;
&lt;/div&gt;
&lt;/div&gt;
&lt;p&gt;The secret key to encrypt sensitive information in the Cavaliba Database (e.g., user passwords, API tokens, SMS content). If you lose or change this value, previous encrypted content from the database will be lost. Use a strong, random string and keep it secure.&lt;/p&gt;
&lt;hr&gt;
&lt;h2&gt;Tenant and Multi-Instance&lt;span class=&#34;hx-absolute -hx-mt-20&#34; id=&#34;tenant-and-multi-instance&#34;&gt;&lt;/span&gt;
    &lt;a href=&#34;#tenant-and-multi-instance&#34; class=&#34;subheading-anchor&#34; aria-label=&#34;Permalink for this section&#34;&gt;&lt;/a&gt;&lt;/h2&gt;&lt;h3&gt;CAVALIBA_TENANT&lt;span class=&#34;hx-absolute -hx-mt-20&#34; id=&#34;cavaliba_tenant&#34;&gt;&lt;/span&gt;
    &lt;a href=&#34;#cavaliba_tenant&#34; class=&#34;subheading-anchor&#34; aria-label=&#34;Permalink for this section&#34;&gt;&lt;/a&gt;&lt;/h3&gt;&lt;div class=&#34;hextra-code-block hx-relative hx-mt-6 first:hx-mt-0 hx-group/code&#34;&gt;

&lt;div&gt;&lt;pre&gt;&lt;code&gt;CAVALIBA_TENANT=cavaliba&lt;/code&gt;&lt;/pre&gt;&lt;/div&gt;&lt;div class=&#34;hextra-code-copy-btn-container hx-opacity-0 hx-transition group-hover/code:hx-opacity-100 hx-flex hx-gap-1 hx-absolute hx-m-[11px] hx-right-0 hx-top-0&#34;&gt;
  &lt;button
    class=&#34;hextra-code-copy-btn hx-group/copybtn hx-transition-all active:hx-opacity-50 hx-bg-primary-700/5 hx-border hx-border-black/5 hx-text-gray-600 hover:hx-text-gray-900 hx-rounded-md hx-p-1.5 dark:hx-bg-primary-300/10 dark:hx-border-white/10 dark:hx-text-gray-400 dark:hover:hx-text-gray-50&#34;
    title=&#34;Copy code&#34;
  &gt;
    &lt;div class=&#34;copy-icon group-[.copied]/copybtn:hx-hidden hx-pointer-events-none hx-h-4 hx-w-4&#34;&gt;&lt;/div&gt;
    &lt;div class=&#34;success-icon hx-hidden group-[.copied]/copybtn:hx-block hx-pointer-events-none hx-h-4 hx-w-4&#34;&gt;&lt;/div&gt;
  &lt;/button&gt;
&lt;/div&gt;
&lt;/div&gt;
&lt;p&gt;The name/prefix of the docker objects (container name, docker network) created when starting Cavaliba. Use one value per docker-compose.yml file to start several simultaneous Cavaliba instances on the same host. Don&amp;rsquo;t forget to also select a different network listening port for each. Each instance is isolated on a different docker bridge. Example: &lt;code&gt;cavaliba-prod&lt;/code&gt;, &lt;code&gt;cavaliba-test&lt;/code&gt;, &lt;code&gt;cavaliba-dev&lt;/code&gt;.&lt;/p&gt;
&lt;hr&gt;
&lt;h2&gt;Database Configuration&lt;span class=&#34;hx-absolute -hx-mt-20&#34; id=&#34;database-configuration&#34;&gt;&lt;/span&gt;
    &lt;a href=&#34;#database-configuration&#34; class=&#34;subheading-anchor&#34; aria-label=&#34;Permalink for this section&#34;&gt;&lt;/a&gt;&lt;/h2&gt;&lt;h3&gt;CAVALIBA_DB_ENGINE&lt;span class=&#34;hx-absolute -hx-mt-20&#34; id=&#34;cavaliba_db_engine&#34;&gt;&lt;/span&gt;
    &lt;a href=&#34;#cavaliba_db_engine&#34; class=&#34;subheading-anchor&#34; aria-label=&#34;Permalink for this section&#34;&gt;&lt;/a&gt;&lt;/h3&gt;&lt;div class=&#34;hextra-code-block hx-relative hx-mt-6 first:hx-mt-0 hx-group/code&#34;&gt;

&lt;div&gt;&lt;pre&gt;&lt;code&gt;CAVALIBA_DB_ENGINE=django.db.backends.mysql&lt;/code&gt;&lt;/pre&gt;&lt;/div&gt;&lt;div class=&#34;hextra-code-copy-btn-container hx-opacity-0 hx-transition group-hover/code:hx-opacity-100 hx-flex hx-gap-1 hx-absolute hx-m-[11px] hx-right-0 hx-top-0&#34;&gt;
  &lt;button
    class=&#34;hextra-code-copy-btn hx-group/copybtn hx-transition-all active:hx-opacity-50 hx-bg-primary-700/5 hx-border hx-border-black/5 hx-text-gray-600 hover:hx-text-gray-900 hx-rounded-md hx-p-1.5 dark:hx-bg-primary-300/10 dark:hx-border-white/10 dark:hx-text-gray-400 dark:hover:hx-text-gray-50&#34;
    title=&#34;Copy code&#34;
  &gt;
    &lt;div class=&#34;copy-icon group-[.copied]/copybtn:hx-hidden hx-pointer-events-none hx-h-4 hx-w-4&#34;&gt;&lt;/div&gt;
    &lt;div class=&#34;success-icon hx-hidden group-[.copied]/copybtn:hx-block hx-pointer-events-none hx-h-4 hx-w-4&#34;&gt;&lt;/div&gt;
  &lt;/button&gt;
&lt;/div&gt;
&lt;/div&gt;
&lt;p&gt;The database backend type. Options: &lt;code&gt;django.db.backends.mysql&lt;/code&gt; (MariaDB/MySQL - default, production-tested), &lt;code&gt;django.db.backends.postgresql&lt;/code&gt; (PostgreSQL - beta support). For now, only MariaDB/MySQL is recommended for production.&lt;/p&gt;
&lt;h3&gt;CAVALIBA_DB_HOST&lt;span class=&#34;hx-absolute -hx-mt-20&#34; id=&#34;cavaliba_db_host&#34;&gt;&lt;/span&gt;
    &lt;a href=&#34;#cavaliba_db_host&#34; class=&#34;subheading-anchor&#34; aria-label=&#34;Permalink for this section&#34;&gt;&lt;/a&gt;&lt;/h3&gt;&lt;div class=&#34;hextra-code-block hx-relative hx-mt-6 first:hx-mt-0 hx-group/code&#34;&gt;

&lt;div&gt;&lt;pre&gt;&lt;code&gt;CAVALIBA_DB_HOST=cavaliba_db&lt;/code&gt;&lt;/pre&gt;&lt;/div&gt;&lt;div class=&#34;hextra-code-copy-btn-container hx-opacity-0 hx-transition group-hover/code:hx-opacity-100 hx-flex hx-gap-1 hx-absolute hx-m-[11px] hx-right-0 hx-top-0&#34;&gt;
  &lt;button
    class=&#34;hextra-code-copy-btn hx-group/copybtn hx-transition-all active:hx-opacity-50 hx-bg-primary-700/5 hx-border hx-border-black/5 hx-text-gray-600 hover:hx-text-gray-900 hx-rounded-md hx-p-1.5 dark:hx-bg-primary-300/10 dark:hx-border-white/10 dark:hx-text-gray-400 dark:hover:hx-text-gray-50&#34;
    title=&#34;Copy code&#34;
  &gt;
    &lt;div class=&#34;copy-icon group-[.copied]/copybtn:hx-hidden hx-pointer-events-none hx-h-4 hx-w-4&#34;&gt;&lt;/div&gt;
    &lt;div class=&#34;success-icon hx-hidden group-[.copied]/copybtn:hx-block hx-pointer-events-none hx-h-4 hx-w-4&#34;&gt;&lt;/div&gt;
  &lt;/button&gt;
&lt;/div&gt;
&lt;/div&gt;
&lt;p&gt;Hostname or IP address of the database server. The &lt;code&gt;cavaliba_db&lt;/code&gt; is the docker DNS name of the internal database service. If you decide to use an external DB server (physical/VM or cloud service), replace with the exact hostname/FQDN. Example: &lt;code&gt;db.example.com&lt;/code&gt; or &lt;code&gt;10.0.0.50&lt;/code&gt;.&lt;/p&gt;
&lt;h3&gt;CAVALIBA_DB_PORT&lt;span class=&#34;hx-absolute -hx-mt-20&#34; id=&#34;cavaliba_db_port&#34;&gt;&lt;/span&gt;
    &lt;a href=&#34;#cavaliba_db_port&#34; class=&#34;subheading-anchor&#34; aria-label=&#34;Permalink for this section&#34;&gt;&lt;/a&gt;&lt;/h3&gt;&lt;div class=&#34;hextra-code-block hx-relative hx-mt-6 first:hx-mt-0 hx-group/code&#34;&gt;

&lt;div&gt;&lt;pre&gt;&lt;code&gt;CAVALIBA_DB_PORT=3306&lt;/code&gt;&lt;/pre&gt;&lt;/div&gt;&lt;div class=&#34;hextra-code-copy-btn-container hx-opacity-0 hx-transition group-hover/code:hx-opacity-100 hx-flex hx-gap-1 hx-absolute hx-m-[11px] hx-right-0 hx-top-0&#34;&gt;
  &lt;button
    class=&#34;hextra-code-copy-btn hx-group/copybtn hx-transition-all active:hx-opacity-50 hx-bg-primary-700/5 hx-border hx-border-black/5 hx-text-gray-600 hover:hx-text-gray-900 hx-rounded-md hx-p-1.5 dark:hx-bg-primary-300/10 dark:hx-border-white/10 dark:hx-text-gray-400 dark:hover:hx-text-gray-50&#34;
    title=&#34;Copy code&#34;
  &gt;
    &lt;div class=&#34;copy-icon group-[.copied]/copybtn:hx-hidden hx-pointer-events-none hx-h-4 hx-w-4&#34;&gt;&lt;/div&gt;
    &lt;div class=&#34;success-icon hx-hidden group-[.copied]/copybtn:hx-block hx-pointer-events-none hx-h-4 hx-w-4&#34;&gt;&lt;/div&gt;
  &lt;/button&gt;
&lt;/div&gt;
&lt;/div&gt;
&lt;p&gt;Port number for database connection. Default: &lt;code&gt;3306&lt;/code&gt; for MySQL/MariaDB, &lt;code&gt;5432&lt;/code&gt; for PostgreSQL. Must match the database service configuration. Ensure the port is open and accessible from the Cavaliba container.&lt;/p&gt;
&lt;h3&gt;CAVALIBA_DB_DATABASE&lt;span class=&#34;hx-absolute -hx-mt-20&#34; id=&#34;cavaliba_db_database&#34;&gt;&lt;/span&gt;
    &lt;a href=&#34;#cavaliba_db_database&#34; class=&#34;subheading-anchor&#34; aria-label=&#34;Permalink for this section&#34;&gt;&lt;/a&gt;&lt;/h3&gt;&lt;div class=&#34;hextra-code-block hx-relative hx-mt-6 first:hx-mt-0 hx-group/code&#34;&gt;

&lt;div&gt;&lt;pre&gt;&lt;code&gt;CAVALIBA_DB_DATABASE=cavaliba&lt;/code&gt;&lt;/pre&gt;&lt;/div&gt;&lt;div class=&#34;hextra-code-copy-btn-container hx-opacity-0 hx-transition group-hover/code:hx-opacity-100 hx-flex hx-gap-1 hx-absolute hx-m-[11px] hx-right-0 hx-top-0&#34;&gt;
  &lt;button
    class=&#34;hextra-code-copy-btn hx-group/copybtn hx-transition-all active:hx-opacity-50 hx-bg-primary-700/5 hx-border hx-border-black/5 hx-text-gray-600 hover:hx-text-gray-900 hx-rounded-md hx-p-1.5 dark:hx-bg-primary-300/10 dark:hx-border-white/10 dark:hx-text-gray-400 dark:hover:hx-text-gray-50&#34;
    title=&#34;Copy code&#34;
  &gt;
    &lt;div class=&#34;copy-icon group-[.copied]/copybtn:hx-hidden hx-pointer-events-none hx-h-4 hx-w-4&#34;&gt;&lt;/div&gt;
    &lt;div class=&#34;success-icon hx-hidden group-[.copied]/copybtn:hx-block hx-pointer-events-none hx-h-4 hx-w-4&#34;&gt;&lt;/div&gt;
  &lt;/button&gt;
&lt;/div&gt;
&lt;/div&gt;
&lt;p&gt;Name of the database created for Cavaliba. The application expects this database to exist with appropriate schema. Can be customized per deployment. Example: &lt;code&gt;cavaliba_prod&lt;/code&gt;, &lt;code&gt;my_app_db&lt;/code&gt;.&lt;/p&gt;
&lt;h3&gt;CAVALIBA_DB_USER&lt;span class=&#34;hx-absolute -hx-mt-20&#34; id=&#34;cavaliba_db_user&#34;&gt;&lt;/span&gt;
    &lt;a href=&#34;#cavaliba_db_user&#34; class=&#34;subheading-anchor&#34; aria-label=&#34;Permalink for this section&#34;&gt;&lt;/a&gt;&lt;/h3&gt;&lt;div class=&#34;hextra-code-block hx-relative hx-mt-6 first:hx-mt-0 hx-group/code&#34;&gt;

&lt;div&gt;&lt;pre&gt;&lt;code&gt;CAVALIBA_DB_USER=cavaliba&lt;/code&gt;&lt;/pre&gt;&lt;/div&gt;&lt;div class=&#34;hextra-code-copy-btn-container hx-opacity-0 hx-transition group-hover/code:hx-opacity-100 hx-flex hx-gap-1 hx-absolute hx-m-[11px] hx-right-0 hx-top-0&#34;&gt;
  &lt;button
    class=&#34;hextra-code-copy-btn hx-group/copybtn hx-transition-all active:hx-opacity-50 hx-bg-primary-700/5 hx-border hx-border-black/5 hx-text-gray-600 hover:hx-text-gray-900 hx-rounded-md hx-p-1.5 dark:hx-bg-primary-300/10 dark:hx-border-white/10 dark:hx-text-gray-400 dark:hover:hx-text-gray-50&#34;
    title=&#34;Copy code&#34;
  &gt;
    &lt;div class=&#34;copy-icon group-[.copied]/copybtn:hx-hidden hx-pointer-events-none hx-h-4 hx-w-4&#34;&gt;&lt;/div&gt;
    &lt;div class=&#34;success-icon hx-hidden group-[.copied]/copybtn:hx-block hx-pointer-events-none hx-h-4 hx-w-4&#34;&gt;&lt;/div&gt;
  &lt;/button&gt;
&lt;/div&gt;
&lt;/div&gt;
&lt;p&gt;Database user account for Cavaliba application connections. This user needs SELECT, INSERT, UPDATE, DELETE, CREATE privileges on the Cavaliba database. Example: &lt;code&gt;cavaliba_app&lt;/code&gt;, &lt;code&gt;app_user&lt;/code&gt;.&lt;/p&gt;
&lt;h3&gt;CAVALIBA_DB_PASSWORD&lt;span class=&#34;hx-absolute -hx-mt-20&#34; id=&#34;cavaliba_db_password&#34;&gt;&lt;/span&gt;
    &lt;a href=&#34;#cavaliba_db_password&#34; class=&#34;subheading-anchor&#34; aria-label=&#34;Permalink for this section&#34;&gt;&lt;/a&gt;&lt;/h3&gt;&lt;div class=&#34;hextra-code-block hx-relative hx-mt-6 first:hx-mt-0 hx-group/code&#34;&gt;

&lt;div&gt;&lt;pre&gt;&lt;code&gt;CAVALIBA_DB_PASSWORD=changeme_please&lt;/code&gt;&lt;/pre&gt;&lt;/div&gt;&lt;div class=&#34;hextra-code-copy-btn-container hx-opacity-0 hx-transition group-hover/code:hx-opacity-100 hx-flex hx-gap-1 hx-absolute hx-m-[11px] hx-right-0 hx-top-0&#34;&gt;
  &lt;button
    class=&#34;hextra-code-copy-btn hx-group/copybtn hx-transition-all active:hx-opacity-50 hx-bg-primary-700/5 hx-border hx-border-black/5 hx-text-gray-600 hover:hx-text-gray-900 hx-rounded-md hx-p-1.5 dark:hx-bg-primary-300/10 dark:hx-border-white/10 dark:hx-text-gray-400 dark:hover:hx-text-gray-50&#34;
    title=&#34;Copy code&#34;
  &gt;
    &lt;div class=&#34;copy-icon group-[.copied]/copybtn:hx-hidden hx-pointer-events-none hx-h-4 hx-w-4&#34;&gt;&lt;/div&gt;
    &lt;div class=&#34;success-icon hx-hidden group-[.copied]/copybtn:hx-block hx-pointer-events-none hx-h-4 hx-w-4&#34;&gt;&lt;/div&gt;
  &lt;/button&gt;
&lt;/div&gt;
&lt;/div&gt;
&lt;p&gt;Password for the database user account running Cavaliba application queries. Must be strong and kept secure. Different from &lt;code&gt;CAVALIBA_DB_ROOT_PASSWORD&lt;/code&gt;. Example: Use a 20+ character random string.&lt;/p&gt;
&lt;h3&gt;CAVALIBA_DB_ROOT_PASSWORD&lt;span class=&#34;hx-absolute -hx-mt-20&#34; id=&#34;cavaliba_db_root_password&#34;&gt;&lt;/span&gt;
    &lt;a href=&#34;#cavaliba_db_root_password&#34; class=&#34;subheading-anchor&#34; aria-label=&#34;Permalink for this section&#34;&gt;&lt;/a&gt;&lt;/h3&gt;&lt;div class=&#34;hextra-code-block hx-relative hx-mt-6 first:hx-mt-0 hx-group/code&#34;&gt;

&lt;div&gt;&lt;pre&gt;&lt;code&gt;CAVALIBA_DB_ROOT_PASSWORD=changeme_please_also&lt;/code&gt;&lt;/pre&gt;&lt;/div&gt;&lt;div class=&#34;hextra-code-copy-btn-container hx-opacity-0 hx-transition group-hover/code:hx-opacity-100 hx-flex hx-gap-1 hx-absolute hx-m-[11px] hx-right-0 hx-top-0&#34;&gt;
  &lt;button
    class=&#34;hextra-code-copy-btn hx-group/copybtn hx-transition-all active:hx-opacity-50 hx-bg-primary-700/5 hx-border hx-border-black/5 hx-text-gray-600 hover:hx-text-gray-900 hx-rounded-md hx-p-1.5 dark:hx-bg-primary-300/10 dark:hx-border-white/10 dark:hx-text-gray-400 dark:hover:hx-text-gray-50&#34;
    title=&#34;Copy code&#34;
  &gt;
    &lt;div class=&#34;copy-icon group-[.copied]/copybtn:hx-hidden hx-pointer-events-none hx-h-4 hx-w-4&#34;&gt;&lt;/div&gt;
    &lt;div class=&#34;success-icon hx-hidden group-[.copied]/copybtn:hx-block hx-pointer-events-none hx-h-4 hx-w-4&#34;&gt;&lt;/div&gt;
  &lt;/button&gt;
&lt;/div&gt;
&lt;/div&gt;
&lt;p&gt;Root/admin password for database administration and backup operations. Used by Docker Compose to initialize the database. Must be changed for security before production use. If the MariaDB is dedicated to Cavaliba, identical values for PASSWORD and ROOT_PASSWORD are acceptable.&lt;/p&gt;
&lt;hr&gt;
&lt;h2&gt;File Storage&lt;span class=&#34;hx-absolute -hx-mt-20&#34; id=&#34;file-storage&#34;&gt;&lt;/span&gt;
    &lt;a href=&#34;#file-storage&#34; class=&#34;subheading-anchor&#34; aria-label=&#34;Permalink for this section&#34;&gt;&lt;/a&gt;&lt;/h2&gt;&lt;h3&gt;CAVALIBA_FILESTORE&lt;span class=&#34;hx-absolute -hx-mt-20&#34; id=&#34;cavaliba_filestore&#34;&gt;&lt;/span&gt;
    &lt;a href=&#34;#cavaliba_filestore&#34; class=&#34;subheading-anchor&#34; aria-label=&#34;Permalink for this section&#34;&gt;&lt;/a&gt;&lt;/h3&gt;&lt;div class=&#34;hextra-code-block hx-relative hx-mt-6 first:hx-mt-0 hx-group/code&#34;&gt;

&lt;div&gt;&lt;pre&gt;&lt;code&gt;CAVALIBA_FILESTORE=&amp;#34;/app/files/filestore/&amp;#34;&lt;/code&gt;&lt;/pre&gt;&lt;/div&gt;&lt;div class=&#34;hextra-code-copy-btn-container hx-opacity-0 hx-transition group-hover/code:hx-opacity-100 hx-flex hx-gap-1 hx-absolute hx-m-[11px] hx-right-0 hx-top-0&#34;&gt;
  &lt;button
    class=&#34;hextra-code-copy-btn hx-group/copybtn hx-transition-all active:hx-opacity-50 hx-bg-primary-700/5 hx-border hx-border-black/5 hx-text-gray-600 hover:hx-text-gray-900 hx-rounded-md hx-p-1.5 dark:hx-bg-primary-300/10 dark:hx-border-white/10 dark:hx-text-gray-400 dark:hover:hx-text-gray-50&#34;
    title=&#34;Copy code&#34;
  &gt;
    &lt;div class=&#34;copy-icon group-[.copied]/copybtn:hx-hidden hx-pointer-events-none hx-h-4 hx-w-4&#34;&gt;&lt;/div&gt;
    &lt;div class=&#34;success-icon hx-hidden group-[.copied]/copybtn:hx-block hx-pointer-events-none hx-h-4 hx-w-4&#34;&gt;&lt;/div&gt;
  &lt;/button&gt;
&lt;/div&gt;
&lt;/div&gt;
&lt;p&gt;Directory path where uploaded files are stored. Must be writable by the application container. Can be mounted from a shared volume for persistent file storage across container restarts. Example: &lt;code&gt;/mnt/nfs/cavaliba/files/&lt;/code&gt; for NFS-mounted storage.&lt;/p&gt;
&lt;hr&gt;
&lt;h2&gt;Scheduled Tasks&lt;span class=&#34;hx-absolute -hx-mt-20&#34; id=&#34;scheduled-tasks&#34;&gt;&lt;/span&gt;
    &lt;a href=&#34;#scheduled-tasks&#34; class=&#34;subheading-anchor&#34; aria-label=&#34;Permalink for this section&#34;&gt;&lt;/a&gt;&lt;/h2&gt;&lt;h3&gt;CAVALIBA_HOUSEKEEPING_SCHEDULE&lt;span class=&#34;hx-absolute -hx-mt-20&#34; id=&#34;cavaliba_housekeeping_schedule&#34;&gt;&lt;/span&gt;
    &lt;a href=&#34;#cavaliba_housekeeping_schedule&#34; class=&#34;subheading-anchor&#34; aria-label=&#34;Permalink for this section&#34;&gt;&lt;/a&gt;&lt;/h3&gt;&lt;div class=&#34;hextra-code-block hx-relative hx-mt-6 first:hx-mt-0 hx-group/code&#34;&gt;

&lt;div&gt;&lt;pre&gt;&lt;code&gt;CAVALIBA_HOUSEKEEPING_SCHEDULE=&amp;#34;21:34&amp;#34;&lt;/code&gt;&lt;/pre&gt;&lt;/div&gt;&lt;div class=&#34;hextra-code-copy-btn-container hx-opacity-0 hx-transition group-hover/code:hx-opacity-100 hx-flex hx-gap-1 hx-absolute hx-m-[11px] hx-right-0 hx-top-0&#34;&gt;
  &lt;button
    class=&#34;hextra-code-copy-btn hx-group/copybtn hx-transition-all active:hx-opacity-50 hx-bg-primary-700/5 hx-border hx-border-black/5 hx-text-gray-600 hover:hx-text-gray-900 hx-rounded-md hx-p-1.5 dark:hx-bg-primary-300/10 dark:hx-border-white/10 dark:hx-text-gray-400 dark:hover:hx-text-gray-50&#34;
    title=&#34;Copy code&#34;
  &gt;
    &lt;div class=&#34;copy-icon group-[.copied]/copybtn:hx-hidden hx-pointer-events-none hx-h-4 hx-w-4&#34;&gt;&lt;/div&gt;
    &lt;div class=&#34;success-icon hx-hidden group-[.copied]/copybtn:hx-block hx-pointer-events-none hx-h-4 hx-w-4&#34;&gt;&lt;/div&gt;
  &lt;/button&gt;
&lt;/div&gt;
&lt;/div&gt;
&lt;p&gt;Time of day (HH:MM format) when the daily maintenance task runs. Handles log purging, message archival, cache refresh, and other cleanup operations. Example: &lt;code&gt;02:00&lt;/code&gt; for 2 AM execution, &lt;code&gt;03:30&lt;/code&gt; for 3:30 AM.&lt;/p&gt;
&lt;hr&gt;
&lt;h2&gt;Email/SMTP Configuration&lt;span class=&#34;hx-absolute -hx-mt-20&#34; id=&#34;emailsmtp-configuration&#34;&gt;&lt;/span&gt;
    &lt;a href=&#34;#emailsmtp-configuration&#34; class=&#34;subheading-anchor&#34; aria-label=&#34;Permalink for this section&#34;&gt;&lt;/a&gt;&lt;/h2&gt;&lt;h3&gt;CAVALIBA_EMAIL_HOST&lt;span class=&#34;hx-absolute -hx-mt-20&#34; id=&#34;cavaliba_email_host&#34;&gt;&lt;/span&gt;
    &lt;a href=&#34;#cavaliba_email_host&#34; class=&#34;subheading-anchor&#34; aria-label=&#34;Permalink for this section&#34;&gt;&lt;/a&gt;&lt;/h3&gt;&lt;div class=&#34;hextra-code-block hx-relative hx-mt-6 first:hx-mt-0 hx-group/code&#34;&gt;

&lt;div&gt;&lt;pre&gt;&lt;code&gt;CAVALIBA_EMAIL_HOST=localhost&lt;/code&gt;&lt;/pre&gt;&lt;/div&gt;&lt;div class=&#34;hextra-code-copy-btn-container hx-opacity-0 hx-transition group-hover/code:hx-opacity-100 hx-flex hx-gap-1 hx-absolute hx-m-[11px] hx-right-0 hx-top-0&#34;&gt;
  &lt;button
    class=&#34;hextra-code-copy-btn hx-group/copybtn hx-transition-all active:hx-opacity-50 hx-bg-primary-700/5 hx-border hx-border-black/5 hx-text-gray-600 hover:hx-text-gray-900 hx-rounded-md hx-p-1.5 dark:hx-bg-primary-300/10 dark:hx-border-white/10 dark:hx-text-gray-400 dark:hover:hx-text-gray-50&#34;
    title=&#34;Copy code&#34;
  &gt;
    &lt;div class=&#34;copy-icon group-[.copied]/copybtn:hx-hidden hx-pointer-events-none hx-h-4 hx-w-4&#34;&gt;&lt;/div&gt;
    &lt;div class=&#34;success-icon hx-hidden group-[.copied]/copybtn:hx-block hx-pointer-events-none hx-h-4 hx-w-4&#34;&gt;&lt;/div&gt;
  &lt;/button&gt;
&lt;/div&gt;
&lt;/div&gt;
&lt;p&gt;SMTP server hostname or IP for sending outbound email notifications. Usually the mail server of your organization. Example: &lt;code&gt;mail.company.com&lt;/code&gt;, &lt;code&gt;smtp.gmail.com&lt;/code&gt;, &lt;code&gt;10.0.0.100&lt;/code&gt;.&lt;/p&gt;
&lt;h3&gt;CAVALIBA_EMAIL_PORT&lt;span class=&#34;hx-absolute -hx-mt-20&#34; id=&#34;cavaliba_email_port&#34;&gt;&lt;/span&gt;
    &lt;a href=&#34;#cavaliba_email_port&#34; class=&#34;subheading-anchor&#34; aria-label=&#34;Permalink for this section&#34;&gt;&lt;/a&gt;&lt;/h3&gt;&lt;div class=&#34;hextra-code-block hx-relative hx-mt-6 first:hx-mt-0 hx-group/code&#34;&gt;

&lt;div&gt;&lt;pre&gt;&lt;code&gt;CAVALIBA_EMAIL_PORT=25&lt;/code&gt;&lt;/pre&gt;&lt;/div&gt;&lt;div class=&#34;hextra-code-copy-btn-container hx-opacity-0 hx-transition group-hover/code:hx-opacity-100 hx-flex hx-gap-1 hx-absolute hx-m-[11px] hx-right-0 hx-top-0&#34;&gt;
  &lt;button
    class=&#34;hextra-code-copy-btn hx-group/copybtn hx-transition-all active:hx-opacity-50 hx-bg-primary-700/5 hx-border hx-border-black/5 hx-text-gray-600 hover:hx-text-gray-900 hx-rounded-md hx-p-1.5 dark:hx-bg-primary-300/10 dark:hx-border-white/10 dark:hx-text-gray-400 dark:hover:hx-text-gray-50&#34;
    title=&#34;Copy code&#34;
  &gt;
    &lt;div class=&#34;copy-icon group-[.copied]/copybtn:hx-hidden hx-pointer-events-none hx-h-4 hx-w-4&#34;&gt;&lt;/div&gt;
    &lt;div class=&#34;success-icon hx-hidden group-[.copied]/copybtn:hx-block hx-pointer-events-none hx-h-4 hx-w-4&#34;&gt;&lt;/div&gt;
  &lt;/button&gt;
&lt;/div&gt;
&lt;/div&gt;
&lt;p&gt;SMTP server port number. Typically &lt;code&gt;25&lt;/code&gt; for unencrypted, &lt;code&gt;465&lt;/code&gt; for SSL, &lt;code&gt;587&lt;/code&gt; for TLS. Must match the mail server configuration. Ensure the port is open from the container. Example: Change to &lt;code&gt;587&lt;/code&gt; for TLS-based SMTP.&lt;/p&gt;
&lt;h3&gt;CAVALIBA_EMAIL_USER&lt;span class=&#34;hx-absolute -hx-mt-20&#34; id=&#34;cavaliba_email_user&#34;&gt;&lt;/span&gt;
    &lt;a href=&#34;#cavaliba_email_user&#34; class=&#34;subheading-anchor&#34; aria-label=&#34;Permalink for this section&#34;&gt;&lt;/a&gt;&lt;/h3&gt;&lt;div class=&#34;hextra-code-block hx-relative hx-mt-6 first:hx-mt-0 hx-group/code&#34;&gt;

&lt;div&gt;&lt;pre&gt;&lt;code&gt;#CAVALIBA_EMAIL_USER=noreply&lt;/code&gt;&lt;/pre&gt;&lt;/div&gt;&lt;div class=&#34;hextra-code-copy-btn-container hx-opacity-0 hx-transition group-hover/code:hx-opacity-100 hx-flex hx-gap-1 hx-absolute hx-m-[11px] hx-right-0 hx-top-0&#34;&gt;
  &lt;button
    class=&#34;hextra-code-copy-btn hx-group/copybtn hx-transition-all active:hx-opacity-50 hx-bg-primary-700/5 hx-border hx-border-black/5 hx-text-gray-600 hover:hx-text-gray-900 hx-rounded-md hx-p-1.5 dark:hx-bg-primary-300/10 dark:hx-border-white/10 dark:hx-text-gray-400 dark:hover:hx-text-gray-50&#34;
    title=&#34;Copy code&#34;
  &gt;
    &lt;div class=&#34;copy-icon group-[.copied]/copybtn:hx-hidden hx-pointer-events-none hx-h-4 hx-w-4&#34;&gt;&lt;/div&gt;
    &lt;div class=&#34;success-icon hx-hidden group-[.copied]/copybtn:hx-block hx-pointer-events-none hx-h-4 hx-w-4&#34;&gt;&lt;/div&gt;
  &lt;/button&gt;
&lt;/div&gt;
&lt;/div&gt;
&lt;p&gt;Username for SMTP authentication if required by your mail server. Leave commented (empty) if your mail server doesn&amp;rsquo;t require authentication. Often a shared service account. Example: &lt;code&gt;notifications@company.com&lt;/code&gt;.&lt;/p&gt;
&lt;h3&gt;CAVALIBA_EMAIL_PASSWORD&lt;span class=&#34;hx-absolute -hx-mt-20&#34; id=&#34;cavaliba_email_password&#34;&gt;&lt;/span&gt;
    &lt;a href=&#34;#cavaliba_email_password&#34; class=&#34;subheading-anchor&#34; aria-label=&#34;Permalink for this section&#34;&gt;&lt;/a&gt;&lt;/h3&gt;&lt;div class=&#34;hextra-code-block hx-relative hx-mt-6 first:hx-mt-0 hx-group/code&#34;&gt;

&lt;div&gt;&lt;pre&gt;&lt;code&gt;#CAVALIBA_EMAIL_PASSWORD=changeme&lt;/code&gt;&lt;/pre&gt;&lt;/div&gt;&lt;div class=&#34;hextra-code-copy-btn-container hx-opacity-0 hx-transition group-hover/code:hx-opacity-100 hx-flex hx-gap-1 hx-absolute hx-m-[11px] hx-right-0 hx-top-0&#34;&gt;
  &lt;button
    class=&#34;hextra-code-copy-btn hx-group/copybtn hx-transition-all active:hx-opacity-50 hx-bg-primary-700/5 hx-border hx-border-black/5 hx-text-gray-600 hover:hx-text-gray-900 hx-rounded-md hx-p-1.5 dark:hx-bg-primary-300/10 dark:hx-border-white/10 dark:hx-text-gray-400 dark:hover:hx-text-gray-50&#34;
    title=&#34;Copy code&#34;
  &gt;
    &lt;div class=&#34;copy-icon group-[.copied]/copybtn:hx-hidden hx-pointer-events-none hx-h-4 hx-w-4&#34;&gt;&lt;/div&gt;
    &lt;div class=&#34;success-icon hx-hidden group-[.copied]/copybtn:hx-block hx-pointer-events-none hx-h-4 hx-w-4&#34;&gt;&lt;/div&gt;
  &lt;/button&gt;
&lt;/div&gt;
&lt;/div&gt;
&lt;p&gt;Password for SMTP authentication if required by your mail server. Leave commented (empty) for open relays. Required for external mail providers like Gmail or SendGrid. Example: App-specific password for Gmail SMTP.&lt;/p&gt;
&lt;hr&gt;
&lt;h2&gt;SMS Configuration&lt;span class=&#34;hx-absolute -hx-mt-20&#34; id=&#34;sms-configuration&#34;&gt;&lt;/span&gt;
    &lt;a href=&#34;#sms-configuration&#34; class=&#34;subheading-anchor&#34; aria-label=&#34;Permalink for this section&#34;&gt;&lt;/a&gt;&lt;/h2&gt;&lt;h3&gt;CAVALIBA_SMS_URL&lt;span class=&#34;hx-absolute -hx-mt-20&#34; id=&#34;cavaliba_sms_url&#34;&gt;&lt;/span&gt;
    &lt;a href=&#34;#cavaliba_sms_url&#34; class=&#34;subheading-anchor&#34; aria-label=&#34;Permalink for this section&#34;&gt;&lt;/a&gt;&lt;/h3&gt;&lt;div class=&#34;hextra-code-block hx-relative hx-mt-6 first:hx-mt-0 hx-group/code&#34;&gt;

&lt;div&gt;&lt;pre&gt;&lt;code&gt;CAVALIBA_SMS_URL=&amp;#34;https://my.sms.provider.com/api/&amp;#34;&lt;/code&gt;&lt;/pre&gt;&lt;/div&gt;&lt;div class=&#34;hextra-code-copy-btn-container hx-opacity-0 hx-transition group-hover/code:hx-opacity-100 hx-flex hx-gap-1 hx-absolute hx-m-[11px] hx-right-0 hx-top-0&#34;&gt;
  &lt;button
    class=&#34;hextra-code-copy-btn hx-group/copybtn hx-transition-all active:hx-opacity-50 hx-bg-primary-700/5 hx-border hx-border-black/5 hx-text-gray-600 hover:hx-text-gray-900 hx-rounded-md hx-p-1.5 dark:hx-bg-primary-300/10 dark:hx-border-white/10 dark:hx-text-gray-400 dark:hover:hx-text-gray-50&#34;
    title=&#34;Copy code&#34;
  &gt;
    &lt;div class=&#34;copy-icon group-[.copied]/copybtn:hx-hidden hx-pointer-events-none hx-h-4 hx-w-4&#34;&gt;&lt;/div&gt;
    &lt;div class=&#34;success-icon hx-hidden group-[.copied]/copybtn:hx-block hx-pointer-events-none hx-h-4 hx-w-4&#34;&gt;&lt;/div&gt;
  &lt;/button&gt;
&lt;/div&gt;
&lt;/div&gt;
&lt;p&gt;Base URL of the SMS gateway API provider. The application constructs SMS sending requests to this endpoint. Must support the required API format. Example: &lt;code&gt;https://api.clicsecure.com/send/&lt;/code&gt; for ClicSecure.&lt;/p&gt;
&lt;h3&gt;CAVALIBA_SMS_LOGIN&lt;span class=&#34;hx-absolute -hx-mt-20&#34; id=&#34;cavaliba_sms_login&#34;&gt;&lt;/span&gt;
    &lt;a href=&#34;#cavaliba_sms_login&#34; class=&#34;subheading-anchor&#34; aria-label=&#34;Permalink for this section&#34;&gt;&lt;/a&gt;&lt;/h3&gt;&lt;div class=&#34;hextra-code-block hx-relative hx-mt-6 first:hx-mt-0 hx-group/code&#34;&gt;

&lt;div&gt;&lt;pre&gt;&lt;code&gt;CAVALIBA_SMS_LOGIN=&amp;#34;my_sms_account&amp;#34;&lt;/code&gt;&lt;/pre&gt;&lt;/div&gt;&lt;div class=&#34;hextra-code-copy-btn-container hx-opacity-0 hx-transition group-hover/code:hx-opacity-100 hx-flex hx-gap-1 hx-absolute hx-m-[11px] hx-right-0 hx-top-0&#34;&gt;
  &lt;button
    class=&#34;hextra-code-copy-btn hx-group/copybtn hx-transition-all active:hx-opacity-50 hx-bg-primary-700/5 hx-border hx-border-black/5 hx-text-gray-600 hover:hx-text-gray-900 hx-rounded-md hx-p-1.5 dark:hx-bg-primary-300/10 dark:hx-border-white/10 dark:hx-text-gray-400 dark:hover:hx-text-gray-50&#34;
    title=&#34;Copy code&#34;
  &gt;
    &lt;div class=&#34;copy-icon group-[.copied]/copybtn:hx-hidden hx-pointer-events-none hx-h-4 hx-w-4&#34;&gt;&lt;/div&gt;
    &lt;div class=&#34;success-icon hx-hidden group-[.copied]/copybtn:hx-block hx-pointer-events-none hx-h-4 hx-w-4&#34;&gt;&lt;/div&gt;
  &lt;/button&gt;
&lt;/div&gt;
&lt;/div&gt;
&lt;p&gt;Account login/ID for the SMS gateway service. Required to authenticate API requests to the SMS provider. Different from Cavaliba user accounts. Example: Your account email or username from SMS provider.&lt;/p&gt;
&lt;h3&gt;CAVALIBA_SMS_PASSWORD&lt;span class=&#34;hx-absolute -hx-mt-20&#34; id=&#34;cavaliba_sms_password&#34;&gt;&lt;/span&gt;
    &lt;a href=&#34;#cavaliba_sms_password&#34; class=&#34;subheading-anchor&#34; aria-label=&#34;Permalink for this section&#34;&gt;&lt;/a&gt;&lt;/h3&gt;&lt;div class=&#34;hextra-code-block hx-relative hx-mt-6 first:hx-mt-0 hx-group/code&#34;&gt;

&lt;div&gt;&lt;pre&gt;&lt;code&gt;CAVALIBA_SMS_PASSWORD=&amp;#34;changeme&amp;#34;&lt;/code&gt;&lt;/pre&gt;&lt;/div&gt;&lt;div class=&#34;hextra-code-copy-btn-container hx-opacity-0 hx-transition group-hover/code:hx-opacity-100 hx-flex hx-gap-1 hx-absolute hx-m-[11px] hx-right-0 hx-top-0&#34;&gt;
  &lt;button
    class=&#34;hextra-code-copy-btn hx-group/copybtn hx-transition-all active:hx-opacity-50 hx-bg-primary-700/5 hx-border hx-border-black/5 hx-text-gray-600 hover:hx-text-gray-900 hx-rounded-md hx-p-1.5 dark:hx-bg-primary-300/10 dark:hx-border-white/10 dark:hx-text-gray-400 dark:hover:hx-text-gray-50&#34;
    title=&#34;Copy code&#34;
  &gt;
    &lt;div class=&#34;copy-icon group-[.copied]/copybtn:hx-hidden hx-pointer-events-none hx-h-4 hx-w-4&#34;&gt;&lt;/div&gt;
    &lt;div class=&#34;success-icon hx-hidden group-[.copied]/copybtn:hx-block hx-pointer-events-none hx-h-4 hx-w-4&#34;&gt;&lt;/div&gt;
  &lt;/button&gt;
&lt;/div&gt;
&lt;/div&gt;
&lt;p&gt;Authentication password or API key for the SMS gateway service. Must be obtained from your SMS provider. Kept secure in the environment configuration. Example: API token or account password from SMS provider.&lt;/p&gt;
&lt;hr&gt;
&lt;h2&gt;Cache and Message Queue&lt;span class=&#34;hx-absolute -hx-mt-20&#34; id=&#34;cache-and-message-queue&#34;&gt;&lt;/span&gt;
    &lt;a href=&#34;#cache-and-message-queue&#34; class=&#34;subheading-anchor&#34; aria-label=&#34;Permalink for this section&#34;&gt;&lt;/a&gt;&lt;/h2&gt;&lt;h3&gt;CAVALIBA_CACHE_DEFAULT_URL&lt;span class=&#34;hx-absolute -hx-mt-20&#34; id=&#34;cavaliba_cache_default_url&#34;&gt;&lt;/span&gt;
    &lt;a href=&#34;#cavaliba_cache_default_url&#34; class=&#34;subheading-anchor&#34; aria-label=&#34;Permalink for this section&#34;&gt;&lt;/a&gt;&lt;/h3&gt;&lt;div class=&#34;hextra-code-block hx-relative hx-mt-6 first:hx-mt-0 hx-group/code&#34;&gt;

&lt;div&gt;&lt;pre&gt;&lt;code&gt;CAVALIBA_CACHE_DEFAULT_URL=&amp;#34;redis://cavaliba_redis:6379&amp;#34;&lt;/code&gt;&lt;/pre&gt;&lt;/div&gt;&lt;div class=&#34;hextra-code-copy-btn-container hx-opacity-0 hx-transition group-hover/code:hx-opacity-100 hx-flex hx-gap-1 hx-absolute hx-m-[11px] hx-right-0 hx-top-0&#34;&gt;
  &lt;button
    class=&#34;hextra-code-copy-btn hx-group/copybtn hx-transition-all active:hx-opacity-50 hx-bg-primary-700/5 hx-border hx-border-black/5 hx-text-gray-600 hover:hx-text-gray-900 hx-rounded-md hx-p-1.5 dark:hx-bg-primary-300/10 dark:hx-border-white/10 dark:hx-text-gray-400 dark:hover:hx-text-gray-50&#34;
    title=&#34;Copy code&#34;
  &gt;
    &lt;div class=&#34;copy-icon group-[.copied]/copybtn:hx-hidden hx-pointer-events-none hx-h-4 hx-w-4&#34;&gt;&lt;/div&gt;
    &lt;div class=&#34;success-icon hx-hidden group-[.copied]/copybtn:hx-block hx-pointer-events-none hx-h-4 hx-w-4&#34;&gt;&lt;/div&gt;
  &lt;/button&gt;
&lt;/div&gt;
&lt;/div&gt;
&lt;p&gt;Redis connection URL for general application caching (permissions, schema cache). The &lt;code&gt;cavaliba_redis&lt;/code&gt; is the docker DNS name. Can point to external Redis instances or cloud services. Example: &lt;code&gt;redis://redis.company.com:6379&lt;/code&gt; or &lt;code&gt;redis://user:pass@redis.cloud.com:6380/0&lt;/code&gt;.&lt;/p&gt;
&lt;h3&gt;CAVALIBA_CACHE_SESSION_URL&lt;span class=&#34;hx-absolute -hx-mt-20&#34; id=&#34;cavaliba_cache_session_url&#34;&gt;&lt;/span&gt;
    &lt;a href=&#34;#cavaliba_cache_session_url&#34; class=&#34;subheading-anchor&#34; aria-label=&#34;Permalink for this section&#34;&gt;&lt;/a&gt;&lt;/h3&gt;&lt;div class=&#34;hextra-code-block hx-relative hx-mt-6 first:hx-mt-0 hx-group/code&#34;&gt;

&lt;div&gt;&lt;pre&gt;&lt;code&gt;CAVALIBA_CACHE_SESSION_URL=&amp;#34;redis://cavaliba_redis:6379&amp;#34;&lt;/code&gt;&lt;/pre&gt;&lt;/div&gt;&lt;div class=&#34;hextra-code-copy-btn-container hx-opacity-0 hx-transition group-hover/code:hx-opacity-100 hx-flex hx-gap-1 hx-absolute hx-m-[11px] hx-right-0 hx-top-0&#34;&gt;
  &lt;button
    class=&#34;hextra-code-copy-btn hx-group/copybtn hx-transition-all active:hx-opacity-50 hx-bg-primary-700/5 hx-border hx-border-black/5 hx-text-gray-600 hover:hx-text-gray-900 hx-rounded-md hx-p-1.5 dark:hx-bg-primary-300/10 dark:hx-border-white/10 dark:hx-text-gray-400 dark:hover:hx-text-gray-50&#34;
    title=&#34;Copy code&#34;
  &gt;
    &lt;div class=&#34;copy-icon group-[.copied]/copybtn:hx-hidden hx-pointer-events-none hx-h-4 hx-w-4&#34;&gt;&lt;/div&gt;
    &lt;div class=&#34;success-icon hx-hidden group-[.copied]/copybtn:hx-block hx-pointer-events-none hx-h-4 hx-w-4&#34;&gt;&lt;/div&gt;
  &lt;/button&gt;
&lt;/div&gt;
&lt;/div&gt;
&lt;p&gt;Redis connection URL specifically for user session storage. Can point to a different Redis instance for session management. Affects login state persistence. Example: Same as CACHE_DEFAULT_URL or separate Redis for dedicated session cache.&lt;/p&gt;
&lt;h3&gt;CAVALIBA_CELERY_BROKER_URL&lt;span class=&#34;hx-absolute -hx-mt-20&#34; id=&#34;cavaliba_celery_broker_url&#34;&gt;&lt;/span&gt;
    &lt;a href=&#34;#cavaliba_celery_broker_url&#34; class=&#34;subheading-anchor&#34; aria-label=&#34;Permalink for this section&#34;&gt;&lt;/a&gt;&lt;/h3&gt;&lt;div class=&#34;hextra-code-block hx-relative hx-mt-6 first:hx-mt-0 hx-group/code&#34;&gt;

&lt;div&gt;&lt;pre&gt;&lt;code&gt;CAVALIBA_CELERY_BROKER_URL=&amp;#34;redis://cavaliba_redis:6379&amp;#34;&lt;/code&gt;&lt;/pre&gt;&lt;/div&gt;&lt;div class=&#34;hextra-code-copy-btn-container hx-opacity-0 hx-transition group-hover/code:hx-opacity-100 hx-flex hx-gap-1 hx-absolute hx-m-[11px] hx-right-0 hx-top-0&#34;&gt;
  &lt;button
    class=&#34;hextra-code-copy-btn hx-group/copybtn hx-transition-all active:hx-opacity-50 hx-bg-primary-700/5 hx-border hx-border-black/5 hx-text-gray-600 hover:hx-text-gray-900 hx-rounded-md hx-p-1.5 dark:hx-bg-primary-300/10 dark:hx-border-white/10 dark:hx-text-gray-400 dark:hover:hx-text-gray-50&#34;
    title=&#34;Copy code&#34;
  &gt;
    &lt;div class=&#34;copy-icon group-[.copied]/copybtn:hx-hidden hx-pointer-events-none hx-h-4 hx-w-4&#34;&gt;&lt;/div&gt;
    &lt;div class=&#34;success-icon hx-hidden group-[.copied]/copybtn:hx-block hx-pointer-events-none hx-h-4 hx-w-4&#34;&gt;&lt;/div&gt;
  &lt;/button&gt;
&lt;/div&gt;
&lt;/div&gt;
&lt;p&gt;Redis connection URL for Celery task queue (background jobs). This is where background job tasks are queued. Must be accessible to both app and worker containers. Example: &lt;code&gt;redis://celery-broker.company.com:6379&lt;/code&gt;.&lt;/p&gt;
&lt;h3&gt;CAVALIBA_CELERY_RESULT_BACKEND&lt;span class=&#34;hx-absolute -hx-mt-20&#34; id=&#34;cavaliba_celery_result_backend&#34;&gt;&lt;/span&gt;
    &lt;a href=&#34;#cavaliba_celery_result_backend&#34; class=&#34;subheading-anchor&#34; aria-label=&#34;Permalink for this section&#34;&gt;&lt;/a&gt;&lt;/h3&gt;&lt;div class=&#34;hextra-code-block hx-relative hx-mt-6 first:hx-mt-0 hx-group/code&#34;&gt;

&lt;div&gt;&lt;pre&gt;&lt;code&gt;CAVALIBA_CELERY_RESULT_BACKEND=&amp;#34;redis://cavaliba_redis:6379&amp;#34;&lt;/code&gt;&lt;/pre&gt;&lt;/div&gt;&lt;div class=&#34;hextra-code-copy-btn-container hx-opacity-0 hx-transition group-hover/code:hx-opacity-100 hx-flex hx-gap-1 hx-absolute hx-m-[11px] hx-right-0 hx-top-0&#34;&gt;
  &lt;button
    class=&#34;hextra-code-copy-btn hx-group/copybtn hx-transition-all active:hx-opacity-50 hx-bg-primary-700/5 hx-border hx-border-black/5 hx-text-gray-600 hover:hx-text-gray-900 hx-rounded-md hx-p-1.5 dark:hx-bg-primary-300/10 dark:hx-border-white/10 dark:hx-text-gray-400 dark:hover:hx-text-gray-50&#34;
    title=&#34;Copy code&#34;
  &gt;
    &lt;div class=&#34;copy-icon group-[.copied]/copybtn:hx-hidden hx-pointer-events-none hx-h-4 hx-w-4&#34;&gt;&lt;/div&gt;
    &lt;div class=&#34;success-icon hx-hidden group-[.copied]/copybtn:hx-block hx-pointer-events-none hx-h-4 hx-w-4&#34;&gt;&lt;/div&gt;
  &lt;/button&gt;
&lt;/div&gt;
&lt;/div&gt;
&lt;p&gt;Redis connection URL for Celery task results storage. Stores results of completed background tasks. Can use the same Redis instance as the broker. Example: &lt;code&gt;redis://results.company.com:6379&lt;/code&gt; for separate result storage.&lt;/p&gt;
&lt;h3&gt;CAVALIBA_CACHE_CONFIGURATION_TIMEOUT&lt;span class=&#34;hx-absolute -hx-mt-20&#34; id=&#34;cavaliba_cache_configuration_timeout&#34;&gt;&lt;/span&gt;
    &lt;a href=&#34;#cavaliba_cache_configuration_timeout&#34; class=&#34;subheading-anchor&#34; aria-label=&#34;Permalink for this section&#34;&gt;&lt;/a&gt;&lt;/h3&gt;&lt;div class=&#34;hextra-code-block hx-relative hx-mt-6 first:hx-mt-0 hx-group/code&#34;&gt;

&lt;div&gt;&lt;pre&gt;&lt;code&gt;#CAVALIBA_CACHE_CONFIGURATION_TIMEOUT=60&lt;/code&gt;&lt;/pre&gt;&lt;/div&gt;&lt;div class=&#34;hextra-code-copy-btn-container hx-opacity-0 hx-transition group-hover/code:hx-opacity-100 hx-flex hx-gap-1 hx-absolute hx-m-[11px] hx-right-0 hx-top-0&#34;&gt;
  &lt;button
    class=&#34;hextra-code-copy-btn hx-group/copybtn hx-transition-all active:hx-opacity-50 hx-bg-primary-700/5 hx-border hx-border-black/5 hx-text-gray-600 hover:hx-text-gray-900 hx-rounded-md hx-p-1.5 dark:hx-bg-primary-300/10 dark:hx-border-white/10 dark:hx-text-gray-400 dark:hover:hx-text-gray-50&#34;
    title=&#34;Copy code&#34;
  &gt;
    &lt;div class=&#34;copy-icon group-[.copied]/copybtn:hx-hidden hx-pointer-events-none hx-h-4 hx-w-4&#34;&gt;&lt;/div&gt;
    &lt;div class=&#34;success-icon hx-hidden group-[.copied]/copybtn:hx-block hx-pointer-events-none hx-h-4 hx-w-4&#34;&gt;&lt;/div&gt;
  &lt;/button&gt;
&lt;/div&gt;
&lt;/div&gt;
&lt;p&gt;TTL in seconds for cached application configuration entries. Default: &lt;code&gt;60&lt;/code&gt;. Increase to reduce database reads; decrease for faster propagation of configuration changes.&lt;/p&gt;
&lt;h3&gt;CAVALIBA_CACHE_SCHEMA_TIMEOUT&lt;span class=&#34;hx-absolute -hx-mt-20&#34; id=&#34;cavaliba_cache_schema_timeout&#34;&gt;&lt;/span&gt;
    &lt;a href=&#34;#cavaliba_cache_schema_timeout&#34; class=&#34;subheading-anchor&#34; aria-label=&#34;Permalink for this section&#34;&gt;&lt;/a&gt;&lt;/h3&gt;&lt;div class=&#34;hextra-code-block hx-relative hx-mt-6 first:hx-mt-0 hx-group/code&#34;&gt;

&lt;div&gt;&lt;pre&gt;&lt;code&gt;#CAVALIBA_CACHE_SCHEMA_TIMEOUT=60&lt;/code&gt;&lt;/pre&gt;&lt;/div&gt;&lt;div class=&#34;hextra-code-copy-btn-container hx-opacity-0 hx-transition group-hover/code:hx-opacity-100 hx-flex hx-gap-1 hx-absolute hx-m-[11px] hx-right-0 hx-top-0&#34;&gt;
  &lt;button
    class=&#34;hextra-code-copy-btn hx-group/copybtn hx-transition-all active:hx-opacity-50 hx-bg-primary-700/5 hx-border hx-border-black/5 hx-text-gray-600 hover:hx-text-gray-900 hx-rounded-md hx-p-1.5 dark:hx-bg-primary-300/10 dark:hx-border-white/10 dark:hx-text-gray-400 dark:hover:hx-text-gray-50&#34;
    title=&#34;Copy code&#34;
  &gt;
    &lt;div class=&#34;copy-icon group-[.copied]/copybtn:hx-hidden hx-pointer-events-none hx-h-4 hx-w-4&#34;&gt;&lt;/div&gt;
    &lt;div class=&#34;success-icon hx-hidden group-[.copied]/copybtn:hx-block hx-pointer-events-none hx-h-4 hx-w-4&#34;&gt;&lt;/div&gt;
  &lt;/button&gt;
&lt;/div&gt;
&lt;/div&gt;
&lt;p&gt;TTL in seconds for cached schema (DataClass) objects. Default: &lt;code&gt;60&lt;/code&gt;. Schema objects are relatively stable; higher values reduce DB load on busy instances.&lt;/p&gt;
&lt;h3&gt;CAVALIBA_CACHE_INSTANCE_TIMEOUT&lt;span class=&#34;hx-absolute -hx-mt-20&#34; id=&#34;cavaliba_cache_instance_timeout&#34;&gt;&lt;/span&gt;
    &lt;a href=&#34;#cavaliba_cache_instance_timeout&#34; class=&#34;subheading-anchor&#34; aria-label=&#34;Permalink for this section&#34;&gt;&lt;/a&gt;&lt;/h3&gt;&lt;div class=&#34;hextra-code-block hx-relative hx-mt-6 first:hx-mt-0 hx-group/code&#34;&gt;

&lt;div&gt;&lt;pre&gt;&lt;code&gt;#CAVALIBA_CACHE_INSTANCE_TIMEOUT=60&lt;/code&gt;&lt;/pre&gt;&lt;/div&gt;&lt;div class=&#34;hextra-code-copy-btn-container hx-opacity-0 hx-transition group-hover/code:hx-opacity-100 hx-flex hx-gap-1 hx-absolute hx-m-[11px] hx-right-0 hx-top-0&#34;&gt;
  &lt;button
    class=&#34;hextra-code-copy-btn hx-group/copybtn hx-transition-all active:hx-opacity-50 hx-bg-primary-700/5 hx-border hx-border-black/5 hx-text-gray-600 hover:hx-text-gray-900 hx-rounded-md hx-p-1.5 dark:hx-bg-primary-300/10 dark:hx-border-white/10 dark:hx-text-gray-400 dark:hover:hx-text-gray-50&#34;
    title=&#34;Copy code&#34;
  &gt;
    &lt;div class=&#34;copy-icon group-[.copied]/copybtn:hx-hidden hx-pointer-events-none hx-h-4 hx-w-4&#34;&gt;&lt;/div&gt;
    &lt;div class=&#34;success-icon hx-hidden group-[.copied]/copybtn:hx-block hx-pointer-events-none hx-h-4 hx-w-4&#34;&gt;&lt;/div&gt;
  &lt;/button&gt;
&lt;/div&gt;
&lt;/div&gt;
&lt;p&gt;TTL in seconds for cached data instance objects. Default: &lt;code&gt;60&lt;/code&gt;. Lower values give fresher data at the cost of more database queries.&lt;/p&gt;
&lt;h3&gt;CAVALIBA_CACHE_ENUMERATE_TIMEOUT&lt;span class=&#34;hx-absolute -hx-mt-20&#34; id=&#34;cavaliba_cache_enumerate_timeout&#34;&gt;&lt;/span&gt;
    &lt;a href=&#34;#cavaliba_cache_enumerate_timeout&#34; class=&#34;subheading-anchor&#34; aria-label=&#34;Permalink for this section&#34;&gt;&lt;/a&gt;&lt;/h3&gt;&lt;div class=&#34;hextra-code-block hx-relative hx-mt-6 first:hx-mt-0 hx-group/code&#34;&gt;

&lt;div&gt;&lt;pre&gt;&lt;code&gt;#CAVALIBA_CACHE_ENUMERATE_TIMEOUT=120&lt;/code&gt;&lt;/pre&gt;&lt;/div&gt;&lt;div class=&#34;hextra-code-copy-btn-container hx-opacity-0 hx-transition group-hover/code:hx-opacity-100 hx-flex hx-gap-1 hx-absolute hx-m-[11px] hx-right-0 hx-top-0&#34;&gt;
  &lt;button
    class=&#34;hextra-code-copy-btn hx-group/copybtn hx-transition-all active:hx-opacity-50 hx-bg-primary-700/5 hx-border hx-border-black/5 hx-text-gray-600 hover:hx-text-gray-900 hx-rounded-md hx-p-1.5 dark:hx-bg-primary-300/10 dark:hx-border-white/10 dark:hx-text-gray-400 dark:hover:hx-text-gray-50&#34;
    title=&#34;Copy code&#34;
  &gt;
    &lt;div class=&#34;copy-icon group-[.copied]/copybtn:hx-hidden hx-pointer-events-none hx-h-4 hx-w-4&#34;&gt;&lt;/div&gt;
    &lt;div class=&#34;success-icon hx-hidden group-[.copied]/copybtn:hx-block hx-pointer-events-none hx-h-4 hx-w-4&#34;&gt;&lt;/div&gt;
  &lt;/button&gt;
&lt;/div&gt;
&lt;/div&gt;
&lt;p&gt;TTL in seconds for cached enumerate field data. Default: &lt;code&gt;120&lt;/code&gt;. Enumerate lists change infrequently, so a longer TTL is safe for most deployments.&lt;/p&gt;
&lt;h3&gt;CAVALIBA_CACHE_DATAPOINT_TIMEOUT&lt;span class=&#34;hx-absolute -hx-mt-20&#34; id=&#34;cavaliba_cache_datapoint_timeout&#34;&gt;&lt;/span&gt;
    &lt;a href=&#34;#cavaliba_cache_datapoint_timeout&#34; class=&#34;subheading-anchor&#34; aria-label=&#34;Permalink for this section&#34;&gt;&lt;/a&gt;&lt;/h3&gt;&lt;div class=&#34;hextra-code-block hx-relative hx-mt-6 first:hx-mt-0 hx-group/code&#34;&gt;

&lt;div&gt;&lt;pre&gt;&lt;code&gt;#CAVALIBA_CACHE_DATAPOINT_TIMEOUT=60&lt;/code&gt;&lt;/pre&gt;&lt;/div&gt;&lt;div class=&#34;hextra-code-copy-btn-container hx-opacity-0 hx-transition group-hover/code:hx-opacity-100 hx-flex hx-gap-1 hx-absolute hx-m-[11px] hx-right-0 hx-top-0&#34;&gt;
  &lt;button
    class=&#34;hextra-code-copy-btn hx-group/copybtn hx-transition-all active:hx-opacity-50 hx-bg-primary-700/5 hx-border hx-border-black/5 hx-text-gray-600 hover:hx-text-gray-900 hx-rounded-md hx-p-1.5 dark:hx-bg-primary-300/10 dark:hx-border-white/10 dark:hx-text-gray-400 dark:hover:hx-text-gray-50&#34;
    title=&#34;Copy code&#34;
  &gt;
    &lt;div class=&#34;copy-icon group-[.copied]/copybtn:hx-hidden hx-pointer-events-none hx-h-4 hx-w-4&#34;&gt;&lt;/div&gt;
    &lt;div class=&#34;success-icon hx-hidden group-[.copied]/copybtn:hx-block hx-pointer-events-none hx-h-4 hx-w-4&#34;&gt;&lt;/div&gt;
  &lt;/button&gt;
&lt;/div&gt;
&lt;/div&gt;
&lt;p&gt;TTL in seconds for cached datapoint (dict) entries. Default: &lt;code&gt;60&lt;/code&gt;.&lt;/p&gt;
&lt;hr&gt;
&lt;h2&gt;OAuth2 Proxy and Federation&lt;span class=&#34;hx-absolute -hx-mt-20&#34; id=&#34;oauth2-proxy-and-federation&#34;&gt;&lt;/span&gt;
    &lt;a href=&#34;#oauth2-proxy-and-federation&#34; class=&#34;subheading-anchor&#34; aria-label=&#34;Permalink for this section&#34;&gt;&lt;/a&gt;&lt;/h2&gt;&lt;h3&gt;Identity Provider Configuration&lt;span class=&#34;hx-absolute -hx-mt-20&#34; id=&#34;identity-provider-configuration&#34;&gt;&lt;/span&gt;
    &lt;a href=&#34;#identity-provider-configuration&#34; class=&#34;subheading-anchor&#34; aria-label=&#34;Permalink for this section&#34;&gt;&lt;/a&gt;&lt;/h3&gt;&lt;h4&gt;OAUTH2_PROXY_PROVIDER&lt;span class=&#34;hx-absolute -hx-mt-20&#34; id=&#34;oauth2_proxy_provider&#34;&gt;&lt;/span&gt;
    &lt;a href=&#34;#oauth2_proxy_provider&#34; class=&#34;subheading-anchor&#34; aria-label=&#34;Permalink for this section&#34;&gt;&lt;/a&gt;&lt;/h4&gt;&lt;div class=&#34;hextra-code-block hx-relative hx-mt-6 first:hx-mt-0 hx-group/code&#34;&gt;

&lt;div&gt;&lt;pre&gt;&lt;code&gt;OAUTH2_PROXY_PROVIDER=&amp;#34;oidc&amp;#34;&lt;/code&gt;&lt;/pre&gt;&lt;/div&gt;&lt;div class=&#34;hextra-code-copy-btn-container hx-opacity-0 hx-transition group-hover/code:hx-opacity-100 hx-flex hx-gap-1 hx-absolute hx-m-[11px] hx-right-0 hx-top-0&#34;&gt;
  &lt;button
    class=&#34;hextra-code-copy-btn hx-group/copybtn hx-transition-all active:hx-opacity-50 hx-bg-primary-700/5 hx-border hx-border-black/5 hx-text-gray-600 hover:hx-text-gray-900 hx-rounded-md hx-p-1.5 dark:hx-bg-primary-300/10 dark:hx-border-white/10 dark:hx-text-gray-400 dark:hover:hx-text-gray-50&#34;
    title=&#34;Copy code&#34;
  &gt;
    &lt;div class=&#34;copy-icon group-[.copied]/copybtn:hx-hidden hx-pointer-events-none hx-h-4 hx-w-4&#34;&gt;&lt;/div&gt;
    &lt;div class=&#34;success-icon hx-hidden group-[.copied]/copybtn:hx-block hx-pointer-events-none hx-h-4 hx-w-4&#34;&gt;&lt;/div&gt;
  &lt;/button&gt;
&lt;/div&gt;
&lt;/div&gt;
&lt;p&gt;OAuth2/SAML identity provider type. Options: &lt;code&gt;oidc&lt;/code&gt; (OpenID Connect), &lt;code&gt;keycloak-oidc&lt;/code&gt; (Keycloak), &lt;code&gt;google&lt;/code&gt;, &lt;code&gt;azure&lt;/code&gt;, etc. Determines which protocol and configuration format is used for federated authentication.&lt;/p&gt;
&lt;h4&gt;OAUTH2_PROXY_PROVIDER_DISPLAY_NAME&lt;span class=&#34;hx-absolute -hx-mt-20&#34; id=&#34;oauth2_proxy_provider_display_name&#34;&gt;&lt;/span&gt;
    &lt;a href=&#34;#oauth2_proxy_provider_display_name&#34; class=&#34;subheading-anchor&#34; aria-label=&#34;Permalink for this section&#34;&gt;&lt;/a&gt;&lt;/h4&gt;&lt;div class=&#34;hextra-code-block hx-relative hx-mt-6 first:hx-mt-0 hx-group/code&#34;&gt;

&lt;div&gt;&lt;pre&gt;&lt;code&gt;OAUTH2_PROXY_PROVIDER_DISPLAY_NAME=&amp;#34;MyKeycloak&amp;#34;&lt;/code&gt;&lt;/pre&gt;&lt;/div&gt;&lt;div class=&#34;hextra-code-copy-btn-container hx-opacity-0 hx-transition group-hover/code:hx-opacity-100 hx-flex hx-gap-1 hx-absolute hx-m-[11px] hx-right-0 hx-top-0&#34;&gt;
  &lt;button
    class=&#34;hextra-code-copy-btn hx-group/copybtn hx-transition-all active:hx-opacity-50 hx-bg-primary-700/5 hx-border hx-border-black/5 hx-text-gray-600 hover:hx-text-gray-900 hx-rounded-md hx-p-1.5 dark:hx-bg-primary-300/10 dark:hx-border-white/10 dark:hx-text-gray-400 dark:hover:hx-text-gray-50&#34;
    title=&#34;Copy code&#34;
  &gt;
    &lt;div class=&#34;copy-icon group-[.copied]/copybtn:hx-hidden hx-pointer-events-none hx-h-4 hx-w-4&#34;&gt;&lt;/div&gt;
    &lt;div class=&#34;success-icon hx-hidden group-[.copied]/copybtn:hx-block hx-pointer-events-none hx-h-4 hx-w-4&#34;&gt;&lt;/div&gt;
  &lt;/button&gt;
&lt;/div&gt;
&lt;/div&gt;
&lt;p&gt;User-friendly name for the identity provider displayed on the login page. Helps users identify which authentication method to use. Example: &lt;code&gt;MyOkta&lt;/code&gt;, &lt;code&gt;Corporate Active Directory&lt;/code&gt;, &lt;code&gt;Azure AD&lt;/code&gt;.&lt;/p&gt;
&lt;h4&gt;OAUTH2_PROXY_OIDC_ISSUER_URL&lt;span class=&#34;hx-absolute -hx-mt-20&#34; id=&#34;oauth2_proxy_oidc_issuer_url&#34;&gt;&lt;/span&gt;
    &lt;a href=&#34;#oauth2_proxy_oidc_issuer_url&#34; class=&#34;subheading-anchor&#34; aria-label=&#34;Permalink for this section&#34;&gt;&lt;/a&gt;&lt;/h4&gt;&lt;div class=&#34;hextra-code-block hx-relative hx-mt-6 first:hx-mt-0 hx-group/code&#34;&gt;

&lt;div&gt;&lt;pre&gt;&lt;code&gt;OAUTH2_PROXY_OIDC_ISSUER_URL=&amp;#34;https://keycloak.example.com/realms/myrealm&amp;#34;&lt;/code&gt;&lt;/pre&gt;&lt;/div&gt;&lt;div class=&#34;hextra-code-copy-btn-container hx-opacity-0 hx-transition group-hover/code:hx-opacity-100 hx-flex hx-gap-1 hx-absolute hx-m-[11px] hx-right-0 hx-top-0&#34;&gt;
  &lt;button
    class=&#34;hextra-code-copy-btn hx-group/copybtn hx-transition-all active:hx-opacity-50 hx-bg-primary-700/5 hx-border hx-border-black/5 hx-text-gray-600 hover:hx-text-gray-900 hx-rounded-md hx-p-1.5 dark:hx-bg-primary-300/10 dark:hx-border-white/10 dark:hx-text-gray-400 dark:hover:hx-text-gray-50&#34;
    title=&#34;Copy code&#34;
  &gt;
    &lt;div class=&#34;copy-icon group-[.copied]/copybtn:hx-hidden hx-pointer-events-none hx-h-4 hx-w-4&#34;&gt;&lt;/div&gt;
    &lt;div class=&#34;success-icon hx-hidden group-[.copied]/copybtn:hx-block hx-pointer-events-none hx-h-4 hx-w-4&#34;&gt;&lt;/div&gt;
  &lt;/button&gt;
&lt;/div&gt;
&lt;/div&gt;
&lt;p&gt;Complete URL of the OIDC identity provider for discovery. Used for OAuth2 discovery endpoints. Must match your IdP configuration exactly including protocol and port. Example: &lt;code&gt;https://okta.company.com&lt;/code&gt;, &lt;code&gt;https://keycloak.example.com:8080/realms/cavaliba&lt;/code&gt;.&lt;/p&gt;
&lt;h4&gt;OAUTH2_PROXY_CLIENT_ID&lt;span class=&#34;hx-absolute -hx-mt-20&#34; id=&#34;oauth2_proxy_client_id&#34;&gt;&lt;/span&gt;
    &lt;a href=&#34;#oauth2_proxy_client_id&#34; class=&#34;subheading-anchor&#34; aria-label=&#34;Permalink for this section&#34;&gt;&lt;/a&gt;&lt;/h4&gt;&lt;div class=&#34;hextra-code-block hx-relative hx-mt-6 first:hx-mt-0 hx-group/code&#34;&gt;

&lt;div&gt;&lt;pre&gt;&lt;code&gt;OAUTH2_PROXY_CLIENT_ID=&amp;#34;cavaliba-client&amp;#34;&lt;/code&gt;&lt;/pre&gt;&lt;/div&gt;&lt;div class=&#34;hextra-code-copy-btn-container hx-opacity-0 hx-transition group-hover/code:hx-opacity-100 hx-flex hx-gap-1 hx-absolute hx-m-[11px] hx-right-0 hx-top-0&#34;&gt;
  &lt;button
    class=&#34;hextra-code-copy-btn hx-group/copybtn hx-transition-all active:hx-opacity-50 hx-bg-primary-700/5 hx-border hx-border-black/5 hx-text-gray-600 hover:hx-text-gray-900 hx-rounded-md hx-p-1.5 dark:hx-bg-primary-300/10 dark:hx-border-white/10 dark:hx-text-gray-400 dark:hover:hx-text-gray-50&#34;
    title=&#34;Copy code&#34;
  &gt;
    &lt;div class=&#34;copy-icon group-[.copied]/copybtn:hx-hidden hx-pointer-events-none hx-h-4 hx-w-4&#34;&gt;&lt;/div&gt;
    &lt;div class=&#34;success-icon hx-hidden group-[.copied]/copybtn:hx-block hx-pointer-events-none hx-h-4 hx-w-4&#34;&gt;&lt;/div&gt;
  &lt;/button&gt;
&lt;/div&gt;
&lt;/div&gt;
&lt;p&gt;OAuth2 application ID provided by your identity provider. Identifies the Cavaliba application within the IdP. Obtained during application registration. Example: Long alphanumeric string from your IdP.&lt;/p&gt;
&lt;h4&gt;OAUTH2_PROXY_CLIENT_SECRET&lt;span class=&#34;hx-absolute -hx-mt-20&#34; id=&#34;oauth2_proxy_client_secret&#34;&gt;&lt;/span&gt;
    &lt;a href=&#34;#oauth2_proxy_client_secret&#34; class=&#34;subheading-anchor&#34; aria-label=&#34;Permalink for this section&#34;&gt;&lt;/a&gt;&lt;/h4&gt;&lt;div class=&#34;hextra-code-block hx-relative hx-mt-6 first:hx-mt-0 hx-group/code&#34;&gt;

&lt;div&gt;&lt;pre&gt;&lt;code&gt;OAUTH2_PROXY_CLIENT_SECRET=&amp;#34;your_client_secret&amp;#34;&lt;/code&gt;&lt;/pre&gt;&lt;/div&gt;&lt;div class=&#34;hextra-code-copy-btn-container hx-opacity-0 hx-transition group-hover/code:hx-opacity-100 hx-flex hx-gap-1 hx-absolute hx-m-[11px] hx-right-0 hx-top-0&#34;&gt;
  &lt;button
    class=&#34;hextra-code-copy-btn hx-group/copybtn hx-transition-all active:hx-opacity-50 hx-bg-primary-700/5 hx-border hx-border-black/5 hx-text-gray-600 hover:hx-text-gray-900 hx-rounded-md hx-p-1.5 dark:hx-bg-primary-300/10 dark:hx-border-white/10 dark:hx-text-gray-400 dark:hover:hx-text-gray-50&#34;
    title=&#34;Copy code&#34;
  &gt;
    &lt;div class=&#34;copy-icon group-[.copied]/copybtn:hx-hidden hx-pointer-events-none hx-h-4 hx-w-4&#34;&gt;&lt;/div&gt;
    &lt;div class=&#34;success-icon hx-hidden group-[.copied]/copybtn:hx-block hx-pointer-events-none hx-h-4 hx-w-4&#34;&gt;&lt;/div&gt;
  &lt;/button&gt;
&lt;/div&gt;
&lt;/div&gt;
&lt;p&gt;OAuth2 application secret/password provided by your identity provider. Used to authenticate the application with the IdP. Must be kept secure and not shared. Example: Generated secret string from IdP.&lt;/p&gt;
&lt;h4&gt;OAUTH2_PROXY_COOKIE_SECRET&lt;span class=&#34;hx-absolute -hx-mt-20&#34; id=&#34;oauth2_proxy_cookie_secret&#34;&gt;&lt;/span&gt;
    &lt;a href=&#34;#oauth2_proxy_cookie_secret&#34; class=&#34;subheading-anchor&#34; aria-label=&#34;Permalink for this section&#34;&gt;&lt;/a&gt;&lt;/h4&gt;&lt;div class=&#34;hextra-code-block hx-relative hx-mt-6 first:hx-mt-0 hx-group/code&#34;&gt;

&lt;div&gt;&lt;pre&gt;&lt;code&gt;OAUTH2_PROXY_COOKIE_SECRET=&amp;#34;your_cookie_secret&amp;#34;&lt;/code&gt;&lt;/pre&gt;&lt;/div&gt;&lt;div class=&#34;hextra-code-copy-btn-container hx-opacity-0 hx-transition group-hover/code:hx-opacity-100 hx-flex hx-gap-1 hx-absolute hx-m-[11px] hx-right-0 hx-top-0&#34;&gt;
  &lt;button
    class=&#34;hextra-code-copy-btn hx-group/copybtn hx-transition-all active:hx-opacity-50 hx-bg-primary-700/5 hx-border hx-border-black/5 hx-text-gray-600 hover:hx-text-gray-900 hx-rounded-md hx-p-1.5 dark:hx-bg-primary-300/10 dark:hx-border-white/10 dark:hx-text-gray-400 dark:hover:hx-text-gray-50&#34;
    title=&#34;Copy code&#34;
  &gt;
    &lt;div class=&#34;copy-icon group-[.copied]/copybtn:hx-hidden hx-pointer-events-none hx-h-4 hx-w-4&#34;&gt;&lt;/div&gt;
    &lt;div class=&#34;success-icon hx-hidden group-[.copied]/copybtn:hx-block hx-pointer-events-none hx-h-4 hx-w-4&#34;&gt;&lt;/div&gt;
  &lt;/button&gt;
&lt;/div&gt;
&lt;/div&gt;
&lt;p&gt;Secret key for signing OAuth2 proxy session cookies. Must be a long random string (24+ characters). Used to prevent cookie tampering and session hijacking. Example: Base64-encoded 24-character random string.&lt;/p&gt;
&lt;h4&gt;OAUTH2_PROXY_REDIRECT_URL&lt;span class=&#34;hx-absolute -hx-mt-20&#34; id=&#34;oauth2_proxy_redirect_url&#34;&gt;&lt;/span&gt;
    &lt;a href=&#34;#oauth2_proxy_redirect_url&#34; class=&#34;subheading-anchor&#34; aria-label=&#34;Permalink for this section&#34;&gt;&lt;/a&gt;&lt;/h4&gt;&lt;div class=&#34;hextra-code-block hx-relative hx-mt-6 first:hx-mt-0 hx-group/code&#34;&gt;

&lt;div&gt;&lt;pre&gt;&lt;code&gt;OAUTH2_PROXY_REDIRECT_URL=&amp;#34;https://cavaliba.example.com/oauth2/callback&amp;#34;&lt;/code&gt;&lt;/pre&gt;&lt;/div&gt;&lt;div class=&#34;hextra-code-copy-btn-container hx-opacity-0 hx-transition group-hover/code:hx-opacity-100 hx-flex hx-gap-1 hx-absolute hx-m-[11px] hx-right-0 hx-top-0&#34;&gt;
  &lt;button
    class=&#34;hextra-code-copy-btn hx-group/copybtn hx-transition-all active:hx-opacity-50 hx-bg-primary-700/5 hx-border hx-border-black/5 hx-text-gray-600 hover:hx-text-gray-900 hx-rounded-md hx-p-1.5 dark:hx-bg-primary-300/10 dark:hx-border-white/10 dark:hx-text-gray-400 dark:hover:hx-text-gray-50&#34;
    title=&#34;Copy code&#34;
  &gt;
    &lt;div class=&#34;copy-icon group-[.copied]/copybtn:hx-hidden hx-pointer-events-none hx-h-4 hx-w-4&#34;&gt;&lt;/div&gt;
    &lt;div class=&#34;success-icon hx-hidden group-[.copied]/copybtn:hx-block hx-pointer-events-none hx-h-4 hx-w-4&#34;&gt;&lt;/div&gt;
  &lt;/button&gt;
&lt;/div&gt;
&lt;/div&gt;
&lt;p&gt;Callback URL where the identity provider redirects after successful authentication. Must exactly match the URL configured in your identity provider application settings. Must use HTTPS in production. Example: &lt;code&gt;https://my.cavaliba.fqdn/oauth2/callback&lt;/code&gt;.&lt;/p&gt;
&lt;h3&gt;Common OAuth2 Settings&lt;span class=&#34;hx-absolute -hx-mt-20&#34; id=&#34;common-oauth2-settings&#34;&gt;&lt;/span&gt;
    &lt;a href=&#34;#common-oauth2-settings&#34; class=&#34;subheading-anchor&#34; aria-label=&#34;Permalink for this section&#34;&gt;&lt;/a&gt;&lt;/h3&gt;&lt;h4&gt;OAUTH2_PROXY_COOKIE_EXPIRE&lt;span class=&#34;hx-absolute -hx-mt-20&#34; id=&#34;oauth2_proxy_cookie_expire&#34;&gt;&lt;/span&gt;
    &lt;a href=&#34;#oauth2_proxy_cookie_expire&#34; class=&#34;subheading-anchor&#34; aria-label=&#34;Permalink for this section&#34;&gt;&lt;/a&gt;&lt;/h4&gt;&lt;div class=&#34;hextra-code-block hx-relative hx-mt-6 first:hx-mt-0 hx-group/code&#34;&gt;

&lt;div&gt;&lt;pre&gt;&lt;code&gt;OAUTH2_PROXY_COOKIE_EXPIRE=&amp;#34;0h45m0s&amp;#34;&lt;/code&gt;&lt;/pre&gt;&lt;/div&gt;&lt;div class=&#34;hextra-code-copy-btn-container hx-opacity-0 hx-transition group-hover/code:hx-opacity-100 hx-flex hx-gap-1 hx-absolute hx-m-[11px] hx-right-0 hx-top-0&#34;&gt;
  &lt;button
    class=&#34;hextra-code-copy-btn hx-group/copybtn hx-transition-all active:hx-opacity-50 hx-bg-primary-700/5 hx-border hx-border-black/5 hx-text-gray-600 hover:hx-text-gray-900 hx-rounded-md hx-p-1.5 dark:hx-bg-primary-300/10 dark:hx-border-white/10 dark:hx-text-gray-400 dark:hover:hx-text-gray-50&#34;
    title=&#34;Copy code&#34;
  &gt;
    &lt;div class=&#34;copy-icon group-[.copied]/copybtn:hx-hidden hx-pointer-events-none hx-h-4 hx-w-4&#34;&gt;&lt;/div&gt;
    &lt;div class=&#34;success-icon hx-hidden group-[.copied]/copybtn:hx-block hx-pointer-events-none hx-h-4 hx-w-4&#34;&gt;&lt;/div&gt;
  &lt;/button&gt;
&lt;/div&gt;
&lt;/div&gt;
&lt;p&gt;OAuth2 session cookie expiration time (format: &lt;code&gt;HhMmSs&lt;/code&gt;). After this period, users must re-authenticate. Shorter durations increase security but reduce convenience. Example: &lt;code&gt;0h30m0s&lt;/code&gt; for 30 minutes, &lt;code&gt;2h0m0s&lt;/code&gt; for 2 hours.&lt;/p&gt;
&lt;h4&gt;OAUTH2_PROXY_HTTP_ADDRESS&lt;span class=&#34;hx-absolute -hx-mt-20&#34; id=&#34;oauth2_proxy_http_address&#34;&gt;&lt;/span&gt;
    &lt;a href=&#34;#oauth2_proxy_http_address&#34; class=&#34;subheading-anchor&#34; aria-label=&#34;Permalink for this section&#34;&gt;&lt;/a&gt;&lt;/h4&gt;&lt;div class=&#34;hextra-code-block hx-relative hx-mt-6 first:hx-mt-0 hx-group/code&#34;&gt;

&lt;div&gt;&lt;pre&gt;&lt;code&gt;OAUTH2_PROXY_HTTP_ADDRESS=&amp;#34;0.0.0.0:4180&amp;#34;&lt;/code&gt;&lt;/pre&gt;&lt;/div&gt;&lt;div class=&#34;hextra-code-copy-btn-container hx-opacity-0 hx-transition group-hover/code:hx-opacity-100 hx-flex hx-gap-1 hx-absolute hx-m-[11px] hx-right-0 hx-top-0&#34;&gt;
  &lt;button
    class=&#34;hextra-code-copy-btn hx-group/copybtn hx-transition-all active:hx-opacity-50 hx-bg-primary-700/5 hx-border hx-border-black/5 hx-text-gray-600 hover:hx-text-gray-900 hx-rounded-md hx-p-1.5 dark:hx-bg-primary-300/10 dark:hx-border-white/10 dark:hx-text-gray-400 dark:hover:hx-text-gray-50&#34;
    title=&#34;Copy code&#34;
  &gt;
    &lt;div class=&#34;copy-icon group-[.copied]/copybtn:hx-hidden hx-pointer-events-none hx-h-4 hx-w-4&#34;&gt;&lt;/div&gt;
    &lt;div class=&#34;success-icon hx-hidden group-[.copied]/copybtn:hx-block hx-pointer-events-none hx-h-4 hx-w-4&#34;&gt;&lt;/div&gt;
  &lt;/button&gt;
&lt;/div&gt;
&lt;/div&gt;
&lt;p&gt;Network address and port where OAuth2 proxy listens. The nginx reverse proxy forwards requests here. &lt;code&gt;0.0.0.0&lt;/code&gt; makes it accessible from all interfaces. Port 4180 is the default. Example: &lt;code&gt;127.0.0.1:4180&lt;/code&gt; to restrict local connections only.&lt;/p&gt;
&lt;h4&gt;OAUTH2_PROXY_SKIP_PROVIDER_BUTTON&lt;span class=&#34;hx-absolute -hx-mt-20&#34; id=&#34;oauth2_proxy_skip_provider_button&#34;&gt;&lt;/span&gt;
    &lt;a href=&#34;#oauth2_proxy_skip_provider_button&#34; class=&#34;subheading-anchor&#34; aria-label=&#34;Permalink for this section&#34;&gt;&lt;/a&gt;&lt;/h4&gt;&lt;div class=&#34;hextra-code-block hx-relative hx-mt-6 first:hx-mt-0 hx-group/code&#34;&gt;

&lt;div&gt;&lt;pre&gt;&lt;code&gt;OAUTH2_PROXY_SKIP_PROVIDER_BUTTON=&amp;#34;true&amp;#34;&lt;/code&gt;&lt;/pre&gt;&lt;/div&gt;&lt;div class=&#34;hextra-code-copy-btn-container hx-opacity-0 hx-transition group-hover/code:hx-opacity-100 hx-flex hx-gap-1 hx-absolute hx-m-[11px] hx-right-0 hx-top-0&#34;&gt;
  &lt;button
    class=&#34;hextra-code-copy-btn hx-group/copybtn hx-transition-all active:hx-opacity-50 hx-bg-primary-700/5 hx-border hx-border-black/5 hx-text-gray-600 hover:hx-text-gray-900 hx-rounded-md hx-p-1.5 dark:hx-bg-primary-300/10 dark:hx-border-white/10 dark:hx-text-gray-400 dark:hover:hx-text-gray-50&#34;
    title=&#34;Copy code&#34;
  &gt;
    &lt;div class=&#34;copy-icon group-[.copied]/copybtn:hx-hidden hx-pointer-events-none hx-h-4 hx-w-4&#34;&gt;&lt;/div&gt;
    &lt;div class=&#34;success-icon hx-hidden group-[.copied]/copybtn:hx-block hx-pointer-events-none hx-h-4 hx-w-4&#34;&gt;&lt;/div&gt;
  &lt;/button&gt;
&lt;/div&gt;
&lt;/div&gt;
&lt;p&gt;Whether to skip showing provider selection button (true/false). When &lt;code&gt;true&lt;/code&gt;, automatically redirects to the single configured provider. Useful for single IdP deployments.&lt;/p&gt;
&lt;h4&gt;OAUTH2_PROXY_EMAIL_DOMAINS&lt;span class=&#34;hx-absolute -hx-mt-20&#34; id=&#34;oauth2_proxy_email_domains&#34;&gt;&lt;/span&gt;
    &lt;a href=&#34;#oauth2_proxy_email_domains&#34; class=&#34;subheading-anchor&#34; aria-label=&#34;Permalink for this section&#34;&gt;&lt;/a&gt;&lt;/h4&gt;&lt;div class=&#34;hextra-code-block hx-relative hx-mt-6 first:hx-mt-0 hx-group/code&#34;&gt;

&lt;div&gt;&lt;pre&gt;&lt;code&gt;OAUTH2_PROXY_EMAIL_DOMAINS=&amp;#34;*&amp;#34;&lt;/code&gt;&lt;/pre&gt;&lt;/div&gt;&lt;div class=&#34;hextra-code-copy-btn-container hx-opacity-0 hx-transition group-hover/code:hx-opacity-100 hx-flex hx-gap-1 hx-absolute hx-m-[11px] hx-right-0 hx-top-0&#34;&gt;
  &lt;button
    class=&#34;hextra-code-copy-btn hx-group/copybtn hx-transition-all active:hx-opacity-50 hx-bg-primary-700/5 hx-border hx-border-black/5 hx-text-gray-600 hover:hx-text-gray-900 hx-rounded-md hx-p-1.5 dark:hx-bg-primary-300/10 dark:hx-border-white/10 dark:hx-text-gray-400 dark:hover:hx-text-gray-50&#34;
    title=&#34;Copy code&#34;
  &gt;
    &lt;div class=&#34;copy-icon group-[.copied]/copybtn:hx-hidden hx-pointer-events-none hx-h-4 hx-w-4&#34;&gt;&lt;/div&gt;
    &lt;div class=&#34;success-icon hx-hidden group-[.copied]/copybtn:hx-block hx-pointer-events-none hx-h-4 hx-w-4&#34;&gt;&lt;/div&gt;
  &lt;/button&gt;
&lt;/div&gt;
&lt;/div&gt;
&lt;p&gt;Allowed email domains for OAuth2 login. &lt;code&gt;*&lt;/code&gt; allows all domains. Restrict to specific domains for security. Example: &lt;code&gt;company.com&lt;/code&gt; or &lt;code&gt;company.com external.com&lt;/code&gt; for multiple domains.&lt;/p&gt;
&lt;h3&gt;Header Propagation&lt;span class=&#34;hx-absolute -hx-mt-20&#34; id=&#34;header-propagation&#34;&gt;&lt;/span&gt;
    &lt;a href=&#34;#header-propagation&#34; class=&#34;subheading-anchor&#34; aria-label=&#34;Permalink for this section&#34;&gt;&lt;/a&gt;&lt;/h3&gt;&lt;h4&gt;OAUTH2_PROXY_SET_XAUTHREQUEST&lt;span class=&#34;hx-absolute -hx-mt-20&#34; id=&#34;oauth2_proxy_set_xauthrequest&#34;&gt;&lt;/span&gt;
    &lt;a href=&#34;#oauth2_proxy_set_xauthrequest&#34; class=&#34;subheading-anchor&#34; aria-label=&#34;Permalink for this section&#34;&gt;&lt;/a&gt;&lt;/h4&gt;&lt;div class=&#34;hextra-code-block hx-relative hx-mt-6 first:hx-mt-0 hx-group/code&#34;&gt;

&lt;div&gt;&lt;pre&gt;&lt;code&gt;OAUTH2_PROXY_SET_XAUTHREQUEST=&amp;#34;true&amp;#34;&lt;/code&gt;&lt;/pre&gt;&lt;/div&gt;&lt;div class=&#34;hextra-code-copy-btn-container hx-opacity-0 hx-transition group-hover/code:hx-opacity-100 hx-flex hx-gap-1 hx-absolute hx-m-[11px] hx-right-0 hx-top-0&#34;&gt;
  &lt;button
    class=&#34;hextra-code-copy-btn hx-group/copybtn hx-transition-all active:hx-opacity-50 hx-bg-primary-700/5 hx-border hx-border-black/5 hx-text-gray-600 hover:hx-text-gray-900 hx-rounded-md hx-p-1.5 dark:hx-bg-primary-300/10 dark:hx-border-white/10 dark:hx-text-gray-400 dark:hover:hx-text-gray-50&#34;
    title=&#34;Copy code&#34;
  &gt;
    &lt;div class=&#34;copy-icon group-[.copied]/copybtn:hx-hidden hx-pointer-events-none hx-h-4 hx-w-4&#34;&gt;&lt;/div&gt;
    &lt;div class=&#34;success-icon hx-hidden group-[.copied]/copybtn:hx-block hx-pointer-events-none hx-h-4 hx-w-4&#34;&gt;&lt;/div&gt;
  &lt;/button&gt;
&lt;/div&gt;
&lt;/div&gt;
&lt;p&gt;Pass user identity to backend as X-Auth-Request header (true/false). When &lt;code&gt;true&lt;/code&gt;, Cavaliba receives the authenticated username and can verify the identity.&lt;/p&gt;
&lt;h4&gt;OAUTH2_PROXY_SET_AUTHORIZATION_HEADER&lt;span class=&#34;hx-absolute -hx-mt-20&#34; id=&#34;oauth2_proxy_set_authorization_header&#34;&gt;&lt;/span&gt;
    &lt;a href=&#34;#oauth2_proxy_set_authorization_header&#34; class=&#34;subheading-anchor&#34; aria-label=&#34;Permalink for this section&#34;&gt;&lt;/a&gt;&lt;/h4&gt;&lt;div class=&#34;hextra-code-block hx-relative hx-mt-6 first:hx-mt-0 hx-group/code&#34;&gt;

&lt;div&gt;&lt;pre&gt;&lt;code&gt;OAUTH2_PROXY_SET_AUTHORIZATION_HEADER=&amp;#34;true&amp;#34;&lt;/code&gt;&lt;/pre&gt;&lt;/div&gt;&lt;div class=&#34;hextra-code-copy-btn-container hx-opacity-0 hx-transition group-hover/code:hx-opacity-100 hx-flex hx-gap-1 hx-absolute hx-m-[11px] hx-right-0 hx-top-0&#34;&gt;
  &lt;button
    class=&#34;hextra-code-copy-btn hx-group/copybtn hx-transition-all active:hx-opacity-50 hx-bg-primary-700/5 hx-border hx-border-black/5 hx-text-gray-600 hover:hx-text-gray-900 hx-rounded-md hx-p-1.5 dark:hx-bg-primary-300/10 dark:hx-border-white/10 dark:hx-text-gray-400 dark:hover:hx-text-gray-50&#34;
    title=&#34;Copy code&#34;
  &gt;
    &lt;div class=&#34;copy-icon group-[.copied]/copybtn:hx-hidden hx-pointer-events-none hx-h-4 hx-w-4&#34;&gt;&lt;/div&gt;
    &lt;div class=&#34;success-icon hx-hidden group-[.copied]/copybtn:hx-block hx-pointer-events-none hx-h-4 hx-w-4&#34;&gt;&lt;/div&gt;
  &lt;/button&gt;
&lt;/div&gt;
&lt;/div&gt;
&lt;p&gt;Pass OAuth2 token as Authorization header to backend (true/false). Allows Cavaliba to access token information for additional validation or claims.&lt;/p&gt;
&lt;h4&gt;OAUTH2_PROXY_PASS_AUTHORIZATION_HEADER&lt;span class=&#34;hx-absolute -hx-mt-20&#34; id=&#34;oauth2_proxy_pass_authorization_header&#34;&gt;&lt;/span&gt;
    &lt;a href=&#34;#oauth2_proxy_pass_authorization_header&#34; class=&#34;subheading-anchor&#34; aria-label=&#34;Permalink for this section&#34;&gt;&lt;/a&gt;&lt;/h4&gt;&lt;div class=&#34;hextra-code-block hx-relative hx-mt-6 first:hx-mt-0 hx-group/code&#34;&gt;

&lt;div&gt;&lt;pre&gt;&lt;code&gt;OAUTH2_PROXY_PASS_AUTHORIZATION_HEADER=&amp;#34;true&amp;#34;&lt;/code&gt;&lt;/pre&gt;&lt;/div&gt;&lt;div class=&#34;hextra-code-copy-btn-container hx-opacity-0 hx-transition group-hover/code:hx-opacity-100 hx-flex hx-gap-1 hx-absolute hx-m-[11px] hx-right-0 hx-top-0&#34;&gt;
  &lt;button
    class=&#34;hextra-code-copy-btn hx-group/copybtn hx-transition-all active:hx-opacity-50 hx-bg-primary-700/5 hx-border hx-border-black/5 hx-text-gray-600 hover:hx-text-gray-900 hx-rounded-md hx-p-1.5 dark:hx-bg-primary-300/10 dark:hx-border-white/10 dark:hx-text-gray-400 dark:hover:hx-text-gray-50&#34;
    title=&#34;Copy code&#34;
  &gt;
    &lt;div class=&#34;copy-icon group-[.copied]/copybtn:hx-hidden hx-pointer-events-none hx-h-4 hx-w-4&#34;&gt;&lt;/div&gt;
    &lt;div class=&#34;success-icon hx-hidden group-[.copied]/copybtn:hx-block hx-pointer-events-none hx-h-4 hx-w-4&#34;&gt;&lt;/div&gt;
  &lt;/button&gt;
&lt;/div&gt;
&lt;/div&gt;
&lt;p&gt;Preserve Authorization header from OAuth2 proxy to Cavaliba (true/false). When &lt;code&gt;true&lt;/code&gt;, Cavaliba can directly use the authorization header for additional authentication.&lt;/p&gt;
&lt;h4&gt;OAUTH2_PROXY_PASS_ACCESS_TOKEN&lt;span class=&#34;hx-absolute -hx-mt-20&#34; id=&#34;oauth2_proxy_pass_access_token&#34;&gt;&lt;/span&gt;
    &lt;a href=&#34;#oauth2_proxy_pass_access_token&#34; class=&#34;subheading-anchor&#34; aria-label=&#34;Permalink for this section&#34;&gt;&lt;/a&gt;&lt;/h4&gt;&lt;div class=&#34;hextra-code-block hx-relative hx-mt-6 first:hx-mt-0 hx-group/code&#34;&gt;

&lt;div&gt;&lt;pre&gt;&lt;code&gt;OAUTH2_PROXY_PASS_ACCESS_TOKEN=&amp;#34;true&amp;#34;&lt;/code&gt;&lt;/pre&gt;&lt;/div&gt;&lt;div class=&#34;hextra-code-copy-btn-container hx-opacity-0 hx-transition group-hover/code:hx-opacity-100 hx-flex hx-gap-1 hx-absolute hx-m-[11px] hx-right-0 hx-top-0&#34;&gt;
  &lt;button
    class=&#34;hextra-code-copy-btn hx-group/copybtn hx-transition-all active:hx-opacity-50 hx-bg-primary-700/5 hx-border hx-border-black/5 hx-text-gray-600 hover:hx-text-gray-900 hx-rounded-md hx-p-1.5 dark:hx-bg-primary-300/10 dark:hx-border-white/10 dark:hx-text-gray-400 dark:hover:hx-text-gray-50&#34;
    title=&#34;Copy code&#34;
  &gt;
    &lt;div class=&#34;copy-icon group-[.copied]/copybtn:hx-hidden hx-pointer-events-none hx-h-4 hx-w-4&#34;&gt;&lt;/div&gt;
    &lt;div class=&#34;success-icon hx-hidden group-[.copied]/copybtn:hx-block hx-pointer-events-none hx-h-4 hx-w-4&#34;&gt;&lt;/div&gt;
  &lt;/button&gt;
&lt;/div&gt;
&lt;/div&gt;
&lt;p&gt;Pass the OAuth2 access token to the backend application (true/false). Allows Cavaliba to use the token for calling other APIs on behalf of the user.&lt;/p&gt;
&lt;h3&gt;Session and Security&lt;span class=&#34;hx-absolute -hx-mt-20&#34; id=&#34;session-and-security&#34;&gt;&lt;/span&gt;
    &lt;a href=&#34;#session-and-security&#34; class=&#34;subheading-anchor&#34; aria-label=&#34;Permalink for this section&#34;&gt;&lt;/a&gt;&lt;/h3&gt;&lt;h4&gt;OAUTH2_PROXY_SESSION_STORE_TYPE&lt;span class=&#34;hx-absolute -hx-mt-20&#34; id=&#34;oauth2_proxy_session_store_type&#34;&gt;&lt;/span&gt;
    &lt;a href=&#34;#oauth2_proxy_session_store_type&#34; class=&#34;subheading-anchor&#34; aria-label=&#34;Permalink for this section&#34;&gt;&lt;/a&gt;&lt;/h4&gt;&lt;div class=&#34;hextra-code-block hx-relative hx-mt-6 first:hx-mt-0 hx-group/code&#34;&gt;

&lt;div&gt;&lt;pre&gt;&lt;code&gt;OAUTH2_PROXY_SESSION_STORE_TYPE=&amp;#34;redis&amp;#34;&lt;/code&gt;&lt;/pre&gt;&lt;/div&gt;&lt;div class=&#34;hextra-code-copy-btn-container hx-opacity-0 hx-transition group-hover/code:hx-opacity-100 hx-flex hx-gap-1 hx-absolute hx-m-[11px] hx-right-0 hx-top-0&#34;&gt;
  &lt;button
    class=&#34;hextra-code-copy-btn hx-group/copybtn hx-transition-all active:hx-opacity-50 hx-bg-primary-700/5 hx-border hx-border-black/5 hx-text-gray-600 hover:hx-text-gray-900 hx-rounded-md hx-p-1.5 dark:hx-bg-primary-300/10 dark:hx-border-white/10 dark:hx-text-gray-400 dark:hover:hx-text-gray-50&#34;
    title=&#34;Copy code&#34;
  &gt;
    &lt;div class=&#34;copy-icon group-[.copied]/copybtn:hx-hidden hx-pointer-events-none hx-h-4 hx-w-4&#34;&gt;&lt;/div&gt;
    &lt;div class=&#34;success-icon hx-hidden group-[.copied]/copybtn:hx-block hx-pointer-events-none hx-h-4 hx-w-4&#34;&gt;&lt;/div&gt;
  &lt;/button&gt;
&lt;/div&gt;
&lt;/div&gt;
&lt;p&gt;Storage backend for OAuth2 sessions. &lt;code&gt;redis&lt;/code&gt; uses Redis for distributed deployments. Must be set to &lt;code&gt;redis&lt;/code&gt; for multi-instance deployments.&lt;/p&gt;
&lt;h4&gt;OAUTH2_PROXY_REDIS_CONNECTION_URL&lt;span class=&#34;hx-absolute -hx-mt-20&#34; id=&#34;oauth2_proxy_redis_connection_url&#34;&gt;&lt;/span&gt;
    &lt;a href=&#34;#oauth2_proxy_redis_connection_url&#34; class=&#34;subheading-anchor&#34; aria-label=&#34;Permalink for this section&#34;&gt;&lt;/a&gt;&lt;/h4&gt;&lt;div class=&#34;hextra-code-block hx-relative hx-mt-6 first:hx-mt-0 hx-group/code&#34;&gt;

&lt;div&gt;&lt;pre&gt;&lt;code&gt;OAUTH2_PROXY_REDIS_CONNECTION_URL=&amp;#34;redis://cavaliba_redis&amp;#34;&lt;/code&gt;&lt;/pre&gt;&lt;/div&gt;&lt;div class=&#34;hextra-code-copy-btn-container hx-opacity-0 hx-transition group-hover/code:hx-opacity-100 hx-flex hx-gap-1 hx-absolute hx-m-[11px] hx-right-0 hx-top-0&#34;&gt;
  &lt;button
    class=&#34;hextra-code-copy-btn hx-group/copybtn hx-transition-all active:hx-opacity-50 hx-bg-primary-700/5 hx-border hx-border-black/5 hx-text-gray-600 hover:hx-text-gray-900 hx-rounded-md hx-p-1.5 dark:hx-bg-primary-300/10 dark:hx-border-white/10 dark:hx-text-gray-400 dark:hover:hx-text-gray-50&#34;
    title=&#34;Copy code&#34;
  &gt;
    &lt;div class=&#34;copy-icon group-[.copied]/copybtn:hx-hidden hx-pointer-events-none hx-h-4 hx-w-4&#34;&gt;&lt;/div&gt;
    &lt;div class=&#34;success-icon hx-hidden group-[.copied]/copybtn:hx-block hx-pointer-events-none hx-h-4 hx-w-4&#34;&gt;&lt;/div&gt;
  &lt;/button&gt;
&lt;/div&gt;
&lt;/div&gt;
&lt;p&gt;Redis connection URL for OAuth2 session storage. Sessions are stored here for scalability across multiple OAuth2 proxy instances. Example: &lt;code&gt;redis://redis.company.com:6379&lt;/code&gt;.&lt;/p&gt;
&lt;h4&gt;OAUTH2_PROXY_COOKIE_HTTPONLY&lt;span class=&#34;hx-absolute -hx-mt-20&#34; id=&#34;oauth2_proxy_cookie_httponly&#34;&gt;&lt;/span&gt;
    &lt;a href=&#34;#oauth2_proxy_cookie_httponly&#34; class=&#34;subheading-anchor&#34; aria-label=&#34;Permalink for this section&#34;&gt;&lt;/a&gt;&lt;/h4&gt;&lt;div class=&#34;hextra-code-block hx-relative hx-mt-6 first:hx-mt-0 hx-group/code&#34;&gt;

&lt;div&gt;&lt;pre&gt;&lt;code&gt;OAUTH2_PROXY_COOKIE_HTTPONLY=&amp;#34;false&amp;#34;&lt;/code&gt;&lt;/pre&gt;&lt;/div&gt;&lt;div class=&#34;hextra-code-copy-btn-container hx-opacity-0 hx-transition group-hover/code:hx-opacity-100 hx-flex hx-gap-1 hx-absolute hx-m-[11px] hx-right-0 hx-top-0&#34;&gt;
  &lt;button
    class=&#34;hextra-code-copy-btn hx-group/copybtn hx-transition-all active:hx-opacity-50 hx-bg-primary-700/5 hx-border hx-border-black/5 hx-text-gray-600 hover:hx-text-gray-900 hx-rounded-md hx-p-1.5 dark:hx-bg-primary-300/10 dark:hx-border-white/10 dark:hx-text-gray-400 dark:hover:hx-text-gray-50&#34;
    title=&#34;Copy code&#34;
  &gt;
    &lt;div class=&#34;copy-icon group-[.copied]/copybtn:hx-hidden hx-pointer-events-none hx-h-4 hx-w-4&#34;&gt;&lt;/div&gt;
    &lt;div class=&#34;success-icon hx-hidden group-[.copied]/copybtn:hx-block hx-pointer-events-none hx-h-4 hx-w-4&#34;&gt;&lt;/div&gt;
  &lt;/button&gt;
&lt;/div&gt;
&lt;/div&gt;
&lt;p&gt;Prevent JavaScript access to OAuth2 session cookies (true/false). When &lt;code&gt;true&lt;/code&gt;, improves security against XSS attacks. Recommended value: &lt;code&gt;true&lt;/code&gt;.&lt;/p&gt;
&lt;h4&gt;OAUTH2_PROXY_COOKIE_SECURE&lt;span class=&#34;hx-absolute -hx-mt-20&#34; id=&#34;oauth2_proxy_cookie_secure&#34;&gt;&lt;/span&gt;
    &lt;a href=&#34;#oauth2_proxy_cookie_secure&#34; class=&#34;subheading-anchor&#34; aria-label=&#34;Permalink for this section&#34;&gt;&lt;/a&gt;&lt;/h4&gt;&lt;div class=&#34;hextra-code-block hx-relative hx-mt-6 first:hx-mt-0 hx-group/code&#34;&gt;

&lt;div&gt;&lt;pre&gt;&lt;code&gt;OAUTH2_PROXY_COOKIE_SECURE=&amp;#34;true&amp;#34;&lt;/code&gt;&lt;/pre&gt;&lt;/div&gt;&lt;div class=&#34;hextra-code-copy-btn-container hx-opacity-0 hx-transition group-hover/code:hx-opacity-100 hx-flex hx-gap-1 hx-absolute hx-m-[11px] hx-right-0 hx-top-0&#34;&gt;
  &lt;button
    class=&#34;hextra-code-copy-btn hx-group/copybtn hx-transition-all active:hx-opacity-50 hx-bg-primary-700/5 hx-border hx-border-black/5 hx-text-gray-600 hover:hx-text-gray-900 hx-rounded-md hx-p-1.5 dark:hx-bg-primary-300/10 dark:hx-border-white/10 dark:hx-text-gray-400 dark:hover:hx-text-gray-50&#34;
    title=&#34;Copy code&#34;
  &gt;
    &lt;div class=&#34;copy-icon group-[.copied]/copybtn:hx-hidden hx-pointer-events-none hx-h-4 hx-w-4&#34;&gt;&lt;/div&gt;
    &lt;div class=&#34;success-icon hx-hidden group-[.copied]/copybtn:hx-block hx-pointer-events-none hx-h-4 hx-w-4&#34;&gt;&lt;/div&gt;
  &lt;/button&gt;
&lt;/div&gt;
&lt;/div&gt;
&lt;p&gt;Require HTTPS for OAuth2 session cookies (true/false). When &lt;code&gt;true&lt;/code&gt;, cookies are not sent over unencrypted HTTP. Should be &lt;code&gt;true&lt;/code&gt; in production. Set to &lt;code&gt;false&lt;/code&gt; only for development.&lt;/p&gt;
&lt;h4&gt;OAUTH2_PROXY_COOKIE_REFRESH&lt;span class=&#34;hx-absolute -hx-mt-20&#34; id=&#34;oauth2_proxy_cookie_refresh&#34;&gt;&lt;/span&gt;
    &lt;a href=&#34;#oauth2_proxy_cookie_refresh&#34; class=&#34;subheading-anchor&#34; aria-label=&#34;Permalink for this section&#34;&gt;&lt;/a&gt;&lt;/h4&gt;&lt;div class=&#34;hextra-code-block hx-relative hx-mt-6 first:hx-mt-0 hx-group/code&#34;&gt;

&lt;div&gt;&lt;pre&gt;&lt;code&gt;OAUTH2_PROXY_COOKIE_REFRESH=&amp;#34;true&amp;#34;&lt;/code&gt;&lt;/pre&gt;&lt;/div&gt;&lt;div class=&#34;hextra-code-copy-btn-container hx-opacity-0 hx-transition group-hover/code:hx-opacity-100 hx-flex hx-gap-1 hx-absolute hx-m-[11px] hx-right-0 hx-top-0&#34;&gt;
  &lt;button
    class=&#34;hextra-code-copy-btn hx-group/copybtn hx-transition-all active:hx-opacity-50 hx-bg-primary-700/5 hx-border hx-border-black/5 hx-text-gray-600 hover:hx-text-gray-900 hx-rounded-md hx-p-1.5 dark:hx-bg-primary-300/10 dark:hx-border-white/10 dark:hx-text-gray-400 dark:hover:hx-text-gray-50&#34;
    title=&#34;Copy code&#34;
  &gt;
    &lt;div class=&#34;copy-icon group-[.copied]/copybtn:hx-hidden hx-pointer-events-none hx-h-4 hx-w-4&#34;&gt;&lt;/div&gt;
    &lt;div class=&#34;success-icon hx-hidden group-[.copied]/copybtn:hx-block hx-pointer-events-none hx-h-4 hx-w-4&#34;&gt;&lt;/div&gt;
  &lt;/button&gt;
&lt;/div&gt;
&lt;/div&gt;
&lt;p&gt;Refresh OAuth2 session cookie on each request (true/false). When &lt;code&gt;true&lt;/code&gt;, extends session timeout with activity. Improves user experience but increases overhead.&lt;/p&gt;
&lt;h4&gt;OAUTH2_PROXY_COOKIE_SAMESITE&lt;span class=&#34;hx-absolute -hx-mt-20&#34; id=&#34;oauth2_proxy_cookie_samesite&#34;&gt;&lt;/span&gt;
    &lt;a href=&#34;#oauth2_proxy_cookie_samesite&#34; class=&#34;subheading-anchor&#34; aria-label=&#34;Permalink for this section&#34;&gt;&lt;/a&gt;&lt;/h4&gt;&lt;div class=&#34;hextra-code-block hx-relative hx-mt-6 first:hx-mt-0 hx-group/code&#34;&gt;

&lt;div&gt;&lt;pre&gt;&lt;code&gt;OAUTH2_PROXY_COOKIE_SAMESITE=&amp;#34;lax&amp;#34;&lt;/code&gt;&lt;/pre&gt;&lt;/div&gt;&lt;div class=&#34;hextra-code-copy-btn-container hx-opacity-0 hx-transition group-hover/code:hx-opacity-100 hx-flex hx-gap-1 hx-absolute hx-m-[11px] hx-right-0 hx-top-0&#34;&gt;
  &lt;button
    class=&#34;hextra-code-copy-btn hx-group/copybtn hx-transition-all active:hx-opacity-50 hx-bg-primary-700/5 hx-border hx-border-black/5 hx-text-gray-600 hover:hx-text-gray-900 hx-rounded-md hx-p-1.5 dark:hx-bg-primary-300/10 dark:hx-border-white/10 dark:hx-text-gray-400 dark:hover:hx-text-gray-50&#34;
    title=&#34;Copy code&#34;
  &gt;
    &lt;div class=&#34;copy-icon group-[.copied]/copybtn:hx-hidden hx-pointer-events-none hx-h-4 hx-w-4&#34;&gt;&lt;/div&gt;
    &lt;div class=&#34;success-icon hx-hidden group-[.copied]/copybtn:hx-block hx-pointer-events-none hx-h-4 hx-w-4&#34;&gt;&lt;/div&gt;
  &lt;/button&gt;
&lt;/div&gt;
&lt;/div&gt;
&lt;p&gt;SameSite policy for OAuth2 cookies. Options: &lt;code&gt;lax&lt;/code&gt; (recommended), &lt;code&gt;strict&lt;/code&gt; (most secure), &lt;code&gt;none&lt;/code&gt; (least secure). &lt;code&gt;lax&lt;/code&gt; is a good balance between security and usability.&lt;/p&gt;
&lt;h4&gt;OAUTH2_PROXY_COOKIE_CSRF_EXPIRE&lt;span class=&#34;hx-absolute -hx-mt-20&#34; id=&#34;oauth2_proxy_cookie_csrf_expire&#34;&gt;&lt;/span&gt;
    &lt;a href=&#34;#oauth2_proxy_cookie_csrf_expire&#34; class=&#34;subheading-anchor&#34; aria-label=&#34;Permalink for this section&#34;&gt;&lt;/a&gt;&lt;/h4&gt;&lt;div class=&#34;hextra-code-block hx-relative hx-mt-6 first:hx-mt-0 hx-group/code&#34;&gt;

&lt;div&gt;&lt;pre&gt;&lt;code&gt;OAUTH2_PROXY_COOKIE_CSRF_EXPIRE=&amp;#34;7m&amp;#34;&lt;/code&gt;&lt;/pre&gt;&lt;/div&gt;&lt;div class=&#34;hextra-code-copy-btn-container hx-opacity-0 hx-transition group-hover/code:hx-opacity-100 hx-flex hx-gap-1 hx-absolute hx-m-[11px] hx-right-0 hx-top-0&#34;&gt;
  &lt;button
    class=&#34;hextra-code-copy-btn hx-group/copybtn hx-transition-all active:hx-opacity-50 hx-bg-primary-700/5 hx-border hx-border-black/5 hx-text-gray-600 hover:hx-text-gray-900 hx-rounded-md hx-p-1.5 dark:hx-bg-primary-300/10 dark:hx-border-white/10 dark:hx-text-gray-400 dark:hover:hx-text-gray-50&#34;
    title=&#34;Copy code&#34;
  &gt;
    &lt;div class=&#34;copy-icon group-[.copied]/copybtn:hx-hidden hx-pointer-events-none hx-h-4 hx-w-4&#34;&gt;&lt;/div&gt;
    &lt;div class=&#34;success-icon hx-hidden group-[.copied]/copybtn:hx-block hx-pointer-events-none hx-h-4 hx-w-4&#34;&gt;&lt;/div&gt;
  &lt;/button&gt;
&lt;/div&gt;
&lt;/div&gt;
&lt;p&gt;CSRF protection cookie expiration (format: &lt;code&gt;XmYs&lt;/code&gt;). These temporary cookies protect against cross-site request forgery attacks during login. Example: &lt;code&gt;5m&lt;/code&gt; for 5 minutes, &lt;code&gt;10m&lt;/code&gt; for 10 minutes.&lt;/p&gt;
&lt;h3&gt;Logging Configuration&lt;span class=&#34;hx-absolute -hx-mt-20&#34; id=&#34;logging-configuration&#34;&gt;&lt;/span&gt;
    &lt;a href=&#34;#logging-configuration&#34; class=&#34;subheading-anchor&#34; aria-label=&#34;Permalink for this section&#34;&gt;&lt;/a&gt;&lt;/h3&gt;&lt;h4&gt;OAUTH2_PROXY_AUTH_LOGGING&lt;span class=&#34;hx-absolute -hx-mt-20&#34; id=&#34;oauth2_proxy_auth_logging&#34;&gt;&lt;/span&gt;
    &lt;a href=&#34;#oauth2_proxy_auth_logging&#34; class=&#34;subheading-anchor&#34; aria-label=&#34;Permalink for this section&#34;&gt;&lt;/a&gt;&lt;/h4&gt;&lt;div class=&#34;hextra-code-block hx-relative hx-mt-6 first:hx-mt-0 hx-group/code&#34;&gt;

&lt;div&gt;&lt;pre&gt;&lt;code&gt;OAUTH2_PROXY_AUTH_LOGGING=&amp;#34;true&amp;#34;&lt;/code&gt;&lt;/pre&gt;&lt;/div&gt;&lt;div class=&#34;hextra-code-copy-btn-container hx-opacity-0 hx-transition group-hover/code:hx-opacity-100 hx-flex hx-gap-1 hx-absolute hx-m-[11px] hx-right-0 hx-top-0&#34;&gt;
  &lt;button
    class=&#34;hextra-code-copy-btn hx-group/copybtn hx-transition-all active:hx-opacity-50 hx-bg-primary-700/5 hx-border hx-border-black/5 hx-text-gray-600 hover:hx-text-gray-900 hx-rounded-md hx-p-1.5 dark:hx-bg-primary-300/10 dark:hx-border-white/10 dark:hx-text-gray-400 dark:hover:hx-text-gray-50&#34;
    title=&#34;Copy code&#34;
  &gt;
    &lt;div class=&#34;copy-icon group-[.copied]/copybtn:hx-hidden hx-pointer-events-none hx-h-4 hx-w-4&#34;&gt;&lt;/div&gt;
    &lt;div class=&#34;success-icon hx-hidden group-[.copied]/copybtn:hx-block hx-pointer-events-none hx-h-4 hx-w-4&#34;&gt;&lt;/div&gt;
  &lt;/button&gt;
&lt;/div&gt;
&lt;/div&gt;
&lt;p&gt;Enable logging of authentication attempts and decisions (true/false). Useful for debugging login issues and monitoring authentication events.&lt;/p&gt;
&lt;h4&gt;OAUTH2_PROXY_STANDARD_LOGGING&lt;span class=&#34;hx-absolute -hx-mt-20&#34; id=&#34;oauth2_proxy_standard_logging&#34;&gt;&lt;/span&gt;
    &lt;a href=&#34;#oauth2_proxy_standard_logging&#34; class=&#34;subheading-anchor&#34; aria-label=&#34;Permalink for this section&#34;&gt;&lt;/a&gt;&lt;/h4&gt;&lt;div class=&#34;hextra-code-block hx-relative hx-mt-6 first:hx-mt-0 hx-group/code&#34;&gt;

&lt;div&gt;&lt;pre&gt;&lt;code&gt;OAUTH2_PROXY_STANDARD_LOGGING=&amp;#34;true&amp;#34;&lt;/code&gt;&lt;/pre&gt;&lt;/div&gt;&lt;div class=&#34;hextra-code-copy-btn-container hx-opacity-0 hx-transition group-hover/code:hx-opacity-100 hx-flex hx-gap-1 hx-absolute hx-m-[11px] hx-right-0 hx-top-0&#34;&gt;
  &lt;button
    class=&#34;hextra-code-copy-btn hx-group/copybtn hx-transition-all active:hx-opacity-50 hx-bg-primary-700/5 hx-border hx-border-black/5 hx-text-gray-600 hover:hx-text-gray-900 hx-rounded-md hx-p-1.5 dark:hx-bg-primary-300/10 dark:hx-border-white/10 dark:hx-text-gray-400 dark:hover:hx-text-gray-50&#34;
    title=&#34;Copy code&#34;
  &gt;
    &lt;div class=&#34;copy-icon group-[.copied]/copybtn:hx-hidden hx-pointer-events-none hx-h-4 hx-w-4&#34;&gt;&lt;/div&gt;
    &lt;div class=&#34;success-icon hx-hidden group-[.copied]/copybtn:hx-block hx-pointer-events-none hx-h-4 hx-w-4&#34;&gt;&lt;/div&gt;
  &lt;/button&gt;
&lt;/div&gt;
&lt;/div&gt;
&lt;p&gt;Enable standard operational logging of OAuth2 proxy (true/false). Logs proxy startup, configuration, and general operational events.&lt;/p&gt;
&lt;h4&gt;OAUTH2_PROXY_REQUEST_LOGGING&lt;span class=&#34;hx-absolute -hx-mt-20&#34; id=&#34;oauth2_proxy_request_logging&#34;&gt;&lt;/span&gt;
    &lt;a href=&#34;#oauth2_proxy_request_logging&#34; class=&#34;subheading-anchor&#34; aria-label=&#34;Permalink for this section&#34;&gt;&lt;/a&gt;&lt;/h4&gt;&lt;div class=&#34;hextra-code-block hx-relative hx-mt-6 first:hx-mt-0 hx-group/code&#34;&gt;

&lt;div&gt;&lt;pre&gt;&lt;code&gt;OAUTH2_PROXY_REQUEST_LOGGING=&amp;#34;false&amp;#34;&lt;/code&gt;&lt;/pre&gt;&lt;/div&gt;&lt;div class=&#34;hextra-code-copy-btn-container hx-opacity-0 hx-transition group-hover/code:hx-opacity-100 hx-flex hx-gap-1 hx-absolute hx-m-[11px] hx-right-0 hx-top-0&#34;&gt;
  &lt;button
    class=&#34;hextra-code-copy-btn hx-group/copybtn hx-transition-all active:hx-opacity-50 hx-bg-primary-700/5 hx-border hx-border-black/5 hx-text-gray-600 hover:hx-text-gray-900 hx-rounded-md hx-p-1.5 dark:hx-bg-primary-300/10 dark:hx-border-white/10 dark:hx-text-gray-400 dark:hover:hx-text-gray-50&#34;
    title=&#34;Copy code&#34;
  &gt;
    &lt;div class=&#34;copy-icon group-[.copied]/copybtn:hx-hidden hx-pointer-events-none hx-h-4 hx-w-4&#34;&gt;&lt;/div&gt;
    &lt;div class=&#34;success-icon hx-hidden group-[.copied]/copybtn:hx-block hx-pointer-events-none hx-h-4 hx-w-4&#34;&gt;&lt;/div&gt;
  &lt;/button&gt;
&lt;/div&gt;
&lt;/div&gt;
&lt;p&gt;Log all HTTP requests to OAuth2 proxy (true/false). Creates verbose logs of every request. Useful for debugging but impacts performance and log size.&lt;/p&gt;
&lt;h4&gt;OAUTH2_PROXY_SHOW_DEBUG_ON_ERROR&lt;span class=&#34;hx-absolute -hx-mt-20&#34; id=&#34;oauth2_proxy_show_debug_on_error&#34;&gt;&lt;/span&gt;
    &lt;a href=&#34;#oauth2_proxy_show_debug_on_error&#34; class=&#34;subheading-anchor&#34; aria-label=&#34;Permalink for this section&#34;&gt;&lt;/a&gt;&lt;/h4&gt;&lt;div class=&#34;hextra-code-block hx-relative hx-mt-6 first:hx-mt-0 hx-group/code&#34;&gt;

&lt;div&gt;&lt;pre&gt;&lt;code&gt;OAUTH2_PROXY_SHOW_DEBUG_ON_ERROR=&amp;#34;false&amp;#34;&lt;/code&gt;&lt;/pre&gt;&lt;/div&gt;&lt;div class=&#34;hextra-code-copy-btn-container hx-opacity-0 hx-transition group-hover/code:hx-opacity-100 hx-flex hx-gap-1 hx-absolute hx-m-[11px] hx-right-0 hx-top-0&#34;&gt;
  &lt;button
    class=&#34;hextra-code-copy-btn hx-group/copybtn hx-transition-all active:hx-opacity-50 hx-bg-primary-700/5 hx-border hx-border-black/5 hx-text-gray-600 hover:hx-text-gray-900 hx-rounded-md hx-p-1.5 dark:hx-bg-primary-300/10 dark:hx-border-white/10 dark:hx-text-gray-400 dark:hover:hx-text-gray-50&#34;
    title=&#34;Copy code&#34;
  &gt;
    &lt;div class=&#34;copy-icon group-[.copied]/copybtn:hx-hidden hx-pointer-events-none hx-h-4 hx-w-4&#34;&gt;&lt;/div&gt;
    &lt;div class=&#34;success-icon hx-hidden group-[.copied]/copybtn:hx-block hx-pointer-events-none hx-h-4 hx-w-4&#34;&gt;&lt;/div&gt;
  &lt;/button&gt;
&lt;/div&gt;
&lt;/div&gt;
&lt;p&gt;Display debug information when errors occur (true/false). Shows detailed error messages and stack traces. Disable in production for security.&lt;/p&gt;
&lt;hr&gt;
&lt;h2&gt;Application Server Configuration&lt;span class=&#34;hx-absolute -hx-mt-20&#34; id=&#34;application-server-configuration&#34;&gt;&lt;/span&gt;
    &lt;a href=&#34;#application-server-configuration&#34; class=&#34;subheading-anchor&#34; aria-label=&#34;Permalink for this section&#34;&gt;&lt;/a&gt;&lt;/h2&gt;&lt;h3&gt;GUNICORN_CMD_ARGS&lt;span class=&#34;hx-absolute -hx-mt-20&#34; id=&#34;gunicorn_cmd_args&#34;&gt;&lt;/span&gt;
    &lt;a href=&#34;#gunicorn_cmd_args&#34; class=&#34;subheading-anchor&#34; aria-label=&#34;Permalink for this section&#34;&gt;&lt;/a&gt;&lt;/h3&gt;&lt;div class=&#34;hextra-code-block hx-relative hx-mt-6 first:hx-mt-0 hx-group/code&#34;&gt;

&lt;div&gt;&lt;pre&gt;&lt;code&gt;GUNICORN_CMD_ARGS=&amp;#34;--workers=5 --log-level info --max-requests 500 --access-logfile &amp;#39;-&amp;#39; --error-logfile &amp;#39;-&amp;#39; --graceful-timeout 2&amp;#34;&lt;/code&gt;&lt;/pre&gt;&lt;/div&gt;&lt;div class=&#34;hextra-code-copy-btn-container hx-opacity-0 hx-transition group-hover/code:hx-opacity-100 hx-flex hx-gap-1 hx-absolute hx-m-[11px] hx-right-0 hx-top-0&#34;&gt;
  &lt;button
    class=&#34;hextra-code-copy-btn hx-group/copybtn hx-transition-all active:hx-opacity-50 hx-bg-primary-700/5 hx-border hx-border-black/5 hx-text-gray-600 hover:hx-text-gray-900 hx-rounded-md hx-p-1.5 dark:hx-bg-primary-300/10 dark:hx-border-white/10 dark:hx-text-gray-400 dark:hover:hx-text-gray-50&#34;
    title=&#34;Copy code&#34;
  &gt;
    &lt;div class=&#34;copy-icon group-[.copied]/copybtn:hx-hidden hx-pointer-events-none hx-h-4 hx-w-4&#34;&gt;&lt;/div&gt;
    &lt;div class=&#34;success-icon hx-hidden group-[.copied]/copybtn:hx-block hx-pointer-events-none hx-h-4 hx-w-4&#34;&gt;&lt;/div&gt;
  &lt;/button&gt;
&lt;/div&gt;
&lt;/div&gt;
&lt;p&gt;Gunicorn WSGI application server configuration. Controls number of worker processes, request limits, timeouts, and logging. Key options:&lt;/p&gt;
&lt;ul&gt;
&lt;li&gt;&lt;code&gt;--workers=N&lt;/code&gt;: Number of worker processes (typically CPU_count + 1). Example: &lt;code&gt;--workers=8&lt;/code&gt; for 8 cores.&lt;/li&gt;
&lt;li&gt;&lt;code&gt;--max-requests N&lt;/code&gt;: Recycle worker after N requests (prevents memory leaks). Example: &lt;code&gt;--max-requests 1000&lt;/code&gt;.&lt;/li&gt;
&lt;li&gt;&lt;code&gt;--log-level&lt;/code&gt;: Logging level (&lt;code&gt;debug&lt;/code&gt;, &lt;code&gt;info&lt;/code&gt;, &lt;code&gt;warning&lt;/code&gt;, &lt;code&gt;error&lt;/code&gt;, &lt;code&gt;critical&lt;/code&gt;). Example: &lt;code&gt;--log-level warning&lt;/code&gt; for less verbose.&lt;/li&gt;
&lt;li&gt;&lt;code&gt;--timeout N&lt;/code&gt;: Request timeout in seconds. Example: &lt;code&gt;--timeout 60&lt;/code&gt; for 60 seconds.&lt;/li&gt;
&lt;/ul&gt;
&lt;p&gt;Example for high-traffic: &lt;code&gt;--workers=16 --max-requests 5000 --log-level warning --timeout 120&lt;/code&gt;&lt;/p&gt;
&lt;hr&gt;
&lt;h2&gt;Misc&lt;span class=&#34;hx-absolute -hx-mt-20&#34; id=&#34;misc&#34;&gt;&lt;/span&gt;
    &lt;a href=&#34;#misc&#34; class=&#34;subheading-anchor&#34; aria-label=&#34;Permalink for this section&#34;&gt;&lt;/a&gt;&lt;/h2&gt;&lt;h3&gt;CAVALIBA_LAST_LOGIN_MINUTES&lt;span class=&#34;hx-absolute -hx-mt-20&#34; id=&#34;cavaliba_last_login_minutes&#34;&gt;&lt;/span&gt;
    &lt;a href=&#34;#cavaliba_last_login_minutes&#34; class=&#34;subheading-anchor&#34; aria-label=&#34;Permalink for this section&#34;&gt;&lt;/a&gt;&lt;/h3&gt;&lt;div class=&#34;hextra-code-block hx-relative hx-mt-6 first:hx-mt-0 hx-group/code&#34;&gt;

&lt;div&gt;&lt;pre&gt;&lt;code&gt;CAVALIBA_LAST_LOGIN_MINUTES=2&lt;/code&gt;&lt;/pre&gt;&lt;/div&gt;&lt;div class=&#34;hextra-code-copy-btn-container hx-opacity-0 hx-transition group-hover/code:hx-opacity-100 hx-flex hx-gap-1 hx-absolute hx-m-[11px] hx-right-0 hx-top-0&#34;&gt;
  &lt;button
    class=&#34;hextra-code-copy-btn hx-group/copybtn hx-transition-all active:hx-opacity-50 hx-bg-primary-700/5 hx-border hx-border-black/5 hx-text-gray-600 hover:hx-text-gray-900 hx-rounded-md hx-p-1.5 dark:hx-bg-primary-300/10 dark:hx-border-white/10 dark:hx-text-gray-400 dark:hover:hx-text-gray-50&#34;
    title=&#34;Copy code&#34;
  &gt;
    &lt;div class=&#34;copy-icon group-[.copied]/copybtn:hx-hidden hx-pointer-events-none hx-h-4 hx-w-4&#34;&gt;&lt;/div&gt;
    &lt;div class=&#34;success-icon hx-hidden group-[.copied]/copybtn:hx-block hx-pointer-events-none hx-h-4 hx-w-4&#34;&gt;&lt;/div&gt;
  &lt;/button&gt;
&lt;/div&gt;
&lt;/div&gt;
&lt;p&gt;Refresh user last_login if idle more than this amount of minutes.&lt;/p&gt;
&lt;hr&gt;
&lt;h3&gt;CAVALIBA_MAX_COMPUTED_USER&lt;span class=&#34;hx-absolute -hx-mt-20&#34; id=&#34;cavaliba_max_computed_user&#34;&gt;&lt;/span&gt;
    &lt;a href=&#34;#cavaliba_max_computed_user&#34; class=&#34;subheading-anchor&#34; aria-label=&#34;Permalink for this section&#34;&gt;&lt;/a&gt;&lt;/h3&gt;&lt;div class=&#34;hextra-code-block hx-relative hx-mt-6 first:hx-mt-0 hx-group/code&#34;&gt;

&lt;div&gt;&lt;pre&gt;&lt;code&gt;CAVALIBA_MAX_COMPUTED_USER=500&lt;/code&gt;&lt;/pre&gt;&lt;/div&gt;&lt;div class=&#34;hextra-code-copy-btn-container hx-opacity-0 hx-transition group-hover/code:hx-opacity-100 hx-flex hx-gap-1 hx-absolute hx-m-[11px] hx-right-0 hx-top-0&#34;&gt;
  &lt;button
    class=&#34;hextra-code-copy-btn hx-group/copybtn hx-transition-all active:hx-opacity-50 hx-bg-primary-700/5 hx-border hx-border-black/5 hx-text-gray-600 hover:hx-text-gray-900 hx-rounded-md hx-p-1.5 dark:hx-bg-primary-300/10 dark:hx-border-white/10 dark:hx-text-gray-400 dark:hover:hx-text-gray-50&#34;
    title=&#34;Copy code&#34;
  &gt;
    &lt;div class=&#34;copy-icon group-[.copied]/copybtn:hx-hidden hx-pointer-events-none hx-h-4 hx-w-4&#34;&gt;&lt;/div&gt;
    &lt;div class=&#34;success-icon hx-hidden group-[.copied]/copybtn:hx-block hx-pointer-events-none hx-h-4 hx-w-4&#34;&gt;&lt;/div&gt;
  &lt;/button&gt;
&lt;/div&gt;
&lt;/div&gt;
&lt;p&gt;Maximum number of users computed and returned per group (direct members, auto members, and recursive members). Applies as a cap to each user list independently. Increase for large groups; lower to protect performance. Default: &lt;code&gt;500&lt;/code&gt;.&lt;/p&gt;
&lt;hr&gt;
&lt;h2&gt;Debug and Development&lt;span class=&#34;hx-absolute -hx-mt-20&#34; id=&#34;debug-and-development&#34;&gt;&lt;/span&gt;
    &lt;a href=&#34;#debug-and-development&#34; class=&#34;subheading-anchor&#34; aria-label=&#34;Permalink for this section&#34;&gt;&lt;/a&gt;&lt;/h2&gt;&lt;h3&gt;CAVALIBA_DEBUG&lt;span class=&#34;hx-absolute -hx-mt-20&#34; id=&#34;cavaliba_debug&#34;&gt;&lt;/span&gt;
    &lt;a href=&#34;#cavaliba_debug&#34; class=&#34;subheading-anchor&#34; aria-label=&#34;Permalink for this section&#34;&gt;&lt;/a&gt;&lt;/h3&gt;&lt;div class=&#34;hextra-code-block hx-relative hx-mt-6 first:hx-mt-0 hx-group/code&#34;&gt;

&lt;div&gt;&lt;pre&gt;&lt;code&gt;CAVALIBA_DEBUG=0&lt;/code&gt;&lt;/pre&gt;&lt;/div&gt;&lt;div class=&#34;hextra-code-copy-btn-container hx-opacity-0 hx-transition group-hover/code:hx-opacity-100 hx-flex hx-gap-1 hx-absolute hx-m-[11px] hx-right-0 hx-top-0&#34;&gt;
  &lt;button
    class=&#34;hextra-code-copy-btn hx-group/copybtn hx-transition-all active:hx-opacity-50 hx-bg-primary-700/5 hx-border hx-border-black/5 hx-text-gray-600 hover:hx-text-gray-900 hx-rounded-md hx-p-1.5 dark:hx-bg-primary-300/10 dark:hx-border-white/10 dark:hx-text-gray-400 dark:hover:hx-text-gray-50&#34;
    title=&#34;Copy code&#34;
  &gt;
    &lt;div class=&#34;copy-icon group-[.copied]/copybtn:hx-hidden hx-pointer-events-none hx-h-4 hx-w-4&#34;&gt;&lt;/div&gt;
    &lt;div class=&#34;success-icon hx-hidden group-[.copied]/copybtn:hx-block hx-pointer-events-none hx-h-4 hx-w-4&#34;&gt;&lt;/div&gt;
  &lt;/button&gt;
&lt;/div&gt;
&lt;/div&gt;
&lt;p&gt;Enable Django debug mode (0 for off, 1 for on). &lt;strong&gt;Set to 0 in PRODUCTION&lt;/strong&gt;. When enabled, shows detailed error pages and disables security features. Never enable in production. Example: Set to &lt;code&gt;1&lt;/code&gt; only in development/testing environments.&lt;/p&gt;
&lt;h3&gt;CAVALIBA_DEBUG_IP&lt;span class=&#34;hx-absolute -hx-mt-20&#34; id=&#34;cavaliba_debug_ip&#34;&gt;&lt;/span&gt;
    &lt;a href=&#34;#cavaliba_debug_ip&#34; class=&#34;subheading-anchor&#34; aria-label=&#34;Permalink for this section&#34;&gt;&lt;/a&gt;&lt;/h3&gt;&lt;div class=&#34;hextra-code-block hx-relative hx-mt-6 first:hx-mt-0 hx-group/code&#34;&gt;

&lt;div&gt;&lt;pre&gt;&lt;code&gt;CAVALIBA_DEBUG_IP=&amp;#34;127.0.0.1 172.19.0.1&amp;#34;&lt;/code&gt;&lt;/pre&gt;&lt;/div&gt;&lt;div class=&#34;hextra-code-copy-btn-container hx-opacity-0 hx-transition group-hover/code:hx-opacity-100 hx-flex hx-gap-1 hx-absolute hx-m-[11px] hx-right-0 hx-top-0&#34;&gt;
  &lt;button
    class=&#34;hextra-code-copy-btn hx-group/copybtn hx-transition-all active:hx-opacity-50 hx-bg-primary-700/5 hx-border hx-border-black/5 hx-text-gray-600 hover:hx-text-gray-900 hx-rounded-md hx-p-1.5 dark:hx-bg-primary-300/10 dark:hx-border-white/10 dark:hx-text-gray-400 dark:hover:hx-text-gray-50&#34;
    title=&#34;Copy code&#34;
  &gt;
    &lt;div class=&#34;copy-icon group-[.copied]/copybtn:hx-hidden hx-pointer-events-none hx-h-4 hx-w-4&#34;&gt;&lt;/div&gt;
    &lt;div class=&#34;success-icon hx-hidden group-[.copied]/copybtn:hx-block hx-pointer-events-none hx-h-4 hx-w-4&#34;&gt;&lt;/div&gt;
  &lt;/button&gt;
&lt;/div&gt;
&lt;/div&gt;
&lt;p&gt;Space-separated list of IP addresses to enable Django Debug Toolbar and additional debug features. Only these IPs see debug information. Used by developers to troubleshoot issues. Example: &lt;code&gt;192.168.1.100 10.0.0.50&lt;/code&gt; for specific developer IPs.&lt;/p&gt;
&lt;h3&gt;CAVALIBA_DEBUG_AAA&lt;span class=&#34;hx-absolute -hx-mt-20&#34; id=&#34;cavaliba_debug_aaa&#34;&gt;&lt;/span&gt;
    &lt;a href=&#34;#cavaliba_debug_aaa&#34; class=&#34;subheading-anchor&#34; aria-label=&#34;Permalink for this section&#34;&gt;&lt;/a&gt;&lt;/h3&gt;&lt;div class=&#34;hextra-code-block hx-relative hx-mt-6 first:hx-mt-0 hx-group/code&#34;&gt;

&lt;div&gt;&lt;pre&gt;&lt;code&gt;CAVALIBA_DEBUG_AAA=&amp;#34;no&amp;#34;&lt;/code&gt;&lt;/pre&gt;&lt;/div&gt;&lt;div class=&#34;hextra-code-copy-btn-container hx-opacity-0 hx-transition group-hover/code:hx-opacity-100 hx-flex hx-gap-1 hx-absolute hx-m-[11px] hx-right-0 hx-top-0&#34;&gt;
  &lt;button
    class=&#34;hextra-code-copy-btn hx-group/copybtn hx-transition-all active:hx-opacity-50 hx-bg-primary-700/5 hx-border hx-border-black/5 hx-text-gray-600 hover:hx-text-gray-900 hx-rounded-md hx-p-1.5 dark:hx-bg-primary-300/10 dark:hx-border-white/10 dark:hx-text-gray-400 dark:hover:hx-text-gray-50&#34;
    title=&#34;Copy code&#34;
  &gt;
    &lt;div class=&#34;copy-icon group-[.copied]/copybtn:hx-hidden hx-pointer-events-none hx-h-4 hx-w-4&#34;&gt;&lt;/div&gt;
    &lt;div class=&#34;success-icon hx-hidden group-[.copied]/copybtn:hx-block hx-pointer-events-none hx-h-4 hx-w-4&#34;&gt;&lt;/div&gt;
  &lt;/button&gt;
&lt;/div&gt;
&lt;/div&gt;
&lt;p&gt;Enable detailed logging of permission system (AAA) operations (yes/no). Shows AAA module decisions and checks for authentication/authorization debugging. Set to &lt;code&gt;yes&lt;/code&gt; only when troubleshooting permission issues.&lt;/p&gt;

      </description>
    </item>
    
    <item>
      <title>App Configuration</title>
      <link>http://localhost:1313/docs/70configuration/app_configuration/</link>
      <pubDate>Mon, 01 Jan 0001 00:00:00 +0000</pubDate>
      
      <guid>http://localhost:1313/docs/70configuration/app_configuration/</guid>
      <description>
        
        
        &lt;p&gt;From the Cavaliba Web UI with appropriate permissions, you can configure many parameters and options for a cavaliba deployment.&lt;/p&gt;
&lt;p&gt;
    &lt;img src=&#34;../app_configuration.png&#34; alt=&#34;config&#34; loading=&#34;lazy&#34; /&gt;&lt;/p&gt;
&lt;p&gt;This page explains all configuration options accessible through the Configuration section.&lt;/p&gt;
&lt;h2&gt;Usage&lt;span class=&#34;hx-absolute -hx-mt-20&#34; id=&#34;usage&#34;&gt;&lt;/span&gt;
    &lt;a href=&#34;#usage&#34; class=&#34;subheading-anchor&#34; aria-label=&#34;Permalink for this section&#34;&gt;&lt;/a&gt;&lt;/h2&gt;&lt;ul&gt;
&lt;li&gt;Use the &lt;code&gt;Configuration&lt;/code&gt; entry in the sidebar.&lt;/li&gt;
&lt;li&gt;Navigate to the desired configuration section.&lt;/li&gt;
&lt;li&gt;Don&amp;rsquo;t forget to save after modifying an option.&lt;/li&gt;
&lt;li&gt;Effect is immediate. No reload/no restart needed.&lt;/li&gt;
&lt;/ul&gt;
&lt;p&gt;&lt;strong&gt;Permission needed:&lt;/strong&gt; &lt;code&gt;p_conf_admin&lt;/code&gt;&lt;/p&gt;
&lt;hr&gt;
&lt;h2&gt;HOME - Global Application Settings&lt;span class=&#34;hx-absolute -hx-mt-20&#34; id=&#34;home---global-application-settings&#34;&gt;&lt;/span&gt;
    &lt;a href=&#34;#home---global-application-settings&#34; class=&#34;subheading-anchor&#34; aria-label=&#34;Permalink for this section&#34;&gt;&lt;/a&gt;&lt;/h2&gt;&lt;h3&gt;GLOBAL_APPNAME&lt;span class=&#34;hx-absolute -hx-mt-20&#34; id=&#34;global_appname&#34;&gt;&lt;/span&gt;
    &lt;a href=&#34;#global_appname&#34; class=&#34;subheading-anchor&#34; aria-label=&#34;Permalink for this section&#34;&gt;&lt;/a&gt;&lt;/h3&gt;&lt;p&gt;&lt;strong&gt;Default:&lt;/strong&gt; &lt;code&gt;Cavaliba&lt;/code&gt;&lt;/p&gt;
&lt;p&gt;The main application name displayed as the top link in the sidebar and throughout the interface.
Customize this to match your organization name. Example: &lt;code&gt;MyCompany IT Portal&lt;/code&gt; or &lt;code&gt;Infrastructure Hub&lt;/code&gt;.&lt;/p&gt;
&lt;h3&gt;CSV_DELIMITER&lt;span class=&#34;hx-absolute -hx-mt-20&#34; id=&#34;csv_delimiter&#34;&gt;&lt;/span&gt;
    &lt;a href=&#34;#csv_delimiter&#34; class=&#34;subheading-anchor&#34; aria-label=&#34;Permalink for this section&#34;&gt;&lt;/a&gt;&lt;/h3&gt;&lt;p&gt;&lt;strong&gt;Default:&lt;/strong&gt; &lt;code&gt;;&lt;/code&gt;&lt;/p&gt;
&lt;p&gt;Default column separator character for CSV files during import/export operations if not specified in the pipeline.
Common values are &lt;code&gt;;&lt;/code&gt; (semicolon) or &lt;code&gt;,&lt;/code&gt; (comma). Used when auto-detecting CSV structure.&lt;/p&gt;
&lt;h3&gt;LOGO_SIZE&lt;span class=&#34;hx-absolute -hx-mt-20&#34; id=&#34;logo_size&#34;&gt;&lt;/span&gt;
    &lt;a href=&#34;#logo_size&#34; class=&#34;subheading-anchor&#34; aria-label=&#34;Permalink for this section&#34;&gt;&lt;/a&gt;&lt;/h3&gt;&lt;p&gt;&lt;strong&gt;Default:&lt;/strong&gt; &lt;code&gt;0&lt;/code&gt;&lt;/p&gt;
&lt;p&gt;Width in pixels for displaying a company logo in the sidebar. Set to &lt;code&gt;0&lt;/code&gt; to disable logo and show app name instead.
Logo file should be placed at &lt;code&gt;/app/files/logo/logo.png&lt;/code&gt;. Recommended size: 200-300 pixels wide.&lt;/p&gt;
&lt;h3&gt;LOG_KEEP_DAYS_DEBUG&lt;span class=&#34;hx-absolute -hx-mt-20&#34; id=&#34;log_keep_days_debug&#34;&gt;&lt;/span&gt;
    &lt;a href=&#34;#log_keep_days_debug&#34; class=&#34;subheading-anchor&#34; aria-label=&#34;Permalink for this section&#34;&gt;&lt;/a&gt;&lt;/h3&gt;&lt;p&gt;&lt;strong&gt;Default:&lt;/strong&gt; &lt;code&gt;7&lt;/code&gt;&lt;/p&gt;
&lt;p&gt;Number of days to retain DEBUG level log entries in the database for interactive access in the Web UI.
A daily housekeeping task automatically purges logs older than this value. Example: Set to &lt;code&gt;14&lt;/code&gt; for 2 weeks of DEBUG logs.&lt;/p&gt;
&lt;h3&gt;LOG_KEEP_DAYS_INFO&lt;span class=&#34;hx-absolute -hx-mt-20&#34; id=&#34;log_keep_days_info&#34;&gt;&lt;/span&gt;
    &lt;a href=&#34;#log_keep_days_info&#34; class=&#34;subheading-anchor&#34; aria-label=&#34;Permalink for this section&#34;&gt;&lt;/a&gt;&lt;/h3&gt;&lt;p&gt;&lt;strong&gt;Default:&lt;/strong&gt; &lt;code&gt;120&lt;/code&gt;&lt;/p&gt;
&lt;p&gt;Number of days to retain INFO level log entries in the database for interactive access in the Web UI.
A daily housekeeping task automatically purges logs older than this value. Example: Set to &lt;code&gt;365&lt;/code&gt; for a full year of INFO logs.&lt;/p&gt;
&lt;h3&gt;LOG_KEEP_DAYS_WARNING&lt;span class=&#34;hx-absolute -hx-mt-20&#34; id=&#34;log_keep_days_warning&#34;&gt;&lt;/span&gt;
    &lt;a href=&#34;#log_keep_days_warning&#34; class=&#34;subheading-anchor&#34; aria-label=&#34;Permalink for this section&#34;&gt;&lt;/a&gt;&lt;/h3&gt;&lt;p&gt;&lt;strong&gt;Default:&lt;/strong&gt; &lt;code&gt;365&lt;/code&gt;&lt;/p&gt;
&lt;p&gt;Number of days to retain WARNING level log entries in the database for interactive access in the Web UI.
A daily housekeeping task automatically purges logs older than this value. Example: Keep at &lt;code&gt;365&lt;/code&gt; for compliance audit trails.&lt;/p&gt;
&lt;h3&gt;LOG_KEEP_DAYS_ERROR&lt;span class=&#34;hx-absolute -hx-mt-20&#34; id=&#34;log_keep_days_error&#34;&gt;&lt;/span&gt;
    &lt;a href=&#34;#log_keep_days_error&#34; class=&#34;subheading-anchor&#34; aria-label=&#34;Permalink for this section&#34;&gt;&lt;/a&gt;&lt;/h3&gt;&lt;p&gt;&lt;strong&gt;Default:&lt;/strong&gt; &lt;code&gt;365&lt;/code&gt;&lt;/p&gt;
&lt;p&gt;Number of days to retain ERROR level log entries in the database for interactive access in the Web UI.
A daily housekeeping task automatically purges logs older than this value. Example: Increase to &lt;code&gt;730&lt;/code&gt; for 2 years of error history.&lt;/p&gt;
&lt;h3&gt;LOG_KEEP_DAYS_CRITICAL&lt;span class=&#34;hx-absolute -hx-mt-20&#34; id=&#34;log_keep_days_critical&#34;&gt;&lt;/span&gt;
    &lt;a href=&#34;#log_keep_days_critical&#34; class=&#34;subheading-anchor&#34; aria-label=&#34;Permalink for this section&#34;&gt;&lt;/a&gt;&lt;/h3&gt;&lt;p&gt;&lt;strong&gt;Default:&lt;/strong&gt; &lt;code&gt;99999&lt;/code&gt;&lt;/p&gt;
&lt;p&gt;Number of days to retain CRITICAL level log entries in the database for interactive access in the Web UI.
A daily housekeeping task purges logs older than this value. The high default (99999 days) effectively keeps critical logs indefinitely.&lt;/p&gt;
&lt;h3&gt;LOG_MAX_ENTRIES&lt;span class=&#34;hx-absolute -hx-mt-20&#34; id=&#34;log_max_entries&#34;&gt;&lt;/span&gt;
    &lt;a href=&#34;#log_max_entries&#34; class=&#34;subheading-anchor&#34; aria-label=&#34;Permalink for this section&#34;&gt;&lt;/a&gt;&lt;/h3&gt;&lt;p&gt;&lt;strong&gt;Default:&lt;/strong&gt; &lt;code&gt;2200000&lt;/code&gt;&lt;/p&gt;
&lt;p&gt;Maximum total number of log entries to maintain across all log levels in the database.
When the total exceeds this limit, oldest logs are purged regardless of retention settings. Prevents database overflow.&lt;/p&gt;
&lt;h3&gt;LOG_EXCLUDED_IP&lt;span class=&#34;hx-absolute -hx-mt-20&#34; id=&#34;log_excluded_ip&#34;&gt;&lt;/span&gt;
    &lt;a href=&#34;#log_excluded_ip&#34; class=&#34;subheading-anchor&#34; aria-label=&#34;Permalink for this section&#34;&gt;&lt;/a&gt;&lt;/h3&gt;&lt;p&gt;&lt;strong&gt;Default:&lt;/strong&gt; `` (empty)&lt;/p&gt;
&lt;p&gt;Space-separated list of IP addresses to exclude from logging to prevent cluttering logs with monitoring/health checks.
Example: &lt;code&gt;192.168.1.50 10.0.0.100&lt;/code&gt; excludes these monitoring servers from appearing in logs.&lt;/p&gt;
&lt;h3&gt;LOG_DEBUG&lt;span class=&#34;hx-absolute -hx-mt-20&#34; id=&#34;log_debug&#34;&gt;&lt;/span&gt;
    &lt;a href=&#34;#log_debug&#34; class=&#34;subheading-anchor&#34; aria-label=&#34;Permalink for this section&#34;&gt;&lt;/a&gt;&lt;/h3&gt;&lt;p&gt;&lt;strong&gt;Default:&lt;/strong&gt; &lt;code&gt;yes&lt;/code&gt;&lt;/p&gt;
&lt;p&gt;Enable or disable DEBUG level logging in the application.
When set to &lt;code&gt;no&lt;/code&gt;, DEBUG messages are not recorded even if the application generates them. Useful for reducing log volume in production.&lt;/p&gt;
&lt;h3&gt;SIDEBAR_ENV&lt;span class=&#34;hx-absolute -hx-mt-20&#34; id=&#34;sidebar_env&#34;&gt;&lt;/span&gt;
    &lt;a href=&#34;#sidebar_env&#34; class=&#34;subheading-anchor&#34; aria-label=&#34;Permalink for this section&#34;&gt;&lt;/a&gt;&lt;/h3&gt;&lt;p&gt;&lt;strong&gt;Default:&lt;/strong&gt; `` (empty)&lt;/p&gt;
&lt;p&gt;Label for the environment displayed prominently in the sidebar to help users identify which environment they&amp;rsquo;re using.
Examples: &lt;code&gt;PROD&lt;/code&gt;, &lt;code&gt;TEST&lt;/code&gt;, &lt;code&gt;DEV&lt;/code&gt;, or &lt;code&gt;STAGING&lt;/code&gt;. Combine with &lt;code&gt;SIDEBAR_COLOR&lt;/code&gt; for visual identification.&lt;/p&gt;
&lt;h3&gt;SIDEBAR_COLOR&lt;span class=&#34;hx-absolute -hx-mt-20&#34; id=&#34;sidebar_color&#34;&gt;&lt;/span&gt;
    &lt;a href=&#34;#sidebar_color&#34; class=&#34;subheading-anchor&#34; aria-label=&#34;Permalink for this section&#34;&gt;&lt;/a&gt;&lt;/h3&gt;&lt;p&gt;&lt;strong&gt;Default:&lt;/strong&gt; &lt;code&gt;#000000&lt;/code&gt;&lt;/p&gt;
&lt;p&gt;Sidebar background color in hexadecimal RGB format to provide visual environment identification.
Examples: &lt;code&gt;#FF0000&lt;/code&gt; (red for production), &lt;code&gt;#FFAA00&lt;/code&gt; (orange for staging), &lt;code&gt;#00AA00&lt;/code&gt; (green for test/dev).&lt;/p&gt;
&lt;h3&gt;REVISION_DISPLAY&lt;span class=&#34;hx-absolute -hx-mt-20&#34; id=&#34;revision_display&#34;&gt;&lt;/span&gt;
    &lt;a href=&#34;#revision_display&#34; class=&#34;subheading-anchor&#34; aria-label=&#34;Permalink for this section&#34;&gt;&lt;/a&gt;&lt;/h3&gt;&lt;p&gt;&lt;strong&gt;Default:&lt;/strong&gt; &lt;code&gt;10&lt;/code&gt;&lt;/p&gt;
&lt;p&gt;Number of revision/audit events to display in the data change history UI for each data instance.
Shows recent changes in chronological order. Increase if you want to see more history on the detail page. Example: Set to &lt;code&gt;50&lt;/code&gt; to see 50 recent changes.&lt;/p&gt;
&lt;h3&gt;REVISION_KEEP_DAYS&lt;span class=&#34;hx-absolute -hx-mt-20&#34; id=&#34;revision_keep_days&#34;&gt;&lt;/span&gt;
    &lt;a href=&#34;#revision_keep_days&#34; class=&#34;subheading-anchor&#34; aria-label=&#34;Permalink for this section&#34;&gt;&lt;/a&gt;&lt;/h3&gt;&lt;p&gt;&lt;strong&gt;Default:&lt;/strong&gt; &lt;code&gt;999&lt;/code&gt;&lt;/p&gt;
&lt;p&gt;Number of days to retain revision/audit events in the database before automatic deletion.
A daily housekeeping task purges older revision records. Example: Set to &lt;code&gt;365&lt;/code&gt; to keep exactly one year of audit trail.&lt;/p&gt;
&lt;h3&gt;BETA_PREVIEW&lt;span class=&#34;hx-absolute -hx-mt-20&#34; id=&#34;beta_preview&#34;&gt;&lt;/span&gt;
    &lt;a href=&#34;#beta_preview&#34; class=&#34;subheading-anchor&#34; aria-label=&#34;Permalink for this section&#34;&gt;&lt;/a&gt;&lt;/h3&gt;&lt;p&gt;&lt;strong&gt;Default:&lt;/strong&gt; &lt;code&gt;no&lt;/code&gt;&lt;/p&gt;
&lt;p&gt;Enable or disable beta/preview features that may be unstable or incomplete.
When set to &lt;code&gt;yes&lt;/code&gt;, shows experimental features currently in development. Disabled by default for stability and reliability.&lt;/p&gt;
&lt;hr&gt;
&lt;h2&gt;USER - User Authentication and Session Settings&lt;span class=&#34;hx-absolute -hx-mt-20&#34; id=&#34;user---user-authentication-and-session-settings&#34;&gt;&lt;/span&gt;
    &lt;a href=&#34;#user---user-authentication-and-session-settings&#34; class=&#34;subheading-anchor&#34; aria-label=&#34;Permalink for this section&#34;&gt;&lt;/a&gt;&lt;/h2&gt;&lt;h3&gt;CACHE_SESSION&lt;span class=&#34;hx-absolute -hx-mt-20&#34; id=&#34;cache_session&#34;&gt;&lt;/span&gt;
    &lt;a href=&#34;#cache_session&#34; class=&#34;subheading-anchor&#34; aria-label=&#34;Permalink for this section&#34;&gt;&lt;/a&gt;&lt;/h3&gt;&lt;p&gt;&lt;strong&gt;Default:&lt;/strong&gt; &lt;code&gt;yes&lt;/code&gt;&lt;/p&gt;
&lt;p&gt;Use Redis cache for user session storage to improve performance and enable sessions across multiple instances.
When enabled, requires Redis connectivity. When disabled, sessions are stored in the database (slower but works standalone).&lt;/p&gt;
&lt;h3&gt;TRUSTED_ANONYMOUS_IPS&lt;span class=&#34;hx-absolute -hx-mt-20&#34; id=&#34;trusted_anonymous_ips&#34;&gt;&lt;/span&gt;
    &lt;a href=&#34;#trusted_anonymous_ips&#34; class=&#34;subheading-anchor&#34; aria-label=&#34;Permalink for this section&#34;&gt;&lt;/a&gt;&lt;/h3&gt;&lt;p&gt;&lt;strong&gt;Default:&lt;/strong&gt; `` (empty)&lt;/p&gt;
&lt;p&gt;Comma-separated list of IP addresses or CIDR blocks that are allowed anonymous access to public pages without authentication.
Example: &lt;code&gt;192.168.1.0/24 10.0.0.0/8&lt;/code&gt; allows these subnets anonymous access. CIDR notation is supported.&lt;/p&gt;
&lt;h3&gt;AUTH_LOGIN_REMOVE_DOMAIN&lt;span class=&#34;hx-absolute -hx-mt-20&#34; id=&#34;auth_login_remove_domain&#34;&gt;&lt;/span&gt;
    &lt;a href=&#34;#auth_login_remove_domain&#34; class=&#34;subheading-anchor&#34; aria-label=&#34;Permalink for this section&#34;&gt;&lt;/a&gt;&lt;/h3&gt;&lt;p&gt;&lt;strong&gt;Default:&lt;/strong&gt; &lt;code&gt;yes&lt;/code&gt;&lt;/p&gt;
&lt;p&gt;Automatically strip domain name from federated login usernames during authentication.
When enabled, &lt;code&gt;john.smith@company.com&lt;/code&gt; becomes &lt;code&gt;john.smith&lt;/code&gt;. Useful when domain is standardized across users.&lt;/p&gt;
&lt;h3&gt;AUTH_FEDERATED_LOGIN_FIELD&lt;span class=&#34;hx-absolute -hx-mt-20&#34; id=&#34;auth_federated_login_field&#34;&gt;&lt;/span&gt;
    &lt;a href=&#34;#auth_federated_login_field&#34; class=&#34;subheading-anchor&#34; aria-label=&#34;Permalink for this section&#34;&gt;&lt;/a&gt;&lt;/h3&gt;&lt;p&gt;&lt;strong&gt;Default:&lt;/strong&gt; &lt;code&gt;X-User&lt;/code&gt;&lt;/p&gt;
&lt;p&gt;HTTP header name that contains the authenticated username from the identity provider or reverse proxy.
The OAuth2 proxy or reverse proxy sets this header. Example: &lt;code&gt;Remote-User&lt;/code&gt; if using Apache auth module.&lt;/p&gt;
&lt;h3&gt;AUTH_FEDERATED_EMAIL_FIELD&lt;span class=&#34;hx-absolute -hx-mt-20&#34; id=&#34;auth_federated_email_field&#34;&gt;&lt;/span&gt;
    &lt;a href=&#34;#auth_federated_email_field&#34; class=&#34;subheading-anchor&#34; aria-label=&#34;Permalink for this section&#34;&gt;&lt;/a&gt;&lt;/h3&gt;&lt;p&gt;&lt;strong&gt;Default:&lt;/strong&gt; &lt;code&gt;X-Email&lt;/code&gt;&lt;/p&gt;
&lt;p&gt;HTTP header name that contains the email address from the identity provider or reverse proxy.
Used to populate user email during just-in-time provisioning. Example: &lt;code&gt;X-Remote-User-Email&lt;/code&gt; if using custom proxy.&lt;/p&gt;
&lt;h3&gt;AUTH_PROVISIONING&lt;span class=&#34;hx-absolute -hx-mt-20&#34; id=&#34;auth_provisioning&#34;&gt;&lt;/span&gt;
    &lt;a href=&#34;#auth_provisioning&#34; class=&#34;subheading-anchor&#34; aria-label=&#34;Permalink for this section&#34;&gt;&lt;/a&gt;&lt;/h3&gt;&lt;p&gt;&lt;strong&gt;Default:&lt;/strong&gt; &lt;code&gt;manual&lt;/code&gt;&lt;/p&gt;
&lt;p&gt;User account provisioning strategy for federated authentication. Options: &lt;code&gt;manual&lt;/code&gt;, &lt;code&gt;visitor&lt;/code&gt;, &lt;code&gt;create&lt;/code&gt;, &lt;code&gt;update&lt;/code&gt;, &lt;code&gt;sync&lt;/code&gt;.&lt;/p&gt;
&lt;ul&gt;
&lt;li&gt;&lt;code&gt;manual&lt;/code&gt;: No auto-provisioning, users must exist in Cavaliba&lt;/li&gt;
&lt;li&gt;&lt;code&gt;visitor&lt;/code&gt;: Temporary access without creating permanent account&lt;/li&gt;
&lt;li&gt;&lt;code&gt;create&lt;/code&gt;: Create new user account with basic role&lt;/li&gt;
&lt;li&gt;&lt;code&gt;update&lt;/code&gt;: Update existing user attributes from IdP&lt;/li&gt;
&lt;li&gt;&lt;code&gt;sync&lt;/code&gt;: Full sync of user attributes and groups&lt;/li&gt;
&lt;/ul&gt;
&lt;hr&gt;
&lt;h2&gt;DATA - Data Management and Pagination Settings&lt;span class=&#34;hx-absolute -hx-mt-20&#34; id=&#34;data---data-management-and-pagination-settings&#34;&gt;&lt;/span&gt;
    &lt;a href=&#34;#data---data-management-and-pagination-settings&#34; class=&#34;subheading-anchor&#34; aria-label=&#34;Permalink for this section&#34;&gt;&lt;/a&gt;&lt;/h2&gt;&lt;h3&gt;DATA_DEFAULT_SIZE&lt;span class=&#34;hx-absolute -hx-mt-20&#34; id=&#34;data_default_size&#34;&gt;&lt;/span&gt;
    &lt;a href=&#34;#data_default_size&#34; class=&#34;subheading-anchor&#34; aria-label=&#34;Permalink for this section&#34;&gt;&lt;/a&gt;&lt;/h3&gt;&lt;p&gt;&lt;strong&gt;Default:&lt;/strong&gt; &lt;code&gt;200&lt;/code&gt;&lt;/p&gt;
&lt;p&gt;Default number of data records displayed per page in data listings and search results.
Users can override this in the UI. Higher values mean less pagination but longer initial load. Example: Set to &lt;code&gt;100&lt;/code&gt; for slower connections.&lt;/p&gt;
&lt;h3&gt;DATA_MAX_SIZE&lt;span class=&#34;hx-absolute -hx-mt-20&#34; id=&#34;data_max_size&#34;&gt;&lt;/span&gt;
    &lt;a href=&#34;#data_max_size&#34; class=&#34;subheading-anchor&#34; aria-label=&#34;Permalink for this section&#34;&gt;&lt;/a&gt;&lt;/h3&gt;&lt;p&gt;&lt;strong&gt;Default:&lt;/strong&gt; &lt;code&gt;500&lt;/code&gt;&lt;/p&gt;
&lt;p&gt;Maximum number of records that can be requested per page in data listings to prevent performance issues.
Prevents users from requesting excessively large result sets. Set to &lt;code&gt;1000&lt;/code&gt; if you have powerful servers.&lt;/p&gt;
&lt;h3&gt;DATA_BIGSET_SIZE&lt;span class=&#34;hx-absolute -hx-mt-20&#34; id=&#34;data_bigset_size&#34;&gt;&lt;/span&gt;
    &lt;a href=&#34;#data_bigset_size&#34; class=&#34;subheading-anchor&#34; aria-label=&#34;Permalink for this section&#34;&gt;&lt;/a&gt;&lt;/h3&gt;&lt;p&gt;&lt;strong&gt;Default:&lt;/strong&gt; &lt;code&gt;500&lt;/code&gt;&lt;/p&gt;
&lt;p&gt;Threshold above which data listings switch to partial loading with AJAX pagination for performance.
When a dataset exceeds this size, only visible rows load initially. Set to &lt;code&gt;1000&lt;/code&gt; for better performance with very large datasets.&lt;/p&gt;
&lt;h3&gt;EXPORT_INTERACTIVE_MAX_SIZE&lt;span class=&#34;hx-absolute -hx-mt-20&#34; id=&#34;export_interactive_max_size&#34;&gt;&lt;/span&gt;
    &lt;a href=&#34;#export_interactive_max_size&#34; class=&#34;subheading-anchor&#34; aria-label=&#34;Permalink for this section&#34;&gt;&lt;/a&gt;&lt;/h3&gt;&lt;p&gt;&lt;strong&gt;Default:&lt;/strong&gt; &lt;code&gt;5000&lt;/code&gt;&lt;/p&gt;
&lt;p&gt;Maximum dataset size for interactive export via the web UI (CSV/Excel/JSON download).
Larger datasets cannot be exported interactively but can be exported via API or batch commands. Example: Set to &lt;code&gt;10000&lt;/code&gt; for more generous limits.&lt;/p&gt;
&lt;hr&gt;
&lt;h2&gt;SIRENE - Notification System Settings&lt;span class=&#34;hx-absolute -hx-mt-20&#34; id=&#34;sirene---notification-system-settings&#34;&gt;&lt;/span&gt;
    &lt;a href=&#34;#sirene---notification-system-settings&#34; class=&#34;subheading-anchor&#34; aria-label=&#34;Permalink for this section&#34;&gt;&lt;/a&gt;&lt;/h2&gt;&lt;h3&gt;SIRENE_APPNAME&lt;span class=&#34;hx-absolute -hx-mt-20&#34; id=&#34;sirene_appname&#34;&gt;&lt;/span&gt;
    &lt;a href=&#34;#sirene_appname&#34; class=&#34;subheading-anchor&#34; aria-label=&#34;Permalink for this section&#34;&gt;&lt;/a&gt;&lt;/h3&gt;&lt;p&gt;&lt;strong&gt;Default:&lt;/strong&gt; &lt;code&gt;Sirene&lt;/code&gt;&lt;/p&gt;
&lt;p&gt;Display name for the Sirene notification/alerting system shown on public status pages and in the UI.
Customize to match your organization branding. Example: &lt;code&gt;MyCompany Alerts&lt;/code&gt; or &lt;code&gt;Infrastructure Notifications&lt;/code&gt;.&lt;/p&gt;
&lt;h3&gt;PUBLIC_MAX_ITEMS&lt;span class=&#34;hx-absolute -hx-mt-20&#34; id=&#34;public_max_items&#34;&gt;&lt;/span&gt;
    &lt;a href=&#34;#public_max_items&#34; class=&#34;subheading-anchor&#34; aria-label=&#34;Permalink for this section&#34;&gt;&lt;/a&gt;&lt;/h3&gt;&lt;p&gt;&lt;strong&gt;Default:&lt;/strong&gt; &lt;code&gt;6&lt;/code&gt;&lt;/p&gt;
&lt;p&gt;Maximum number of public incident messages displayed on the public status page.
Shows most recent/active incidents first. Limiting this improves page load time. Example: Set to &lt;code&gt;10&lt;/code&gt; to show more incidents.&lt;/p&gt;
&lt;h3&gt;DEFAULT_DURATION_MINUTE&lt;span class=&#34;hx-absolute -hx-mt-20&#34; id=&#34;default_duration_minute&#34;&gt;&lt;/span&gt;
    &lt;a href=&#34;#default_duration_minute&#34; class=&#34;subheading-anchor&#34; aria-label=&#34;Permalink for this section&#34;&gt;&lt;/a&gt;&lt;/h3&gt;&lt;p&gt;&lt;strong&gt;Default:&lt;/strong&gt; &lt;code&gt;1440&lt;/code&gt;&lt;/p&gt;
&lt;p&gt;Default duration in minutes before notifications auto-archive if not manually updated (1440 = 24 hours).
After this period, active incidents are automatically moved to archived status. Example: Set to &lt;code&gt;60&lt;/code&gt; for 1-hour auto-archive.&lt;/p&gt;
&lt;h3&gt;PUBLIC_SORT_ORDER&lt;span class=&#34;hx-absolute -hx-mt-20&#34; id=&#34;public_sort_order&#34;&gt;&lt;/span&gt;
    &lt;a href=&#34;#public_sort_order&#34; class=&#34;subheading-anchor&#34; aria-label=&#34;Permalink for this section&#34;&gt;&lt;/a&gt;&lt;/h3&gt;&lt;p&gt;&lt;strong&gt;Default:&lt;/strong&gt; &lt;code&gt;creation&lt;/code&gt;&lt;/p&gt;
&lt;p&gt;Sort order for public messages: &lt;code&gt;creation&lt;/code&gt; (newest first) or &lt;code&gt;severity&lt;/code&gt; (most critical first).
Determines what users see first on the public status page. Example: Use &lt;code&gt;severity&lt;/code&gt; to highlight critical issues.&lt;/p&gt;
&lt;h3&gt;PUBLIC_SKIP_TO_TRUSTED&lt;span class=&#34;hx-absolute -hx-mt-20&#34; id=&#34;public_skip_to_trusted&#34;&gt;&lt;/span&gt;
    &lt;a href=&#34;#public_skip_to_trusted&#34; class=&#34;subheading-anchor&#34; aria-label=&#34;Permalink for this section&#34;&gt;&lt;/a&gt;&lt;/h3&gt;&lt;p&gt;&lt;strong&gt;Default:&lt;/strong&gt; &lt;code&gt;no&lt;/code&gt;&lt;/p&gt;
&lt;p&gt;Skip the public status page for users from trusted IP addresses, redirect directly to authenticated status view.
When enabled, trusted users bypass the public page. Useful when public page is less detailed than authenticated view.&lt;/p&gt;
&lt;h3&gt;USER_MAX_NOTIFICATION&lt;span class=&#34;hx-absolute -hx-mt-20&#34; id=&#34;user_max_notification&#34;&gt;&lt;/span&gt;
    &lt;a href=&#34;#user_max_notification&#34; class=&#34;subheading-anchor&#34; aria-label=&#34;Permalink for this section&#34;&gt;&lt;/a&gt;&lt;/h3&gt;&lt;p&gt;&lt;strong&gt;Default:&lt;/strong&gt; &lt;code&gt;100&lt;/code&gt;&lt;/p&gt;
&lt;p&gt;Maximum number of users per notification distribution in a single batch to prevent queue overload.
Notifications with more recipients are split into multiple batches. Example: Set to &lt;code&gt;50&lt;/code&gt; for smaller batches on slower systems.&lt;/p&gt;
&lt;h3&gt;EMAIL_MAX_NOTIFICATION&lt;span class=&#34;hx-absolute -hx-mt-20&#34; id=&#34;email_max_notification&#34;&gt;&lt;/span&gt;
    &lt;a href=&#34;#email_max_notification&#34; class=&#34;subheading-anchor&#34; aria-label=&#34;Permalink for this section&#34;&gt;&lt;/a&gt;&lt;/h3&gt;&lt;p&gt;&lt;strong&gt;Default:&lt;/strong&gt; &lt;code&gt;100&lt;/code&gt;&lt;/p&gt;
&lt;p&gt;Maximum number of email addresses per notification send operation to manage SMTP server load.
Large email distributions are split into multiple batches. Example: Set to &lt;code&gt;25&lt;/code&gt; if your SMTP server has strict limits.&lt;/p&gt;
&lt;h3&gt;EMAIL_MODE&lt;span class=&#34;hx-absolute -hx-mt-20&#34; id=&#34;email_mode&#34;&gt;&lt;/span&gt;
    &lt;a href=&#34;#email_mode&#34; class=&#34;subheading-anchor&#34; aria-label=&#34;Permalink for this section&#34;&gt;&lt;/a&gt;&lt;/h3&gt;&lt;p&gt;&lt;strong&gt;Default:&lt;/strong&gt; &lt;code&gt;stdout&lt;/code&gt;&lt;/p&gt;
&lt;p&gt;Email delivery method: &lt;code&gt;stdout&lt;/code&gt; (logs to console), &lt;code&gt;folder&lt;/code&gt; (writes to files), or &lt;code&gt;smtp&lt;/code&gt; (sends via mail server).
Use &lt;code&gt;stdout&lt;/code&gt;/&lt;code&gt;folder&lt;/code&gt; for testing. Switch to &lt;code&gt;smtp&lt;/code&gt; in production with proper &lt;code&gt;CAVALIBA_EMAIL_HOST&lt;/code&gt; configuration.&lt;/p&gt;
&lt;h3&gt;EMAIL_FOLDER&lt;span class=&#34;hx-absolute -hx-mt-20&#34; id=&#34;email_folder&#34;&gt;&lt;/span&gt;
    &lt;a href=&#34;#email_folder&#34; class=&#34;subheading-anchor&#34; aria-label=&#34;Permalink for this section&#34;&gt;&lt;/a&gt;&lt;/h3&gt;&lt;p&gt;&lt;strong&gt;Default:&lt;/strong&gt; &lt;code&gt;/app/files/mail/&lt;/code&gt;&lt;/p&gt;
&lt;p&gt;File system path where email files are written in &lt;code&gt;folder&lt;/code&gt; mode for testing or external mail system integration.
Directory must be writable by the application. Example: &lt;code&gt;/var/log/cavaliba_mail/&lt;/code&gt; for centralized email log location.&lt;/p&gt;
&lt;h3&gt;EMAIL_FROM&lt;span class=&#34;hx-absolute -hx-mt-20&#34; id=&#34;email_from&#34;&gt;&lt;/span&gt;
    &lt;a href=&#34;#email_from&#34; class=&#34;subheading-anchor&#34; aria-label=&#34;Permalink for this section&#34;&gt;&lt;/a&gt;&lt;/h3&gt;&lt;p&gt;&lt;strong&gt;Default:&lt;/strong&gt; &lt;code&gt;noreply@findadomain.com&lt;/code&gt;&lt;/p&gt;
&lt;p&gt;Source email address displayed to recipients as the sender of notification emails.
Must be a valid email format. Example: &lt;code&gt;alerts@company.com&lt;/code&gt; or &lt;code&gt;notifications@mydomain.org&lt;/code&gt;.&lt;/p&gt;
&lt;h3&gt;EMAIL_SMTP_BATCH&lt;span class=&#34;hx-absolute -hx-mt-20&#34; id=&#34;email_smtp_batch&#34;&gt;&lt;/span&gt;
    &lt;a href=&#34;#email_smtp_batch&#34; class=&#34;subheading-anchor&#34; aria-label=&#34;Permalink for this section&#34;&gt;&lt;/a&gt;&lt;/h3&gt;&lt;p&gt;&lt;strong&gt;Default:&lt;/strong&gt; &lt;code&gt;100&lt;/code&gt;&lt;/p&gt;
&lt;p&gt;Maximum email recipients per SMTP connection to manage resource usage and prevent connection timeouts.
Improves efficiency by grouping recipients. Example: Set to &lt;code&gt;50&lt;/code&gt; if SMTP server disconnects with larger batches.&lt;/p&gt;
&lt;h3&gt;EMAIL_PREFIX&lt;span class=&#34;hx-absolute -hx-mt-20&#34; id=&#34;email_prefix&#34;&gt;&lt;/span&gt;
    &lt;a href=&#34;#email_prefix&#34; class=&#34;subheading-anchor&#34; aria-label=&#34;Permalink for this section&#34;&gt;&lt;/a&gt;&lt;/h3&gt;&lt;p&gt;&lt;strong&gt;Default:&lt;/strong&gt; &lt;code&gt;[Cavaliba] &lt;/code&gt;&lt;/p&gt;
&lt;p&gt;Prefix automatically added to the subject line of new incident notification emails.
Helps users filter and identify incident emails in their inbox. Example: &lt;code&gt;[MyCompany Alert] &lt;/code&gt; or &lt;code&gt;[ALERT] &lt;/code&gt;.&lt;/p&gt;
&lt;h3&gt;EMAIL_UPDATE_PREFIX&lt;span class=&#34;hx-absolute -hx-mt-20&#34; id=&#34;email_update_prefix&#34;&gt;&lt;/span&gt;
    &lt;a href=&#34;#email_update_prefix&#34; class=&#34;subheading-anchor&#34; aria-label=&#34;Permalink for this section&#34;&gt;&lt;/a&gt;&lt;/h3&gt;&lt;p&gt;&lt;strong&gt;Default:&lt;/strong&gt; &lt;code&gt;[Cavaliba Update] &lt;/code&gt;&lt;/p&gt;
&lt;p&gt;Prefix added to the subject line of incident update notification emails to distinguish from initial notifications.
Helps users track which emails are updates vs. new incidents. Example: &lt;code&gt;[MyCompany Update] &lt;/code&gt; or &lt;code&gt;[UPDATE] &lt;/code&gt;.&lt;/p&gt;
&lt;h3&gt;EMAIL_TEST_SUBJECT&lt;span class=&#34;hx-absolute -hx-mt-20&#34; id=&#34;email_test_subject&#34;&gt;&lt;/span&gt;
    &lt;a href=&#34;#email_test_subject&#34; class=&#34;subheading-anchor&#34; aria-label=&#34;Permalink for this section&#34;&gt;&lt;/a&gt;&lt;/h3&gt;&lt;p&gt;&lt;strong&gt;Default:&lt;/strong&gt; &lt;code&gt;Cavaliba - TEST TEST TEST - Please ignore.&lt;/code&gt;&lt;/p&gt;
&lt;p&gt;Subject line used when sending test email messages to verify email configuration is working.
Should clearly indicate it&amp;rsquo;s a test to avoid confusion. Example: &lt;code&gt;TEST Email Configuration - Ignore&lt;/code&gt;.&lt;/p&gt;
&lt;h3&gt;EMAIL_TEST_CONTENT&lt;span class=&#34;hx-absolute -hx-mt-20&#34; id=&#34;email_test_content&#34;&gt;&lt;/span&gt;
    &lt;a href=&#34;#email_test_content&#34; class=&#34;subheading-anchor&#34; aria-label=&#34;Permalink for this section&#34;&gt;&lt;/a&gt;&lt;/h3&gt;&lt;p&gt;&lt;strong&gt;Default:&lt;/strong&gt; &lt;code&gt;Test.Ignore.&lt;/code&gt;&lt;/p&gt;
&lt;p&gt;Email body content for test messages when verifying email system configuration.
Keep it brief and clear that it&amp;rsquo;s a test. Example: &lt;code&gt;This is a test email from Cavaliba. Please ignore.&lt;/code&gt;&lt;/p&gt;
&lt;h3&gt;SMS_MAX_NOTIFICATION&lt;span class=&#34;hx-absolute -hx-mt-20&#34; id=&#34;sms_max_notification&#34;&gt;&lt;/span&gt;
    &lt;a href=&#34;#sms_max_notification&#34; class=&#34;subheading-anchor&#34; aria-label=&#34;Permalink for this section&#34;&gt;&lt;/a&gt;&lt;/h3&gt;&lt;p&gt;&lt;strong&gt;Default:&lt;/strong&gt; &lt;code&gt;30&lt;/code&gt;&lt;/p&gt;
&lt;p&gt;Maximum number of SMS recipients per notification batch to manage SMS provider rate limits.
SMS providers typically have strict rate limits. Example: Set to &lt;code&gt;10&lt;/code&gt; for conservative rate limiting.&lt;/p&gt;
&lt;h3&gt;SMS_QUOTA_PER_DAY&lt;span class=&#34;hx-absolute -hx-mt-20&#34; id=&#34;sms_quota_per_day&#34;&gt;&lt;/span&gt;
    &lt;a href=&#34;#sms_quota_per_day&#34; class=&#34;subheading-anchor&#34; aria-label=&#34;Permalink for this section&#34;&gt;&lt;/a&gt;&lt;/h3&gt;&lt;p&gt;&lt;strong&gt;Default:&lt;/strong&gt; &lt;code&gt;100&lt;/code&gt;&lt;/p&gt;
&lt;p&gt;Maximum number of SMS messages per user per 24-hour period to prevent user overload.
Applied per recipient, not globally. Helps prevent notification fatigue. Example: Set to &lt;code&gt;50&lt;/code&gt; for stricter limits.&lt;/p&gt;
&lt;h3&gt;SMS_MODE&lt;span class=&#34;hx-absolute -hx-mt-20&#34; id=&#34;sms_mode&#34;&gt;&lt;/span&gt;
    &lt;a href=&#34;#sms_mode&#34; class=&#34;subheading-anchor&#34; aria-label=&#34;Permalink for this section&#34;&gt;&lt;/a&gt;&lt;/h3&gt;&lt;p&gt;&lt;strong&gt;Default:&lt;/strong&gt; &lt;code&gt;stdout&lt;/code&gt;&lt;/p&gt;
&lt;p&gt;SMS delivery method: &lt;code&gt;stdout&lt;/code&gt; (logs to console), &lt;code&gt;folder&lt;/code&gt; (writes to files), or &lt;code&gt;clicsecure&lt;/code&gt; (SMS provider API).
Use &lt;code&gt;stdout&lt;/code&gt;/&lt;code&gt;folder&lt;/code&gt; for testing. Switch to &lt;code&gt;clicsecure&lt;/code&gt; in production with proper SMS provider credentials.&lt;/p&gt;
&lt;h3&gt;SMS_FOLDER&lt;span class=&#34;hx-absolute -hx-mt-20&#34; id=&#34;sms_folder&#34;&gt;&lt;/span&gt;
    &lt;a href=&#34;#sms_folder&#34; class=&#34;subheading-anchor&#34; aria-label=&#34;Permalink for this section&#34;&gt;&lt;/a&gt;&lt;/h3&gt;&lt;p&gt;&lt;strong&gt;Default:&lt;/strong&gt; &lt;code&gt;/app/files/sms/&lt;/code&gt;&lt;/p&gt;
&lt;p&gt;File system path where SMS files are written in &lt;code&gt;folder&lt;/code&gt; mode for testing or external SMS system integration.
Directory must be writable by the application. Example: &lt;code&gt;/var/log/cavaliba_sms/&lt;/code&gt; for centralized SMS log location.&lt;/p&gt;
&lt;h3&gt;SMS_PREFIX&lt;span class=&#34;hx-absolute -hx-mt-20&#34; id=&#34;sms_prefix&#34;&gt;&lt;/span&gt;
    &lt;a href=&#34;#sms_prefix&#34; class=&#34;subheading-anchor&#34; aria-label=&#34;Permalink for this section&#34;&gt;&lt;/a&gt;&lt;/h3&gt;&lt;p&gt;&lt;strong&gt;Default:&lt;/strong&gt; &lt;code&gt;[Cavaliba] &lt;/code&gt;&lt;/p&gt;
&lt;p&gt;Prefix added to SMS text messages for new incidents to identify the source system.
Keep short since SMS has character limits. Example: &lt;code&gt;[ALERT] &lt;/code&gt; for brevity.&lt;/p&gt;
&lt;h3&gt;SMS_UPDATE_PREFIX&lt;span class=&#34;hx-absolute -hx-mt-20&#34; id=&#34;sms_update_prefix&#34;&gt;&lt;/span&gt;
    &lt;a href=&#34;#sms_update_prefix&#34; class=&#34;subheading-anchor&#34; aria-label=&#34;Permalink for this section&#34;&gt;&lt;/a&gt;&lt;/h3&gt;&lt;p&gt;&lt;strong&gt;Default:&lt;/strong&gt; &lt;code&gt;[Cavaliba Update] &lt;/code&gt;&lt;/p&gt;
&lt;p&gt;Prefix added to SMS text messages for incident updates to distinguish from initial alerts.
Keep concise due to SMS character limits. Example: &lt;code&gt;[UPDATE] &lt;/code&gt; for a shorter prefix.&lt;/p&gt;
&lt;h3&gt;SMS_TEST&lt;span class=&#34;hx-absolute -hx-mt-20&#34; id=&#34;sms_test&#34;&gt;&lt;/span&gt;
    &lt;a href=&#34;#sms_test&#34; class=&#34;subheading-anchor&#34; aria-label=&#34;Permalink for this section&#34;&gt;&lt;/a&gt;&lt;/h3&gt;&lt;p&gt;&lt;strong&gt;Default:&lt;/strong&gt; &lt;code&gt;Cavaliba - TEST TEST TEST - Please ignore.&lt;/code&gt;&lt;/p&gt;
&lt;p&gt;Test message content sent when verifying SMS configuration is working.
Should be brief and clearly marked as a test. Example: &lt;code&gt;TEST SMS from Cavaliba - Ignore&lt;/code&gt;&lt;/p&gt;
&lt;h3&gt;SMS_WARNING&lt;span class=&#34;hx-absolute -hx-mt-20&#34; id=&#34;sms_warning&#34;&gt;&lt;/span&gt;
    &lt;a href=&#34;#sms_warning&#34; class=&#34;subheading-anchor&#34; aria-label=&#34;Permalink for this section&#34;&gt;&lt;/a&gt;&lt;/h3&gt;&lt;p&gt;&lt;strong&gt;Default:&lt;/strong&gt; &lt;code&gt;IMPORTANT: All SMS activity is recorded for security purposes.&lt;/code&gt;&lt;/p&gt;
&lt;p&gt;Warning message included in SMS notifications to inform recipients of logging/recording.
Legal/compliance requirement in some jurisdictions. Example: &lt;code&gt;Note: This message is logged for compliance.&lt;/code&gt;&lt;/p&gt;
&lt;h3&gt;NOTIFY_FIELDS&lt;span class=&#34;hx-absolute -hx-mt-20&#34; id=&#34;notify_fields&#34;&gt;&lt;/span&gt;
    &lt;a href=&#34;#notify_fields&#34; class=&#34;subheading-anchor&#34; aria-label=&#34;Permalink for this section&#34;&gt;&lt;/a&gt;&lt;/h3&gt;&lt;p&gt;&lt;strong&gt;Default:&lt;/strong&gt; &lt;code&gt;user group app site&lt;/code&gt;&lt;/p&gt;
&lt;p&gt;Schema field names that define notification targets in the data schema for triggering notifications.
These fields must exist in your schemas. Example: &lt;code&gt;notify_user notify_admin notify_site&lt;/code&gt; if using custom names.&lt;/p&gt;
&lt;h3&gt;NOTIFY_SUBSCRIPTIONS&lt;span class=&#34;hx-absolute -hx-mt-20&#34; id=&#34;notify_subscriptions&#34;&gt;&lt;/span&gt;
    &lt;a href=&#34;#notify_subscriptions&#34; class=&#34;subheading-anchor&#34; aria-label=&#34;Permalink for this section&#34;&gt;&lt;/a&gt;&lt;/h3&gt;&lt;p&gt;&lt;strong&gt;Default:&lt;/strong&gt; &lt;code&gt;site:app&lt;/code&gt;&lt;/p&gt;
&lt;p&gt;Schema relationships for automatic notification propagation using parent:child notation.
Notifications propagate from child to parent following these relationships. Example: &lt;code&gt;app:service site:app customer:site&lt;/code&gt; for multi-level propagation.&lt;/p&gt;
&lt;hr&gt;
&lt;h2&gt;STATUS - Status Monitoring Settings&lt;span class=&#34;hx-absolute -hx-mt-20&#34; id=&#34;status---status-monitoring-settings&#34;&gt;&lt;/span&gt;
    &lt;a href=&#34;#status---status-monitoring-settings&#34; class=&#34;subheading-anchor&#34; aria-label=&#34;Permalink for this section&#34;&gt;&lt;/a&gt;&lt;/h2&gt;&lt;h3&gt;STATUS_APPNAME&lt;span class=&#34;hx-absolute -hx-mt-20&#34; id=&#34;status_appname&#34;&gt;&lt;/span&gt;
    &lt;a href=&#34;#status_appname&#34; class=&#34;subheading-anchor&#34; aria-label=&#34;Permalink for this section&#34;&gt;&lt;/a&gt;&lt;/h3&gt;&lt;p&gt;&lt;strong&gt;Default:&lt;/strong&gt; &lt;code&gt;StatusPage&lt;/code&gt;&lt;/p&gt;
&lt;p&gt;Display name for the Status Monitoring application shown on public pages and UI navigation.
Customize to match your organization branding. Example: &lt;code&gt;Infrastructure Status&lt;/code&gt; or &lt;code&gt;System Health Monitor&lt;/code&gt;.&lt;/p&gt;
&lt;h3&gt;STATUS_RAW_KEEP_DAYS&lt;span class=&#34;hx-absolute -hx-mt-20&#34; id=&#34;status_raw_keep_days&#34;&gt;&lt;/span&gt;
    &lt;a href=&#34;#status_raw_keep_days&#34; class=&#34;subheading-anchor&#34; aria-label=&#34;Permalink for this section&#34;&gt;&lt;/a&gt;&lt;/h3&gt;&lt;p&gt;&lt;strong&gt;Default:&lt;/strong&gt; &lt;code&gt;7&lt;/code&gt;&lt;/p&gt;
&lt;p&gt;Number of days to retain raw detailed status check results in the database.
Raw data provides minute-by-minute history. Daily housekeeping purges older data. Example: Set to &lt;code&gt;14&lt;/code&gt; for 2 weeks of detailed data.&lt;/p&gt;
&lt;h3&gt;STATUS_SAMPLE_HOUR_KEEP_DAYS&lt;span class=&#34;hx-absolute -hx-mt-20&#34; id=&#34;status_sample_hour_keep_days&#34;&gt;&lt;/span&gt;
    &lt;a href=&#34;#status_sample_hour_keep_days&#34; class=&#34;subheading-anchor&#34; aria-label=&#34;Permalink for this section&#34;&gt;&lt;/a&gt;&lt;/h3&gt;&lt;p&gt;&lt;strong&gt;Default:&lt;/strong&gt; &lt;code&gt;31&lt;/code&gt;&lt;/p&gt;
&lt;p&gt;Number of days to retain hourly aggregated status sample data in the database for trend analysis.
Hourly samples provide summarized trends with lower storage impact. Retained longer than raw data for long-term analysis.&lt;/p&gt;
&lt;hr&gt;
&lt;h2&gt;IPAM - IP Address Management Settings&lt;span class=&#34;hx-absolute -hx-mt-20&#34; id=&#34;ipam---ip-address-management-settings&#34;&gt;&lt;/span&gt;
    &lt;a href=&#34;#ipam---ip-address-management-settings&#34; class=&#34;subheading-anchor&#34; aria-label=&#34;Permalink for this section&#34;&gt;&lt;/a&gt;&lt;/h2&gt;&lt;h3&gt;IPAM_APPNAME&lt;span class=&#34;hx-absolute -hx-mt-20&#34; id=&#34;ipam_appname&#34;&gt;&lt;/span&gt;
    &lt;a href=&#34;#ipam_appname&#34; class=&#34;subheading-anchor&#34; aria-label=&#34;Permalink for this section&#34;&gt;&lt;/a&gt;&lt;/h3&gt;&lt;p&gt;&lt;strong&gt;Default:&lt;/strong&gt; &lt;code&gt;IPAM - IP Management&lt;/code&gt;&lt;/p&gt;
&lt;p&gt;Display name for the IPAM (IP Address Management) application shown in navigation and public-facing interfaces.
Customize to match your organization naming conventions. Example: &lt;code&gt;IP Address Management&lt;/code&gt; or &lt;code&gt;Network Planning&lt;/code&gt;.&lt;/p&gt;

      </description>
    </item>
    
    <item>
      <title>Authentication Methods</title>
      <link>http://localhost:1313/docs/70configuration/authentication/</link>
      <pubDate>Mon, 01 Jan 0001 00:00:00 +0000</pubDate>
      
      <guid>http://localhost:1313/docs/70configuration/authentication/</guid>
      <description>
        
        
        &lt;p&gt;Cavaliba supports multiple authentication methods to accommodate different deployment scenarios, from small single-user environments to large enterprise deployments with federated identity management.&lt;/p&gt;
&lt;p&gt;This page covers all available authentication modes and their configuration. Choose the method that best suits your security requirements and organizational structure.&lt;/p&gt;
&lt;hr&gt;
&lt;h2&gt;Overview and Selection Guide&lt;span class=&#34;hx-absolute -hx-mt-20&#34; id=&#34;overview-and-selection-guide&#34;&gt;&lt;/span&gt;
    &lt;a href=&#34;#overview-and-selection-guide&#34; class=&#34;subheading-anchor&#34; aria-label=&#34;Permalink for this section&#34;&gt;&lt;/a&gt;&lt;/h2&gt;&lt;table&gt;
  &lt;thead&gt;
      &lt;tr&gt;
          &lt;th style=&#34;text-align: left&#34;&gt;Method&lt;/th&gt;
          &lt;th style=&#34;text-align: left&#34;&gt;Suitable For&lt;/th&gt;
          &lt;th style=&#34;text-align: left&#34;&gt;External Auth&lt;/th&gt;
          &lt;th style=&#34;text-align: left&#34;&gt;Features&lt;/th&gt;
          &lt;th style=&#34;text-align: left&#34;&gt;Complexity&lt;/th&gt;
      &lt;/tr&gt;
  &lt;/thead&gt;
  &lt;tbody&gt;
      &lt;tr&gt;
          &lt;td style=&#34;text-align: left&#34;&gt;&lt;strong&gt;Local&lt;/strong&gt;&lt;/td&gt;
          &lt;td style=&#34;text-align: left&#34;&gt;Small deployments, testing&lt;/td&gt;
          &lt;td style=&#34;text-align: left&#34;&gt;No&lt;/td&gt;
          &lt;td style=&#34;text-align: left&#34;&gt;Manual user management, simple passwords&lt;/td&gt;
          &lt;td style=&#34;text-align: left&#34;&gt;Low&lt;/td&gt;
      &lt;/tr&gt;
      &lt;tr&gt;
          &lt;td style=&#34;text-align: left&#34;&gt;&lt;strong&gt;Basic&lt;/strong&gt;&lt;/td&gt;
          &lt;td style=&#34;text-align: left&#34;&gt;Small teams, legacy systems&lt;/td&gt;
          &lt;td style=&#34;text-align: left&#34;&gt;Yes (external)&lt;/td&gt;
          &lt;td style=&#34;text-align: left&#34;&gt;HTTP Basic Auth, file-based users&lt;/td&gt;
          &lt;td style=&#34;text-align: left&#34;&gt;Low&lt;/td&gt;
      &lt;/tr&gt;
      &lt;tr&gt;
          &lt;td style=&#34;text-align: left&#34;&gt;&lt;strong&gt;Forced&lt;/strong&gt;&lt;/td&gt;
          &lt;td style=&#34;text-align: left&#34;&gt;Development, isolated testing&lt;/td&gt;
          &lt;td style=&#34;text-align: left&#34;&gt;No&lt;/td&gt;
          &lt;td style=&#34;text-align: left&#34;&gt;Single auto-login user&lt;/td&gt;
          &lt;td style=&#34;text-align: left&#34;&gt;Very Low&lt;/td&gt;
      &lt;/tr&gt;
      &lt;tr&gt;
          &lt;td style=&#34;text-align: left&#34;&gt;&lt;strong&gt;LDAP&lt;/strong&gt;&lt;/td&gt;
          &lt;td style=&#34;text-align: left&#34;&gt;Enterprise directories&lt;/td&gt;
          &lt;td style=&#34;text-align: left&#34;&gt;Via Keycloak&lt;/td&gt;
          &lt;td style=&#34;text-align: left&#34;&gt;Central directory auth&lt;/td&gt;
          &lt;td style=&#34;text-align: left&#34;&gt;Medium&lt;/td&gt;
      &lt;/tr&gt;
      &lt;tr&gt;
          &lt;td style=&#34;text-align: left&#34;&gt;&lt;strong&gt;OIDC/SAML&lt;/strong&gt;&lt;/td&gt;
          &lt;td style=&#34;text-align: left&#34;&gt;Modern enterprise&lt;/td&gt;
          &lt;td style=&#34;text-align: left&#34;&gt;Yes (OAuth2 Proxy)&lt;/td&gt;
          &lt;td style=&#34;text-align: left&#34;&gt;MFA, federated identity, self-service&lt;/td&gt;
          &lt;td style=&#34;text-align: left&#34;&gt;High&lt;/td&gt;
      &lt;/tr&gt;
  &lt;/tbody&gt;
&lt;/table&gt;
&lt;hr&gt;
&lt;h2&gt;Local Authentication&lt;span class=&#34;hx-absolute -hx-mt-20&#34; id=&#34;local-authentication&#34;&gt;&lt;/span&gt;
    &lt;a href=&#34;#local-authentication&#34; class=&#34;subheading-anchor&#34; aria-label=&#34;Permalink for this section&#34;&gt;&lt;/a&gt;&lt;/h2&gt;&lt;h3&gt;Overview&lt;span class=&#34;hx-absolute -hx-mt-20&#34; id=&#34;overview&#34;&gt;&lt;/span&gt;
    &lt;a href=&#34;#overview&#34; class=&#34;subheading-anchor&#34; aria-label=&#34;Permalink for this section&#34;&gt;&lt;/a&gt;&lt;/h3&gt;&lt;p&gt;Local Authentication is the &lt;strong&gt;default mode&lt;/strong&gt; after a fresh Cavaliba installation. User accounts (login/password) are managed directly inside Cavaliba by an administrator. Sign-in/Sign-out web forms are provided by the application.&lt;/p&gt;
&lt;p&gt;&lt;strong&gt;Best for:&lt;/strong&gt; Small deployments with limited users and no need for advanced features like MFA or self-service password management.&lt;/p&gt;
&lt;h3&gt;Configuration&lt;span class=&#34;hx-absolute -hx-mt-20&#34; id=&#34;configuration&#34;&gt;&lt;/span&gt;
    &lt;a href=&#34;#configuration&#34; class=&#34;subheading-anchor&#34; aria-label=&#34;Permalink for this section&#34;&gt;&lt;/a&gt;&lt;/h3&gt;&lt;h4&gt;Step 1: Update Environment File&lt;span class=&#34;hx-absolute -hx-mt-20&#34; id=&#34;step-1-update-environment-file&#34;&gt;&lt;/span&gt;
    &lt;a href=&#34;#step-1-update-environment-file&#34; class=&#34;subheading-anchor&#34; aria-label=&#34;Permalink for this section&#34;&gt;&lt;/a&gt;&lt;/h4&gt;&lt;p&gt;In your &lt;code&gt;.env&lt;/code&gt; file, set:&lt;/p&gt;
&lt;div class=&#34;hextra-code-block hx-relative hx-mt-6 first:hx-mt-0 hx-group/code&#34;&gt;

&lt;div&gt;&lt;pre&gt;&lt;code&gt;CAVALIBA_AUTH_MODE=local&lt;/code&gt;&lt;/pre&gt;&lt;/div&gt;&lt;div class=&#34;hextra-code-copy-btn-container hx-opacity-0 hx-transition group-hover/code:hx-opacity-100 hx-flex hx-gap-1 hx-absolute hx-m-[11px] hx-right-0 hx-top-0&#34;&gt;
  &lt;button
    class=&#34;hextra-code-copy-btn hx-group/copybtn hx-transition-all active:hx-opacity-50 hx-bg-primary-700/5 hx-border hx-border-black/5 hx-text-gray-600 hover:hx-text-gray-900 hx-rounded-md hx-p-1.5 dark:hx-bg-primary-300/10 dark:hx-border-white/10 dark:hx-text-gray-400 dark:hover:hx-text-gray-50&#34;
    title=&#34;Copy code&#34;
  &gt;
    &lt;div class=&#34;copy-icon group-[.copied]/copybtn:hx-hidden hx-pointer-events-none hx-h-4 hx-w-4&#34;&gt;&lt;/div&gt;
    &lt;div class=&#34;success-icon hx-hidden group-[.copied]/copybtn:hx-block hx-pointer-events-none hx-h-4 hx-w-4&#34;&gt;&lt;/div&gt;
  &lt;/button&gt;
&lt;/div&gt;
&lt;/div&gt;
&lt;h4&gt;Step 2: Configure Docker&lt;span class=&#34;hx-absolute -hx-mt-20&#34; id=&#34;step-2-configure-docker&#34;&gt;&lt;/span&gt;
    &lt;a href=&#34;#step-2-configure-docker&#34; class=&#34;subheading-anchor&#34; aria-label=&#34;Permalink for this section&#34;&gt;&lt;/a&gt;&lt;/h4&gt;&lt;ul&gt;
&lt;li&gt;Ensure OAUTH2 configuration blocks are commented out in &lt;code&gt;nginx.conf&lt;/code&gt;&lt;/li&gt;
&lt;li&gt;Ensure oauth2_proxy container bloc is commented out in &lt;code&gt;docker-compose.yml&lt;/code&gt;&lt;/li&gt;
&lt;li&gt;Ensure basic authentication blocks are commented out in &lt;code&gt;nginx.conf&lt;/code&gt;&lt;/li&gt;
&lt;/ul&gt;
&lt;h4&gt;Step 3: Restart Containers&lt;span class=&#34;hx-absolute -hx-mt-20&#34; id=&#34;step-3-restart-containers&#34;&gt;&lt;/span&gt;
    &lt;a href=&#34;#step-3-restart-containers&#34; class=&#34;subheading-anchor&#34; aria-label=&#34;Permalink for this section&#34;&gt;&lt;/a&gt;&lt;/h4&gt;&lt;div class=&#34;hextra-code-block hx-relative hx-mt-6 first:hx-mt-0 hx-group/code&#34;&gt;

&lt;div&gt;&lt;div class=&#34;highlight&#34;&gt;&lt;pre tabindex=&#34;0&#34; class=&#34;chroma&#34;&gt;&lt;code class=&#34;language-bash&#34; data-lang=&#34;bash&#34;&gt;&lt;span class=&#34;line&#34;&gt;&lt;span class=&#34;cl&#34;&gt;docker compose down
&lt;/span&gt;&lt;/span&gt;&lt;span class=&#34;line&#34;&gt;&lt;span class=&#34;cl&#34;&gt;docker compose up -d&lt;/span&gt;&lt;/span&gt;&lt;/code&gt;&lt;/pre&gt;&lt;/div&gt;&lt;/div&gt;&lt;div class=&#34;hextra-code-copy-btn-container hx-opacity-0 hx-transition group-hover/code:hx-opacity-100 hx-flex hx-gap-1 hx-absolute hx-m-[11px] hx-right-0 hx-top-0&#34;&gt;
  &lt;button
    class=&#34;hextra-code-copy-btn hx-group/copybtn hx-transition-all active:hx-opacity-50 hx-bg-primary-700/5 hx-border hx-border-black/5 hx-text-gray-600 hover:hx-text-gray-900 hx-rounded-md hx-p-1.5 dark:hx-bg-primary-300/10 dark:hx-border-white/10 dark:hx-text-gray-400 dark:hover:hx-text-gray-50&#34;
    title=&#34;Copy code&#34;
  &gt;
    &lt;div class=&#34;copy-icon group-[.copied]/copybtn:hx-hidden hx-pointer-events-none hx-h-4 hx-w-4&#34;&gt;&lt;/div&gt;
    &lt;div class=&#34;success-icon hx-hidden group-[.copied]/copybtn:hx-block hx-pointer-events-none hx-h-4 hx-w-4&#34;&gt;&lt;/div&gt;
  &lt;/button&gt;
&lt;/div&gt;
&lt;/div&gt;
&lt;h4&gt;Step 4: Login&lt;span class=&#34;hx-absolute -hx-mt-20&#34; id=&#34;step-4-login&#34;&gt;&lt;/span&gt;
    &lt;a href=&#34;#step-4-login&#34; class=&#34;subheading-anchor&#34; aria-label=&#34;Permalink for this section&#34;&gt;&lt;/a&gt;&lt;/h4&gt;&lt;ul&gt;
&lt;li&gt;Access Cavaliba with the default admin account (login: &lt;code&gt;admin&lt;/code&gt;, password from &lt;code&gt;CAVALIBA_ADMIN_PASSWORD&lt;/code&gt; in &lt;code&gt;.env&lt;/code&gt;)&lt;/li&gt;
&lt;/ul&gt;
&lt;h3&gt;User Management&lt;span class=&#34;hx-absolute -hx-mt-20&#34; id=&#34;user-management&#34;&gt;&lt;/span&gt;
    &lt;a href=&#34;#user-management&#34; class=&#34;subheading-anchor&#34; aria-label=&#34;Permalink for this section&#34;&gt;&lt;/a&gt;&lt;/h3&gt;&lt;h4&gt;Adding a New User&lt;span class=&#34;hx-absolute -hx-mt-20&#34; id=&#34;adding-a-new-user&#34;&gt;&lt;/span&gt;
    &lt;a href=&#34;#adding-a-new-user&#34; class=&#34;subheading-anchor&#34; aria-label=&#34;Permalink for this section&#34;&gt;&lt;/a&gt;&lt;/h4&gt;&lt;p&gt;&lt;strong&gt;Via Web Admin Interface:&lt;/strong&gt;&lt;/p&gt;
&lt;ol&gt;
&lt;li&gt;Open the &lt;strong&gt;DB Admin Tool&lt;/strong&gt; from Cavaliba main menu (Admin section)&lt;/li&gt;
&lt;li&gt;Select the Django user table (&lt;code&gt;auth_user&lt;/code&gt;)&lt;/li&gt;
&lt;li&gt;Click the &amp;ldquo;Add User&amp;rdquo; button and fill in the form:
&lt;ul&gt;
&lt;li&gt;&lt;strong&gt;Username&lt;/strong&gt;: Login identifier (e.g., &lt;code&gt;john.smith&lt;/code&gt;)&lt;/li&gt;
&lt;li&gt;&lt;strong&gt;Password&lt;/strong&gt;: Initial password (encrypted in database)&lt;/li&gt;
&lt;li&gt;&lt;strong&gt;Email&lt;/strong&gt;: User email address&lt;/li&gt;
&lt;/ul&gt;
&lt;/li&gt;
&lt;li&gt;Return to Cavaliba&lt;/li&gt;
&lt;li&gt;Go to the &lt;strong&gt;User module&lt;/strong&gt; in administration&lt;/li&gt;
&lt;li&gt;Add the same user with extended information:
&lt;ul&gt;
&lt;li&gt;Full name&lt;/li&gt;
&lt;li&gt;Group membership&lt;/li&gt;
&lt;li&gt;Roles and permissions&lt;/li&gt;
&lt;li&gt;Email preferences&lt;/li&gt;
&lt;/ul&gt;
&lt;/li&gt;
&lt;/ol&gt;
&lt;p&gt;&lt;strong&gt;Via Django Shell (CLI):&lt;/strong&gt;&lt;/p&gt;
&lt;div class=&#34;hextra-code-block hx-relative hx-mt-6 first:hx-mt-0 hx-group/code&#34;&gt;

&lt;div&gt;&lt;div class=&#34;highlight&#34;&gt;&lt;pre tabindex=&#34;0&#34; class=&#34;chroma&#34;&gt;&lt;code class=&#34;language-bash&#34; data-lang=&#34;bash&#34;&gt;&lt;span class=&#34;line&#34;&gt;&lt;span class=&#34;cl&#34;&gt;docker &lt;span class=&#34;nb&#34;&gt;exec&lt;/span&gt; -it cavaliba_app python manage.py shell&lt;/span&gt;&lt;/span&gt;&lt;/code&gt;&lt;/pre&gt;&lt;/div&gt;&lt;/div&gt;&lt;div class=&#34;hextra-code-copy-btn-container hx-opacity-0 hx-transition group-hover/code:hx-opacity-100 hx-flex hx-gap-1 hx-absolute hx-m-[11px] hx-right-0 hx-top-0&#34;&gt;
  &lt;button
    class=&#34;hextra-code-copy-btn hx-group/copybtn hx-transition-all active:hx-opacity-50 hx-bg-primary-700/5 hx-border hx-border-black/5 hx-text-gray-600 hover:hx-text-gray-900 hx-rounded-md hx-p-1.5 dark:hx-bg-primary-300/10 dark:hx-border-white/10 dark:hx-text-gray-400 dark:hover:hx-text-gray-50&#34;
    title=&#34;Copy code&#34;
  &gt;
    &lt;div class=&#34;copy-icon group-[.copied]/copybtn:hx-hidden hx-pointer-events-none hx-h-4 hx-w-4&#34;&gt;&lt;/div&gt;
    &lt;div class=&#34;success-icon hx-hidden group-[.copied]/copybtn:hx-block hx-pointer-events-none hx-h-4 hx-w-4&#34;&gt;&lt;/div&gt;
  &lt;/button&gt;
&lt;/div&gt;
&lt;/div&gt;
&lt;p&gt;In the Python shell:&lt;/p&gt;
&lt;div class=&#34;hextra-code-block hx-relative hx-mt-6 first:hx-mt-0 hx-group/code&#34;&gt;

&lt;div&gt;&lt;div class=&#34;highlight&#34;&gt;&lt;pre tabindex=&#34;0&#34; class=&#34;chroma&#34;&gt;&lt;code class=&#34;language-python&#34; data-lang=&#34;python&#34;&gt;&lt;span class=&#34;line&#34;&gt;&lt;span class=&#34;cl&#34;&gt;&lt;span class=&#34;kn&#34;&gt;from&lt;/span&gt; &lt;span class=&#34;nn&#34;&gt;django.contrib.auth.models&lt;/span&gt; &lt;span class=&#34;kn&#34;&gt;import&lt;/span&gt; &lt;span class=&#34;n&#34;&gt;User&lt;/span&gt;
&lt;/span&gt;&lt;/span&gt;&lt;span class=&#34;line&#34;&gt;&lt;span class=&#34;cl&#34;&gt;&lt;span class=&#34;n&#34;&gt;user&lt;/span&gt; &lt;span class=&#34;o&#34;&gt;=&lt;/span&gt; &lt;span class=&#34;n&#34;&gt;User&lt;/span&gt;&lt;span class=&#34;o&#34;&gt;.&lt;/span&gt;&lt;span class=&#34;n&#34;&gt;objects&lt;/span&gt;&lt;span class=&#34;o&#34;&gt;.&lt;/span&gt;&lt;span class=&#34;n&#34;&gt;create_user&lt;/span&gt;&lt;span class=&#34;p&#34;&gt;(&lt;/span&gt;&lt;span class=&#34;s2&#34;&gt;&amp;#34;john.smith&amp;#34;&lt;/span&gt;&lt;span class=&#34;p&#34;&gt;,&lt;/span&gt; &lt;span class=&#34;s2&#34;&gt;&amp;#34;john@company.com&amp;#34;&lt;/span&gt;&lt;span class=&#34;p&#34;&gt;,&lt;/span&gt; &lt;span class=&#34;s2&#34;&gt;&amp;#34;initialpassword&amp;#34;&lt;/span&gt;&lt;span class=&#34;p&#34;&gt;)&lt;/span&gt;&lt;/span&gt;&lt;/span&gt;&lt;/code&gt;&lt;/pre&gt;&lt;/div&gt;&lt;/div&gt;&lt;div class=&#34;hextra-code-copy-btn-container hx-opacity-0 hx-transition group-hover/code:hx-opacity-100 hx-flex hx-gap-1 hx-absolute hx-m-[11px] hx-right-0 hx-top-0&#34;&gt;
  &lt;button
    class=&#34;hextra-code-copy-btn hx-group/copybtn hx-transition-all active:hx-opacity-50 hx-bg-primary-700/5 hx-border hx-border-black/5 hx-text-gray-600 hover:hx-text-gray-900 hx-rounded-md hx-p-1.5 dark:hx-bg-primary-300/10 dark:hx-border-white/10 dark:hx-text-gray-400 dark:hover:hx-text-gray-50&#34;
    title=&#34;Copy code&#34;
  &gt;
    &lt;div class=&#34;copy-icon group-[.copied]/copybtn:hx-hidden hx-pointer-events-none hx-h-4 hx-w-4&#34;&gt;&lt;/div&gt;
    &lt;div class=&#34;success-icon hx-hidden group-[.copied]/copybtn:hx-block hx-pointer-events-none hx-h-4 hx-w-4&#34;&gt;&lt;/div&gt;
  &lt;/button&gt;
&lt;/div&gt;
&lt;/div&gt;
&lt;p&gt;&lt;strong&gt;Via Django createsuperuser (admin only):&lt;/strong&gt;&lt;/p&gt;
&lt;div class=&#34;hextra-code-block hx-relative hx-mt-6 first:hx-mt-0 hx-group/code&#34;&gt;

&lt;div&gt;&lt;div class=&#34;highlight&#34;&gt;&lt;pre tabindex=&#34;0&#34; class=&#34;chroma&#34;&gt;&lt;code class=&#34;language-bash&#34; data-lang=&#34;bash&#34;&gt;&lt;span class=&#34;line&#34;&gt;&lt;span class=&#34;cl&#34;&gt;docker &lt;span class=&#34;nb&#34;&gt;exec&lt;/span&gt; -it cavaliba_app python manage.py createsuperuser&lt;/span&gt;&lt;/span&gt;&lt;/code&gt;&lt;/pre&gt;&lt;/div&gt;&lt;/div&gt;&lt;div class=&#34;hextra-code-copy-btn-container hx-opacity-0 hx-transition group-hover/code:hx-opacity-100 hx-flex hx-gap-1 hx-absolute hx-m-[11px] hx-right-0 hx-top-0&#34;&gt;
  &lt;button
    class=&#34;hextra-code-copy-btn hx-group/copybtn hx-transition-all active:hx-opacity-50 hx-bg-primary-700/5 hx-border hx-border-black/5 hx-text-gray-600 hover:hx-text-gray-900 hx-rounded-md hx-p-1.5 dark:hx-bg-primary-300/10 dark:hx-border-white/10 dark:hx-text-gray-400 dark:hover:hx-text-gray-50&#34;
    title=&#34;Copy code&#34;
  &gt;
    &lt;div class=&#34;copy-icon group-[.copied]/copybtn:hx-hidden hx-pointer-events-none hx-h-4 hx-w-4&#34;&gt;&lt;/div&gt;
    &lt;div class=&#34;success-icon hx-hidden group-[.copied]/copybtn:hx-block hx-pointer-events-none hx-h-4 hx-w-4&#34;&gt;&lt;/div&gt;
  &lt;/button&gt;
&lt;/div&gt;
&lt;/div&gt;
&lt;h4&gt;Suspending or Removing a User&lt;span class=&#34;hx-absolute -hx-mt-20&#34; id=&#34;suspending-or-removing-a-user&#34;&gt;&lt;/span&gt;
    &lt;a href=&#34;#suspending-or-removing-a-user&#34; class=&#34;subheading-anchor&#34; aria-label=&#34;Permalink for this section&#34;&gt;&lt;/a&gt;&lt;/h4&gt;&lt;ol&gt;
&lt;li&gt;Open the &lt;strong&gt;DB Admin Tool&lt;/strong&gt; from Cavaliba main menu&lt;/li&gt;
&lt;li&gt;Select the Django user table&lt;/li&gt;
&lt;li&gt;Find the user and edit:
&lt;ul&gt;
&lt;li&gt;Set &lt;strong&gt;Active&lt;/strong&gt; checkbox to unchecked to suspend&lt;/li&gt;
&lt;li&gt;Click delete to remove entirely&lt;/li&gt;
&lt;/ul&gt;
&lt;/li&gt;
&lt;li&gt;Return to the &lt;strong&gt;User module&lt;/strong&gt; in Cavaliba to update the Cavaliba user record&lt;/li&gt;
&lt;/ol&gt;
&lt;p&gt;&lt;strong&gt;Note:&lt;/strong&gt; Disabling in Django prevents login but the Cavaliba user record remains and can still receive notifications via Sirene.&lt;/p&gt;
&lt;h4&gt;Changing a User&amp;rsquo;s Password&lt;span class=&#34;hx-absolute -hx-mt-20&#34; id=&#34;changing-a-users-password&#34;&gt;&lt;/span&gt;
    &lt;a href=&#34;#changing-a-users-password&#34; class=&#34;subheading-anchor&#34; aria-label=&#34;Permalink for this section&#34;&gt;&lt;/a&gt;&lt;/h4&gt;&lt;p&gt;&lt;strong&gt;Via Web Admin Interface:&lt;/strong&gt;&lt;/p&gt;
&lt;ol&gt;
&lt;li&gt;Open the &lt;strong&gt;DB Admin Tool&lt;/strong&gt; from Cavaliba main menu&lt;/li&gt;
&lt;li&gt;Select the Django user table&lt;/li&gt;
&lt;li&gt;Click on the user to edit&lt;/li&gt;
&lt;li&gt;Use the &lt;strong&gt;Change Password&lt;/strong&gt; button/link to set a new password&lt;/li&gt;
&lt;/ol&gt;
&lt;p&gt;&lt;strong&gt;Via Django CLI:&lt;/strong&gt;&lt;/p&gt;
&lt;div class=&#34;hextra-code-block hx-relative hx-mt-6 first:hx-mt-0 hx-group/code&#34;&gt;

&lt;div&gt;&lt;div class=&#34;highlight&#34;&gt;&lt;pre tabindex=&#34;0&#34; class=&#34;chroma&#34;&gt;&lt;code class=&#34;language-bash&#34; data-lang=&#34;bash&#34;&gt;&lt;span class=&#34;line&#34;&gt;&lt;span class=&#34;cl&#34;&gt;docker &lt;span class=&#34;nb&#34;&gt;exec&lt;/span&gt; -it cavaliba_app python manage.py changepassword LOGIN&lt;/span&gt;&lt;/span&gt;&lt;/code&gt;&lt;/pre&gt;&lt;/div&gt;&lt;/div&gt;&lt;div class=&#34;hextra-code-copy-btn-container hx-opacity-0 hx-transition group-hover/code:hx-opacity-100 hx-flex hx-gap-1 hx-absolute hx-m-[11px] hx-right-0 hx-top-0&#34;&gt;
  &lt;button
    class=&#34;hextra-code-copy-btn hx-group/copybtn hx-transition-all active:hx-opacity-50 hx-bg-primary-700/5 hx-border hx-border-black/5 hx-text-gray-600 hover:hx-text-gray-900 hx-rounded-md hx-p-1.5 dark:hx-bg-primary-300/10 dark:hx-border-white/10 dark:hx-text-gray-400 dark:hover:hx-text-gray-50&#34;
    title=&#34;Copy code&#34;
  &gt;
    &lt;div class=&#34;copy-icon group-[.copied]/copybtn:hx-hidden hx-pointer-events-none hx-h-4 hx-w-4&#34;&gt;&lt;/div&gt;
    &lt;div class=&#34;success-icon hx-hidden group-[.copied]/copybtn:hx-block hx-pointer-events-none hx-h-4 hx-w-4&#34;&gt;&lt;/div&gt;
  &lt;/button&gt;
&lt;/div&gt;
&lt;/div&gt;
&lt;h3&gt;Important Notes&lt;span class=&#34;hx-absolute -hx-mt-20&#34; id=&#34;important-notes&#34;&gt;&lt;/span&gt;
    &lt;a href=&#34;#important-notes&#34; class=&#34;subheading-anchor&#34; aria-label=&#34;Permalink for this section&#34;&gt;&lt;/a&gt;&lt;/h3&gt;&lt;ul&gt;
&lt;li&gt;Local authentication requires users to exist in &lt;strong&gt;both&lt;/strong&gt;:
&lt;ol&gt;
&lt;li&gt;Django auth table (&lt;code&gt;auth_user&lt;/code&gt;) - for login credentials&lt;/li&gt;
&lt;li&gt;Cavaliba user model (&lt;code&gt;SireneUser&lt;/code&gt;) - for roles, groups, permissions, notifications&lt;/li&gt;
&lt;/ol&gt;
&lt;/li&gt;
&lt;li&gt;Password changes made in the DB admin tool take effect immediately&lt;/li&gt;
&lt;li&gt;No password expiration or complexity rules are enforced by default&lt;/li&gt;
&lt;/ul&gt;
&lt;hr&gt;
&lt;h2&gt;Basic Authentication&lt;span class=&#34;hx-absolute -hx-mt-20&#34; id=&#34;basic-authentication&#34;&gt;&lt;/span&gt;
    &lt;a href=&#34;#basic-authentication&#34; class=&#34;subheading-anchor&#34; aria-label=&#34;Permalink for this section&#34;&gt;&lt;/a&gt;&lt;/h2&gt;&lt;h3&gt;Overview&lt;span class=&#34;hx-absolute -hx-mt-20&#34; id=&#34;overview-1&#34;&gt;&lt;/span&gt;
    &lt;a href=&#34;#overview-1&#34; class=&#34;subheading-anchor&#34; aria-label=&#34;Permalink for this section&#34;&gt;&lt;/a&gt;&lt;/h3&gt;&lt;p&gt;Basic Authentication is an &lt;strong&gt;external&lt;/strong&gt; authentication mode. The web server (or upstream reverse proxy) handles authentication and passes the authenticated username to Cavaliba via HTTP headers.&lt;/p&gt;
&lt;p&gt;&lt;strong&gt;Best for:&lt;/strong&gt; Small teams with existing infrastructure (Apache, Nginx with auth modules, or external reverse proxies).&lt;/p&gt;
&lt;h3&gt;Configuration&lt;span class=&#34;hx-absolute -hx-mt-20&#34; id=&#34;configuration-1&#34;&gt;&lt;/span&gt;
    &lt;a href=&#34;#configuration-1&#34; class=&#34;subheading-anchor&#34; aria-label=&#34;Permalink for this section&#34;&gt;&lt;/a&gt;&lt;/h3&gt;&lt;h4&gt;Option 1: Using Cavaliba&amp;rsquo;s Internal Nginx&lt;span class=&#34;hx-absolute -hx-mt-20&#34; id=&#34;option-1-using-cavalibas-internal-nginx&#34;&gt;&lt;/span&gt;
    &lt;a href=&#34;#option-1-using-cavalibas-internal-nginx&#34; class=&#34;subheading-anchor&#34; aria-label=&#34;Permalink for this section&#34;&gt;&lt;/a&gt;&lt;/h4&gt;&lt;h5&gt;Step 1: Create htpasswd File&lt;span class=&#34;hx-absolute -hx-mt-20&#34; id=&#34;step-1-create-htpasswd-file&#34;&gt;&lt;/span&gt;
    &lt;a href=&#34;#step-1-create-htpasswd-file&#34; class=&#34;subheading-anchor&#34; aria-label=&#34;Permalink for this section&#34;&gt;&lt;/a&gt;&lt;/h5&gt;&lt;p&gt;On your host machine, create a password file using the &lt;code&gt;htpasswd&lt;/code&gt; utility:&lt;/p&gt;
&lt;div class=&#34;hextra-code-block hx-relative hx-mt-6 first:hx-mt-0 hx-group/code&#34;&gt;

&lt;div&gt;&lt;div class=&#34;highlight&#34;&gt;&lt;pre tabindex=&#34;0&#34; class=&#34;chroma&#34;&gt;&lt;code class=&#34;language-bash&#34; data-lang=&#34;bash&#34;&gt;&lt;span class=&#34;line&#34;&gt;&lt;span class=&#34;cl&#34;&gt;&lt;span class=&#34;c1&#34;&gt;# Install apache2-utils if needed (Ubuntu/Debian)&lt;/span&gt;
&lt;/span&gt;&lt;/span&gt;&lt;span class=&#34;line&#34;&gt;&lt;span class=&#34;cl&#34;&gt;sudo apt-get install apache2-utils
&lt;/span&gt;&lt;/span&gt;&lt;span class=&#34;line&#34;&gt;&lt;span class=&#34;cl&#34;&gt;
&lt;/span&gt;&lt;/span&gt;&lt;span class=&#34;line&#34;&gt;&lt;span class=&#34;cl&#34;&gt;&lt;span class=&#34;c1&#34;&gt;# Create htpasswd file with first user&lt;/span&gt;
&lt;/span&gt;&lt;/span&gt;&lt;span class=&#34;line&#34;&gt;&lt;span class=&#34;cl&#34;&gt;htpasswd -c ./htpasswd username1
&lt;/span&gt;&lt;/span&gt;&lt;span class=&#34;line&#34;&gt;&lt;span class=&#34;cl&#34;&gt;
&lt;/span&gt;&lt;/span&gt;&lt;span class=&#34;line&#34;&gt;&lt;span class=&#34;cl&#34;&gt;&lt;span class=&#34;c1&#34;&gt;# Add additional users (without -c flag)&lt;/span&gt;
&lt;/span&gt;&lt;/span&gt;&lt;span class=&#34;line&#34;&gt;&lt;span class=&#34;cl&#34;&gt;htpasswd ./htpasswd username2
&lt;/span&gt;&lt;/span&gt;&lt;span class=&#34;line&#34;&gt;&lt;span class=&#34;cl&#34;&gt;htpasswd ./htpasswd username3&lt;/span&gt;&lt;/span&gt;&lt;/code&gt;&lt;/pre&gt;&lt;/div&gt;&lt;/div&gt;&lt;div class=&#34;hextra-code-copy-btn-container hx-opacity-0 hx-transition group-hover/code:hx-opacity-100 hx-flex hx-gap-1 hx-absolute hx-m-[11px] hx-right-0 hx-top-0&#34;&gt;
  &lt;button
    class=&#34;hextra-code-copy-btn hx-group/copybtn hx-transition-all active:hx-opacity-50 hx-bg-primary-700/5 hx-border hx-border-black/5 hx-text-gray-600 hover:hx-text-gray-900 hx-rounded-md hx-p-1.5 dark:hx-bg-primary-300/10 dark:hx-border-white/10 dark:hx-text-gray-400 dark:hover:hx-text-gray-50&#34;
    title=&#34;Copy code&#34;
  &gt;
    &lt;div class=&#34;copy-icon group-[.copied]/copybtn:hx-hidden hx-pointer-events-none hx-h-4 hx-w-4&#34;&gt;&lt;/div&gt;
    &lt;div class=&#34;success-icon hx-hidden group-[.copied]/copybtn:hx-block hx-pointer-events-none hx-h-4 hx-w-4&#34;&gt;&lt;/div&gt;
  &lt;/button&gt;
&lt;/div&gt;
&lt;/div&gt;
&lt;p&gt;Keep this file in your Cavaliba directory (e.g., &lt;code&gt;./config/htpasswd&lt;/code&gt;).&lt;/p&gt;
&lt;h5&gt;Step 2: Update docker-compose.yml&lt;span class=&#34;hx-absolute -hx-mt-20&#34; id=&#34;step-2-update-docker-composeyml&#34;&gt;&lt;/span&gt;
    &lt;a href=&#34;#step-2-update-docker-composeyml&#34; class=&#34;subheading-anchor&#34; aria-label=&#34;Permalink for this section&#34;&gt;&lt;/a&gt;&lt;/h5&gt;&lt;p&gt;Uncomment the volume section mounting the htpasswd file into the Nginx container:&lt;/p&gt;
&lt;div class=&#34;hextra-code-block hx-relative hx-mt-6 first:hx-mt-0 hx-group/code&#34;&gt;

&lt;div&gt;&lt;div class=&#34;highlight&#34;&gt;&lt;pre tabindex=&#34;0&#34; class=&#34;chroma&#34;&gt;&lt;code class=&#34;language-yaml&#34; data-lang=&#34;yaml&#34;&gt;&lt;span class=&#34;line&#34;&gt;&lt;span class=&#34;cl&#34;&gt;&lt;span class=&#34;nt&#34;&gt;nginx&lt;/span&gt;&lt;span class=&#34;p&#34;&gt;:&lt;/span&gt;&lt;span class=&#34;w&#34;&gt;
&lt;/span&gt;&lt;/span&gt;&lt;/span&gt;&lt;span class=&#34;line&#34;&gt;&lt;span class=&#34;cl&#34;&gt;&lt;span class=&#34;w&#34;&gt;  &lt;/span&gt;&lt;span class=&#34;nt&#34;&gt;volumes&lt;/span&gt;&lt;span class=&#34;p&#34;&gt;:&lt;/span&gt;&lt;span class=&#34;w&#34;&gt;
&lt;/span&gt;&lt;/span&gt;&lt;/span&gt;&lt;span class=&#34;line&#34;&gt;&lt;span class=&#34;cl&#34;&gt;&lt;span class=&#34;w&#34;&gt;    &lt;/span&gt;&lt;span class=&#34;c&#34;&gt;# ... existing volumes ...&lt;/span&gt;&lt;span class=&#34;w&#34;&gt;
&lt;/span&gt;&lt;/span&gt;&lt;/span&gt;&lt;span class=&#34;line&#34;&gt;&lt;span class=&#34;cl&#34;&gt;&lt;span class=&#34;w&#34;&gt;    &lt;/span&gt;- &lt;span class=&#34;l&#34;&gt;./config/htpasswd:/etc/nginx/conf.d/.htpasswd:ro&lt;/span&gt;&lt;/span&gt;&lt;/span&gt;&lt;/code&gt;&lt;/pre&gt;&lt;/div&gt;&lt;/div&gt;&lt;div class=&#34;hextra-code-copy-btn-container hx-opacity-0 hx-transition group-hover/code:hx-opacity-100 hx-flex hx-gap-1 hx-absolute hx-m-[11px] hx-right-0 hx-top-0&#34;&gt;
  &lt;button
    class=&#34;hextra-code-copy-btn hx-group/copybtn hx-transition-all active:hx-opacity-50 hx-bg-primary-700/5 hx-border hx-border-black/5 hx-text-gray-600 hover:hx-text-gray-900 hx-rounded-md hx-p-1.5 dark:hx-bg-primary-300/10 dark:hx-border-white/10 dark:hx-text-gray-400 dark:hover:hx-text-gray-50&#34;
    title=&#34;Copy code&#34;
  &gt;
    &lt;div class=&#34;copy-icon group-[.copied]/copybtn:hx-hidden hx-pointer-events-none hx-h-4 hx-w-4&#34;&gt;&lt;/div&gt;
    &lt;div class=&#34;success-icon hx-hidden group-[.copied]/copybtn:hx-block hx-pointer-events-none hx-h-4 hx-w-4&#34;&gt;&lt;/div&gt;
  &lt;/button&gt;
&lt;/div&gt;
&lt;/div&gt;
&lt;h5&gt;Step 3: Update nginx.conf&lt;span class=&#34;hx-absolute -hx-mt-20&#34; id=&#34;step-3-update-nginxconf&#34;&gt;&lt;/span&gt;
    &lt;a href=&#34;#step-3-update-nginxconf&#34; class=&#34;subheading-anchor&#34; aria-label=&#34;Permalink for this section&#34;&gt;&lt;/a&gt;&lt;/h5&gt;&lt;p&gt;Uncomment the basic authentication configuration block:&lt;/p&gt;
&lt;div class=&#34;hextra-code-block hx-relative hx-mt-6 first:hx-mt-0 hx-group/code&#34;&gt;

&lt;div&gt;&lt;div class=&#34;highlight&#34;&gt;&lt;pre tabindex=&#34;0&#34; class=&#34;chroma&#34;&gt;&lt;code class=&#34;language-nginx&#34; data-lang=&#34;nginx&#34;&gt;&lt;span class=&#34;line&#34;&gt;&lt;span class=&#34;cl&#34;&gt;&lt;span class=&#34;k&#34;&gt;location&lt;/span&gt; &lt;span class=&#34;s&#34;&gt;/&lt;/span&gt; &lt;span class=&#34;p&#34;&gt;{&lt;/span&gt;
&lt;/span&gt;&lt;/span&gt;&lt;span class=&#34;line&#34;&gt;&lt;span class=&#34;cl&#34;&gt;    &lt;span class=&#34;kn&#34;&gt;auth_basic&lt;/span&gt; &lt;span class=&#34;s&#34;&gt;&amp;#34;Cavaliba&amp;#34;&lt;/span&gt;&lt;span class=&#34;p&#34;&gt;;&lt;/span&gt;
&lt;/span&gt;&lt;/span&gt;&lt;span class=&#34;line&#34;&gt;&lt;span class=&#34;cl&#34;&gt;    &lt;span class=&#34;kn&#34;&gt;auth_basic_user_file&lt;/span&gt; &lt;span class=&#34;s&#34;&gt;/etc/nginx/conf.d/.htpasswd&lt;/span&gt;&lt;span class=&#34;p&#34;&gt;;&lt;/span&gt;
&lt;/span&gt;&lt;/span&gt;&lt;span class=&#34;line&#34;&gt;&lt;span class=&#34;cl&#34;&gt;    &lt;span class=&#34;c1&#34;&gt;# ... proxy settings ...
&lt;/span&gt;&lt;/span&gt;&lt;/span&gt;&lt;span class=&#34;line&#34;&gt;&lt;span class=&#34;cl&#34;&gt;&lt;span class=&#34;c1&#34;&gt;&lt;/span&gt;&lt;span class=&#34;p&#34;&gt;}&lt;/span&gt;&lt;/span&gt;&lt;/span&gt;&lt;/code&gt;&lt;/pre&gt;&lt;/div&gt;&lt;/div&gt;&lt;div class=&#34;hextra-code-copy-btn-container hx-opacity-0 hx-transition group-hover/code:hx-opacity-100 hx-flex hx-gap-1 hx-absolute hx-m-[11px] hx-right-0 hx-top-0&#34;&gt;
  &lt;button
    class=&#34;hextra-code-copy-btn hx-group/copybtn hx-transition-all active:hx-opacity-50 hx-bg-primary-700/5 hx-border hx-border-black/5 hx-text-gray-600 hover:hx-text-gray-900 hx-rounded-md hx-p-1.5 dark:hx-bg-primary-300/10 dark:hx-border-white/10 dark:hx-text-gray-400 dark:hover:hx-text-gray-50&#34;
    title=&#34;Copy code&#34;
  &gt;
    &lt;div class=&#34;copy-icon group-[.copied]/copybtn:hx-hidden hx-pointer-events-none hx-h-4 hx-w-4&#34;&gt;&lt;/div&gt;
    &lt;div class=&#34;success-icon hx-hidden group-[.copied]/copybtn:hx-block hx-pointer-events-none hx-h-4 hx-w-4&#34;&gt;&lt;/div&gt;
  &lt;/button&gt;
&lt;/div&gt;
&lt;/div&gt;
&lt;h5&gt;Step 4: Update .env File&lt;span class=&#34;hx-absolute -hx-mt-20&#34; id=&#34;step-4-update-env-file&#34;&gt;&lt;/span&gt;
    &lt;a href=&#34;#step-4-update-env-file&#34; class=&#34;subheading-anchor&#34; aria-label=&#34;Permalink for this section&#34;&gt;&lt;/a&gt;&lt;/h5&gt;&lt;div class=&#34;hextra-code-block hx-relative hx-mt-6 first:hx-mt-0 hx-group/code&#34;&gt;

&lt;div&gt;&lt;pre&gt;&lt;code&gt;CAVALIBA_AUTH_MODE=basic&lt;/code&gt;&lt;/pre&gt;&lt;/div&gt;&lt;div class=&#34;hextra-code-copy-btn-container hx-opacity-0 hx-transition group-hover/code:hx-opacity-100 hx-flex hx-gap-1 hx-absolute hx-m-[11px] hx-right-0 hx-top-0&#34;&gt;
  &lt;button
    class=&#34;hextra-code-copy-btn hx-group/copybtn hx-transition-all active:hx-opacity-50 hx-bg-primary-700/5 hx-border hx-border-black/5 hx-text-gray-600 hover:hx-text-gray-900 hx-rounded-md hx-p-1.5 dark:hx-bg-primary-300/10 dark:hx-border-white/10 dark:hx-text-gray-400 dark:hover:hx-text-gray-50&#34;
    title=&#34;Copy code&#34;
  &gt;
    &lt;div class=&#34;copy-icon group-[.copied]/copybtn:hx-hidden hx-pointer-events-none hx-h-4 hx-w-4&#34;&gt;&lt;/div&gt;
    &lt;div class=&#34;success-icon hx-hidden group-[.copied]/copybtn:hx-block hx-pointer-events-none hx-h-4 hx-w-4&#34;&gt;&lt;/div&gt;
  &lt;/button&gt;
&lt;/div&gt;
&lt;/div&gt;
&lt;p&gt;Ensure OAUTH2 configuration is commented out.&lt;/p&gt;
&lt;h5&gt;Step 5: Restart Containers&lt;span class=&#34;hx-absolute -hx-mt-20&#34; id=&#34;step-5-restart-containers&#34;&gt;&lt;/span&gt;
    &lt;a href=&#34;#step-5-restart-containers&#34; class=&#34;subheading-anchor&#34; aria-label=&#34;Permalink for this section&#34;&gt;&lt;/a&gt;&lt;/h5&gt;&lt;div class=&#34;hextra-code-block hx-relative hx-mt-6 first:hx-mt-0 hx-group/code&#34;&gt;

&lt;div&gt;&lt;div class=&#34;highlight&#34;&gt;&lt;pre tabindex=&#34;0&#34; class=&#34;chroma&#34;&gt;&lt;code class=&#34;language-bash&#34; data-lang=&#34;bash&#34;&gt;&lt;span class=&#34;line&#34;&gt;&lt;span class=&#34;cl&#34;&gt;docker compose down
&lt;/span&gt;&lt;/span&gt;&lt;span class=&#34;line&#34;&gt;&lt;span class=&#34;cl&#34;&gt;docker compose up -d&lt;/span&gt;&lt;/span&gt;&lt;/code&gt;&lt;/pre&gt;&lt;/div&gt;&lt;/div&gt;&lt;div class=&#34;hextra-code-copy-btn-container hx-opacity-0 hx-transition group-hover/code:hx-opacity-100 hx-flex hx-gap-1 hx-absolute hx-m-[11px] hx-right-0 hx-top-0&#34;&gt;
  &lt;button
    class=&#34;hextra-code-copy-btn hx-group/copybtn hx-transition-all active:hx-opacity-50 hx-bg-primary-700/5 hx-border hx-border-black/5 hx-text-gray-600 hover:hx-text-gray-900 hx-rounded-md hx-p-1.5 dark:hx-bg-primary-300/10 dark:hx-border-white/10 dark:hx-text-gray-400 dark:hover:hx-text-gray-50&#34;
    title=&#34;Copy code&#34;
  &gt;
    &lt;div class=&#34;copy-icon group-[.copied]/copybtn:hx-hidden hx-pointer-events-none hx-h-4 hx-w-4&#34;&gt;&lt;/div&gt;
    &lt;div class=&#34;success-icon hx-hidden group-[.copied]/copybtn:hx-block hx-pointer-events-none hx-h-4 hx-w-4&#34;&gt;&lt;/div&gt;
  &lt;/button&gt;
&lt;/div&gt;
&lt;/div&gt;
&lt;h4&gt;Option 2: Using External Reverse Proxy&lt;span class=&#34;hx-absolute -hx-mt-20&#34; id=&#34;option-2-using-external-reverse-proxy&#34;&gt;&lt;/span&gt;
    &lt;a href=&#34;#option-2-using-external-reverse-proxy&#34; class=&#34;subheading-anchor&#34; aria-label=&#34;Permalink for this section&#34;&gt;&lt;/a&gt;&lt;/h4&gt;&lt;p&gt;If you have an external reverse proxy or web server (Apache, HAProxy, cloud-based auth), configure it to:&lt;/p&gt;
&lt;ol&gt;
&lt;li&gt;Perform HTTP Basic Authentication&lt;/li&gt;
&lt;li&gt;Set the HTTP &lt;code&gt;Authorization&lt;/code&gt; header or &lt;code&gt;Remote-User&lt;/code&gt; header with the authenticated username&lt;/li&gt;
&lt;li&gt;Forward the request to Cavaliba&lt;/li&gt;
&lt;/ol&gt;
&lt;p&gt;The reverse proxy &lt;strong&gt;must&lt;/strong&gt; pass one of these headers:&lt;/p&gt;
&lt;ul&gt;
&lt;li&gt;Standard HTTP &lt;code&gt;Authorization&lt;/code&gt; header (Base64-encoded username:password)&lt;/li&gt;
&lt;li&gt;Custom header like &lt;code&gt;Remote-User&lt;/code&gt; with the username&lt;/li&gt;
&lt;li&gt;Custom header configured in Cavaliba&lt;/li&gt;
&lt;/ul&gt;
&lt;h3&gt;User Management&lt;span class=&#34;hx-absolute -hx-mt-20&#34; id=&#34;user-management-1&#34;&gt;&lt;/span&gt;
    &lt;a href=&#34;#user-management-1&#34; class=&#34;subheading-anchor&#34; aria-label=&#34;Permalink for this section&#34;&gt;&lt;/a&gt;&lt;/h3&gt;&lt;p&gt;As with Local Authentication, users must exist in &lt;strong&gt;both&lt;/strong&gt;:&lt;/p&gt;
&lt;ol&gt;
&lt;li&gt;&lt;strong&gt;External&lt;/strong&gt; (htpasswd file, reverse proxy directory) - for login credentials&lt;/li&gt;
&lt;li&gt;&lt;strong&gt;Cavaliba user model&lt;/strong&gt; - for roles, groups, permissions, notifications&lt;/li&gt;
&lt;/ol&gt;
&lt;h4&gt;Maintaining htpasswd File&lt;span class=&#34;hx-absolute -hx-mt-20&#34; id=&#34;maintaining-htpasswd-file&#34;&gt;&lt;/span&gt;
    &lt;a href=&#34;#maintaining-htpasswd-file&#34; class=&#34;subheading-anchor&#34; aria-label=&#34;Permalink for this section&#34;&gt;&lt;/a&gt;&lt;/h4&gt;&lt;div class=&#34;hextra-code-block hx-relative hx-mt-6 first:hx-mt-0 hx-group/code&#34;&gt;

&lt;div&gt;&lt;div class=&#34;highlight&#34;&gt;&lt;pre tabindex=&#34;0&#34; class=&#34;chroma&#34;&gt;&lt;code class=&#34;language-bash&#34; data-lang=&#34;bash&#34;&gt;&lt;span class=&#34;line&#34;&gt;&lt;span class=&#34;cl&#34;&gt;&lt;span class=&#34;c1&#34;&gt;# List current users&lt;/span&gt;
&lt;/span&gt;&lt;/span&gt;&lt;span class=&#34;line&#34;&gt;&lt;span class=&#34;cl&#34;&gt;htpasswd -l ./htpasswd
&lt;/span&gt;&lt;/span&gt;&lt;span class=&#34;line&#34;&gt;&lt;span class=&#34;cl&#34;&gt;
&lt;/span&gt;&lt;/span&gt;&lt;span class=&#34;line&#34;&gt;&lt;span class=&#34;cl&#34;&gt;&lt;span class=&#34;c1&#34;&gt;# Change user password&lt;/span&gt;
&lt;/span&gt;&lt;/span&gt;&lt;span class=&#34;line&#34;&gt;&lt;span class=&#34;cl&#34;&gt;htpasswd ./htpasswd username
&lt;/span&gt;&lt;/span&gt;&lt;span class=&#34;line&#34;&gt;&lt;span class=&#34;cl&#34;&gt;
&lt;/span&gt;&lt;/span&gt;&lt;span class=&#34;line&#34;&gt;&lt;span class=&#34;cl&#34;&gt;&lt;span class=&#34;c1&#34;&gt;# Delete user&lt;/span&gt;
&lt;/span&gt;&lt;/span&gt;&lt;span class=&#34;line&#34;&gt;&lt;span class=&#34;cl&#34;&gt;htpasswd -D ./htpasswd username&lt;/span&gt;&lt;/span&gt;&lt;/code&gt;&lt;/pre&gt;&lt;/div&gt;&lt;/div&gt;&lt;div class=&#34;hextra-code-copy-btn-container hx-opacity-0 hx-transition group-hover/code:hx-opacity-100 hx-flex hx-gap-1 hx-absolute hx-m-[11px] hx-right-0 hx-top-0&#34;&gt;
  &lt;button
    class=&#34;hextra-code-copy-btn hx-group/copybtn hx-transition-all active:hx-opacity-50 hx-bg-primary-700/5 hx-border hx-border-black/5 hx-text-gray-600 hover:hx-text-gray-900 hx-rounded-md hx-p-1.5 dark:hx-bg-primary-300/10 dark:hx-border-white/10 dark:hx-text-gray-400 dark:hover:hx-text-gray-50&#34;
    title=&#34;Copy code&#34;
  &gt;
    &lt;div class=&#34;copy-icon group-[.copied]/copybtn:hx-hidden hx-pointer-events-none hx-h-4 hx-w-4&#34;&gt;&lt;/div&gt;
    &lt;div class=&#34;success-icon hx-hidden group-[.copied]/copybtn:hx-block hx-pointer-events-none hx-h-4 hx-w-4&#34;&gt;&lt;/div&gt;
  &lt;/button&gt;
&lt;/div&gt;
&lt;/div&gt;
&lt;p&gt;Changes to htpasswd take effect immediately without container restart.&lt;/p&gt;
&lt;h3&gt;Important Notes&lt;span class=&#34;hx-absolute -hx-mt-20&#34; id=&#34;important-notes-1&#34;&gt;&lt;/span&gt;
    &lt;a href=&#34;#important-notes-1&#34; class=&#34;subheading-anchor&#34; aria-label=&#34;Permalink for this section&#34;&gt;&lt;/a&gt;&lt;/h3&gt;&lt;ul&gt;
&lt;li&gt;Basic Authentication sends credentials in Base64 encoding (easily decoded) - &lt;strong&gt;always use HTTPS in production&lt;/strong&gt;&lt;/li&gt;
&lt;li&gt;User management is split between external system and Cavaliba&lt;/li&gt;
&lt;li&gt;Password policies are controlled by the external auth system, not Cavaliba&lt;/li&gt;
&lt;li&gt;Cavaliba user records must be manually created and synchronized with external users&lt;/li&gt;
&lt;/ul&gt;
&lt;hr&gt;
&lt;h2&gt;Forced Authentication&lt;span class=&#34;hx-absolute -hx-mt-20&#34; id=&#34;forced-authentication&#34;&gt;&lt;/span&gt;
    &lt;a href=&#34;#forced-authentication&#34; class=&#34;subheading-anchor&#34; aria-label=&#34;Permalink for this section&#34;&gt;&lt;/a&gt;&lt;/h2&gt;&lt;h3&gt;Overview&lt;span class=&#34;hx-absolute -hx-mt-20&#34; id=&#34;overview-2&#34;&gt;&lt;/span&gt;
    &lt;a href=&#34;#overview-2&#34; class=&#34;subheading-anchor&#34; aria-label=&#34;Permalink for this section&#34;&gt;&lt;/a&gt;&lt;/h3&gt;&lt;p&gt;Forced Authentication means &lt;strong&gt;no authentication&lt;/strong&gt;. All connections are automatically mapped to a single predefined Cavaliba user without any credential verification.&lt;/p&gt;
&lt;p&gt;&lt;strong&gt;Best for:&lt;/strong&gt; Development, testing, isolated single-user environments only.&lt;/p&gt;
&lt;h3&gt;Configuration&lt;span class=&#34;hx-absolute -hx-mt-20&#34; id=&#34;configuration-2&#34;&gt;&lt;/span&gt;
    &lt;a href=&#34;#configuration-2&#34; class=&#34;subheading-anchor&#34; aria-label=&#34;Permalink for this section&#34;&gt;&lt;/a&gt;&lt;/h3&gt;&lt;h4&gt;Step 1: Update .env File&lt;span class=&#34;hx-absolute -hx-mt-20&#34; id=&#34;step-1-update-env-file&#34;&gt;&lt;/span&gt;
    &lt;a href=&#34;#step-1-update-env-file&#34; class=&#34;subheading-anchor&#34; aria-label=&#34;Permalink for this section&#34;&gt;&lt;/a&gt;&lt;/h4&gt;&lt;div class=&#34;hextra-code-block hx-relative hx-mt-6 first:hx-mt-0 hx-group/code&#34;&gt;

&lt;div&gt;&lt;pre&gt;&lt;code&gt;CAVALIBA_AUTH_MODE=forced
CAVALIBA_FORCE_LOGIN=admin&lt;/code&gt;&lt;/pre&gt;&lt;/div&gt;&lt;div class=&#34;hextra-code-copy-btn-container hx-opacity-0 hx-transition group-hover/code:hx-opacity-100 hx-flex hx-gap-1 hx-absolute hx-m-[11px] hx-right-0 hx-top-0&#34;&gt;
  &lt;button
    class=&#34;hextra-code-copy-btn hx-group/copybtn hx-transition-all active:hx-opacity-50 hx-bg-primary-700/5 hx-border hx-border-black/5 hx-text-gray-600 hover:hx-text-gray-900 hx-rounded-md hx-p-1.5 dark:hx-bg-primary-300/10 dark:hx-border-white/10 dark:hx-text-gray-400 dark:hover:hx-text-gray-50&#34;
    title=&#34;Copy code&#34;
  &gt;
    &lt;div class=&#34;copy-icon group-[.copied]/copybtn:hx-hidden hx-pointer-events-none hx-h-4 hx-w-4&#34;&gt;&lt;/div&gt;
    &lt;div class=&#34;success-icon hx-hidden group-[.copied]/copybtn:hx-block hx-pointer-events-none hx-h-4 hx-w-4&#34;&gt;&lt;/div&gt;
  &lt;/button&gt;
&lt;/div&gt;
&lt;/div&gt;
&lt;p&gt;Replace &lt;code&gt;admin&lt;/code&gt; with the username you want to auto-login.&lt;/p&gt;
&lt;h4&gt;Step 2: Comment Out Other Auth&lt;span class=&#34;hx-absolute -hx-mt-20&#34; id=&#34;step-2-comment-out-other-auth&#34;&gt;&lt;/span&gt;
    &lt;a href=&#34;#step-2-comment-out-other-auth&#34; class=&#34;subheading-anchor&#34; aria-label=&#34;Permalink for this section&#34;&gt;&lt;/a&gt;&lt;/h4&gt;&lt;ul&gt;
&lt;li&gt;Ensure OAUTH2 configuration is commented out in &lt;code&gt;nginx.conf&lt;/code&gt; and &lt;code&gt;docker-compose.yml&lt;/code&gt;&lt;/li&gt;
&lt;li&gt;Ensure basic authentication is commented out in &lt;code&gt;nginx.conf&lt;/code&gt;&lt;/li&gt;
&lt;/ul&gt;
&lt;h4&gt;Step 3: Restart Containers&lt;span class=&#34;hx-absolute -hx-mt-20&#34; id=&#34;step-3-restart-containers-1&#34;&gt;&lt;/span&gt;
    &lt;a href=&#34;#step-3-restart-containers-1&#34; class=&#34;subheading-anchor&#34; aria-label=&#34;Permalink for this section&#34;&gt;&lt;/a&gt;&lt;/h4&gt;&lt;div class=&#34;hextra-code-block hx-relative hx-mt-6 first:hx-mt-0 hx-group/code&#34;&gt;

&lt;div&gt;&lt;div class=&#34;highlight&#34;&gt;&lt;pre tabindex=&#34;0&#34; class=&#34;chroma&#34;&gt;&lt;code class=&#34;language-bash&#34; data-lang=&#34;bash&#34;&gt;&lt;span class=&#34;line&#34;&gt;&lt;span class=&#34;cl&#34;&gt;docker compose down
&lt;/span&gt;&lt;/span&gt;&lt;span class=&#34;line&#34;&gt;&lt;span class=&#34;cl&#34;&gt;docker compose up -d&lt;/span&gt;&lt;/span&gt;&lt;/code&gt;&lt;/pre&gt;&lt;/div&gt;&lt;/div&gt;&lt;div class=&#34;hextra-code-copy-btn-container hx-opacity-0 hx-transition group-hover/code:hx-opacity-100 hx-flex hx-gap-1 hx-absolute hx-m-[11px] hx-right-0 hx-top-0&#34;&gt;
  &lt;button
    class=&#34;hextra-code-copy-btn hx-group/copybtn hx-transition-all active:hx-opacity-50 hx-bg-primary-700/5 hx-border hx-border-black/5 hx-text-gray-600 hover:hx-text-gray-900 hx-rounded-md hx-p-1.5 dark:hx-bg-primary-300/10 dark:hx-border-white/10 dark:hx-text-gray-400 dark:hover:hx-text-gray-50&#34;
    title=&#34;Copy code&#34;
  &gt;
    &lt;div class=&#34;copy-icon group-[.copied]/copybtn:hx-hidden hx-pointer-events-none hx-h-4 hx-w-4&#34;&gt;&lt;/div&gt;
    &lt;div class=&#34;success-icon hx-hidden group-[.copied]/copybtn:hx-block hx-pointer-events-none hx-h-4 hx-w-4&#34;&gt;&lt;/div&gt;
  &lt;/button&gt;
&lt;/div&gt;
&lt;/div&gt;
&lt;h3&gt;Behavior&lt;span class=&#34;hx-absolute -hx-mt-20&#34; id=&#34;behavior&#34;&gt;&lt;/span&gt;
    &lt;a href=&#34;#behavior&#34; class=&#34;subheading-anchor&#34; aria-label=&#34;Permalink for this section&#34;&gt;&lt;/a&gt;&lt;/h3&gt;&lt;ul&gt;
&lt;li&gt;All requests are authenticated as the user specified in &lt;code&gt;CAVALIBA_FORCE_LOGIN&lt;/code&gt;&lt;/li&gt;
&lt;li&gt;No login form is displayed&lt;/li&gt;
&lt;li&gt;No logout button is functional&lt;/li&gt;
&lt;li&gt;Direct access to the application without authentication&lt;/li&gt;
&lt;/ul&gt;
&lt;h3&gt;Security Warning&lt;span class=&#34;hx-absolute -hx-mt-20&#34; id=&#34;security-warning&#34;&gt;&lt;/span&gt;
    &lt;a href=&#34;#security-warning&#34; class=&#34;subheading-anchor&#34; aria-label=&#34;Permalink for this section&#34;&gt;&lt;/a&gt;&lt;/h3&gt;&lt;p&gt;⚠️ &lt;strong&gt;DO NOT USE IN PRODUCTION&lt;/strong&gt;&lt;/p&gt;
&lt;p&gt;Do not use Forced Authentication in:&lt;/p&gt;
&lt;ul&gt;
&lt;li&gt;Shared networks&lt;/li&gt;
&lt;li&gt;QA/Test environments with sensitive data&lt;/li&gt;
&lt;li&gt;Production environments&lt;/li&gt;
&lt;li&gt;Any multi-user scenario&lt;/li&gt;
&lt;/ul&gt;
&lt;p&gt;This mode is intended &lt;strong&gt;only&lt;/strong&gt; for isolated development on a single machine.&lt;/p&gt;
&lt;hr&gt;
&lt;h2&gt;LDAP Authentication&lt;span class=&#34;hx-absolute -hx-mt-20&#34; id=&#34;ldap-authentication&#34;&gt;&lt;/span&gt;
    &lt;a href=&#34;#ldap-authentication&#34; class=&#34;subheading-anchor&#34; aria-label=&#34;Permalink for this section&#34;&gt;&lt;/a&gt;&lt;/h2&gt;&lt;h3&gt;Direct LDAP Support&lt;span class=&#34;hx-absolute -hx-mt-20&#34; id=&#34;direct-ldap-support&#34;&gt;&lt;/span&gt;
    &lt;a href=&#34;#direct-ldap-support&#34; class=&#34;subheading-anchor&#34; aria-label=&#34;Permalink for this section&#34;&gt;&lt;/a&gt;&lt;/h3&gt;&lt;p&gt;Cavaliba does &lt;strong&gt;not&lt;/strong&gt; provide direct LDAP authentication out of the box.&lt;/p&gt;
&lt;h3&gt;Indirect LDAP via Keycloak&lt;span class=&#34;hx-absolute -hx-mt-20&#34; id=&#34;indirect-ldap-via-keycloak&#34;&gt;&lt;/span&gt;
    &lt;a href=&#34;#indirect-ldap-via-keycloak&#34; class=&#34;subheading-anchor&#34; aria-label=&#34;Permalink for this section&#34;&gt;&lt;/a&gt;&lt;/h3&gt;&lt;p&gt;LDAP authentication can be achieved indirectly by using the &lt;strong&gt;OIDC/OAuth2 mode&lt;/strong&gt; (described below) with a local &lt;strong&gt;Keycloak Identity Provider&lt;/strong&gt; that connects to your LDAP directory.&lt;/p&gt;
&lt;p&gt;This approach provides:&lt;/p&gt;
&lt;ul&gt;
&lt;li&gt;Central LDAP directory authentication&lt;/li&gt;
&lt;li&gt;Keycloak&amp;rsquo;s additional features (MFA, user federation, etc.)&lt;/li&gt;
&lt;li&gt;Cavaliba&amp;rsquo;s role and permission management&lt;/li&gt;
&lt;/ul&gt;
&lt;h4&gt;Quick Setup Path&lt;span class=&#34;hx-absolute -hx-mt-20&#34; id=&#34;quick-setup-path&#34;&gt;&lt;/span&gt;
    &lt;a href=&#34;#quick-setup-path&#34; class=&#34;subheading-anchor&#34; aria-label=&#34;Permalink for this section&#34;&gt;&lt;/a&gt;&lt;/h4&gt;&lt;ol&gt;
&lt;li&gt;Deploy a Keycloak instance (Docker container or separate service)&lt;/li&gt;
&lt;li&gt;Configure Keycloak to use your LDAP directory as a User Federation&lt;/li&gt;
&lt;li&gt;Create a Cavaliba client/application in Keycloak&lt;/li&gt;
&lt;li&gt;Configure Cavaliba to use OAuth2 mode with Keycloak as the IdP&lt;/li&gt;
&lt;li&gt;See &lt;strong&gt;OIDC/SAML&lt;/strong&gt; section below for detailed OAuth2 configuration&lt;/li&gt;
&lt;/ol&gt;
&lt;h3&gt;Benefits of This Approach&lt;span class=&#34;hx-absolute -hx-mt-20&#34; id=&#34;benefits-of-this-approach&#34;&gt;&lt;/span&gt;
    &lt;a href=&#34;#benefits-of-this-approach&#34; class=&#34;subheading-anchor&#34; aria-label=&#34;Permalink for this section&#34;&gt;&lt;/a&gt;&lt;/h3&gt;&lt;ul&gt;
&lt;li&gt;&lt;strong&gt;Centralized authentication&lt;/strong&gt;: Users authenticate against existing LDAP directory (Active Directory, OpenLDAP, etc.)&lt;/li&gt;
&lt;li&gt;&lt;strong&gt;No duplicate password management&lt;/strong&gt;: Single source of truth for user credentials&lt;/li&gt;
&lt;li&gt;&lt;strong&gt;Enhanced security&lt;/strong&gt;: Keycloak can add MFA and other advanced features&lt;/li&gt;
&lt;li&gt;&lt;strong&gt;User federation&lt;/strong&gt;: Keycloak can sync user attributes from LDAP&lt;/li&gt;
&lt;li&gt;&lt;strong&gt;Flexible authorization&lt;/strong&gt;: Cavaliba handles role-based access control&lt;/li&gt;
&lt;/ul&gt;
&lt;hr&gt;
&lt;h2&gt;OIDC/SAML Authentication (OAuth2)&lt;span class=&#34;hx-absolute -hx-mt-20&#34; id=&#34;oidcsaml-authentication-oauth2&#34;&gt;&lt;/span&gt;
    &lt;a href=&#34;#oidcsaml-authentication-oauth2&#34; class=&#34;subheading-anchor&#34; aria-label=&#34;Permalink for this section&#34;&gt;&lt;/a&gt;&lt;/h2&gt;&lt;h3&gt;Overview&lt;span class=&#34;hx-absolute -hx-mt-20&#34; id=&#34;overview-3&#34;&gt;&lt;/span&gt;
    &lt;a href=&#34;#overview-3&#34; class=&#34;subheading-anchor&#34; aria-label=&#34;Permalink for this section&#34;&gt;&lt;/a&gt;&lt;/h3&gt;&lt;p&gt;OIDC (OpenID Connect) and SAML are &lt;strong&gt;external&lt;/strong&gt; authentication modes. Authentication is performed by an external Identity Provider (IdP) such as Keycloak, Okta, Microsoft Azure AD, Google, etc.&lt;/p&gt;
&lt;p&gt;Cavaliba uses the &lt;strong&gt;oauth2_proxy&lt;/strong&gt; companion container to handle the authentication protocol negotiation. The proxy authenticates the user with the IdP and then forwards the authenticated request to Cavaliba.&lt;/p&gt;
&lt;p&gt;&lt;strong&gt;Best for:&lt;/strong&gt; Large enterprise deployments, modern security practices, multi-factor authentication, federated identity management.&lt;/p&gt;
&lt;h3&gt;Supported Identity Providers&lt;span class=&#34;hx-absolute -hx-mt-20&#34; id=&#34;supported-identity-providers&#34;&gt;&lt;/span&gt;
    &lt;a href=&#34;#supported-identity-providers&#34; class=&#34;subheading-anchor&#34; aria-label=&#34;Permalink for this section&#34;&gt;&lt;/a&gt;&lt;/h3&gt;&lt;ul&gt;
&lt;li&gt;&lt;strong&gt;Keycloak&lt;/strong&gt; - Open-source, self-hosted identity platform&lt;/li&gt;
&lt;li&gt;&lt;strong&gt;Okta&lt;/strong&gt; - Commercial cloud-based IdP&lt;/li&gt;
&lt;li&gt;&lt;strong&gt;Microsoft Azure AD / Entra ID&lt;/strong&gt; - Microsoft&amp;rsquo;s identity service&lt;/li&gt;
&lt;li&gt;&lt;strong&gt;Google&lt;/strong&gt; - Gmail/Google Workspace accounts&lt;/li&gt;
&lt;li&gt;&lt;strong&gt;Auth0&lt;/strong&gt; - Commercial identity platform&lt;/li&gt;
&lt;li&gt;&lt;strong&gt;Other OIDC/SAML providers&lt;/strong&gt; - Any provider supporting standard protocols&lt;/li&gt;
&lt;/ul&gt;
&lt;h3&gt;Architecture&lt;span class=&#34;hx-absolute -hx-mt-20&#34; id=&#34;architecture&#34;&gt;&lt;/span&gt;
    &lt;a href=&#34;#architecture&#34; class=&#34;subheading-anchor&#34; aria-label=&#34;Permalink for this section&#34;&gt;&lt;/a&gt;&lt;/h3&gt;&lt;div class=&#34;hextra-code-block hx-relative hx-mt-6 first:hx-mt-0 hx-group/code&#34;&gt;

&lt;div&gt;&lt;pre&gt;&lt;code&gt;User Browser
    ↓
Nginx (Reverse Proxy)
    ↓
oauth2_proxy Container
    ↓
External Identity Provider (IdP)
    ↓ (authenticated, returns user info)
Cavaliba Application&lt;/code&gt;&lt;/pre&gt;&lt;/div&gt;&lt;div class=&#34;hextra-code-copy-btn-container hx-opacity-0 hx-transition group-hover/code:hx-opacity-100 hx-flex hx-gap-1 hx-absolute hx-m-[11px] hx-right-0 hx-top-0&#34;&gt;
  &lt;button
    class=&#34;hextra-code-copy-btn hx-group/copybtn hx-transition-all active:hx-opacity-50 hx-bg-primary-700/5 hx-border hx-border-black/5 hx-text-gray-600 hover:hx-text-gray-900 hx-rounded-md hx-p-1.5 dark:hx-bg-primary-300/10 dark:hx-border-white/10 dark:hx-text-gray-400 dark:hover:hx-text-gray-50&#34;
    title=&#34;Copy code&#34;
  &gt;
    &lt;div class=&#34;copy-icon group-[.copied]/copybtn:hx-hidden hx-pointer-events-none hx-h-4 hx-w-4&#34;&gt;&lt;/div&gt;
    &lt;div class=&#34;success-icon hx-hidden group-[.copied]/copybtn:hx-block hx-pointer-events-none hx-h-4 hx-w-4&#34;&gt;&lt;/div&gt;
  &lt;/button&gt;
&lt;/div&gt;
&lt;/div&gt;
&lt;p&gt;The oauth2_proxy container sits between the user and Cavaliba, handling all OAuth2/SAML protocol details.&lt;/p&gt;
&lt;h3&gt;Configuration Steps&lt;span class=&#34;hx-absolute -hx-mt-20&#34; id=&#34;configuration-steps&#34;&gt;&lt;/span&gt;
    &lt;a href=&#34;#configuration-steps&#34; class=&#34;subheading-anchor&#34; aria-label=&#34;Permalink for this section&#34;&gt;&lt;/a&gt;&lt;/h3&gt;&lt;h4&gt;Step 1: Register Cavaliba with Your Identity Provider&lt;span class=&#34;hx-absolute -hx-mt-20&#34; id=&#34;step-1-register-cavaliba-with-your-identity-provider&#34;&gt;&lt;/span&gt;
    &lt;a href=&#34;#step-1-register-cavaliba-with-your-identity-provider&#34; class=&#34;subheading-anchor&#34; aria-label=&#34;Permalink for this section&#34;&gt;&lt;/a&gt;&lt;/h4&gt;&lt;p&gt;Each IdP has a different process for registering applications. General steps:&lt;/p&gt;
&lt;ol&gt;
&lt;li&gt;Log in to your IdP admin console&lt;/li&gt;
&lt;li&gt;Create a new application or service provider&lt;/li&gt;
&lt;li&gt;Set &lt;strong&gt;Redirect URI&lt;/strong&gt; to: &lt;code&gt;https://cavaliba.your-domain.com/oauth2/callback&lt;/code&gt;&lt;/li&gt;
&lt;li&gt;Configure which user attributes are shared with Cavaliba&lt;/li&gt;
&lt;li&gt;Note the &lt;strong&gt;Client ID&lt;/strong&gt; and &lt;strong&gt;Client Secret&lt;/strong&gt; (or equivalent)&lt;/li&gt;
&lt;/ol&gt;
&lt;h4&gt;Step 2: Update .env File&lt;span class=&#34;hx-absolute -hx-mt-20&#34; id=&#34;step-2-update-env-file&#34;&gt;&lt;/span&gt;
    &lt;a href=&#34;#step-2-update-env-file&#34; class=&#34;subheading-anchor&#34; aria-label=&#34;Permalink for this section&#34;&gt;&lt;/a&gt;&lt;/h4&gt;&lt;p&gt;Create or update the OAuth2 configuration in &lt;code&gt;.env&lt;/code&gt;:&lt;/p&gt;
&lt;div class=&#34;hextra-code-block hx-relative hx-mt-6 first:hx-mt-0 hx-group/code&#34;&gt;

&lt;div&gt;&lt;pre&gt;&lt;code&gt;# Authentication mode
CAVALIBA_AUTH_MODE=oauth2

# Identity Provider selection
OAUTH2_PROXY_PROVIDER=&amp;#34;oidc&amp;#34;
OAUTH2_PROXY_PROVIDER_DISPLAY_NAME=&amp;#34;Your IdP Name&amp;#34;
OAUTH2_PROXY_OIDC_ISSUER_URL=&amp;#34;https://your-idp.com/path/to/realm&amp;#34;

# Application credentials from IdP
OAUTH2_PROXY_CLIENT_ID=&amp;#34;your-client-id&amp;#34;
OAUTH2_PROXY_CLIENT_SECRET=&amp;#34;your-client-secret&amp;#34;

# Session security
OAUTH2_PROXY_COOKIE_SECRET=&amp;#34;your-cookie-secret-min-24-chars&amp;#34;
OAUTH2_PROXY_REDIRECT_URL=&amp;#34;https://cavaliba.your-domain.com/oauth2/callback&amp;#34;

# Cookie settings
OAUTH2_PROXY_COOKIE_SECURE=&amp;#34;true&amp;#34;
OAUTH2_PROXY_COOKIE_HTTPONLY=&amp;#34;true&amp;#34;
OAUTH2_PROXY_COOKIE_SAMESITE=&amp;#34;lax&amp;#34;
OAUTH2_PROXY_COOKIE_EXPIRE=&amp;#34;0h45m0s&amp;#34;

# Session storage
OAUTH2_PROXY_SESSION_STORE_TYPE=&amp;#34;redis&amp;#34;
OAUTH2_PROXY_REDIS_CONNECTION_URL=&amp;#34;redis://cavaliba_redis:6379&amp;#34;

# Email domain restriction (optional)
OAUTH2_PROXY_EMAIL_DOMAINS=&amp;#34;company.com&amp;#34;&lt;/code&gt;&lt;/pre&gt;&lt;/div&gt;&lt;div class=&#34;hextra-code-copy-btn-container hx-opacity-0 hx-transition group-hover/code:hx-opacity-100 hx-flex hx-gap-1 hx-absolute hx-m-[11px] hx-right-0 hx-top-0&#34;&gt;
  &lt;button
    class=&#34;hextra-code-copy-btn hx-group/copybtn hx-transition-all active:hx-opacity-50 hx-bg-primary-700/5 hx-border hx-border-black/5 hx-text-gray-600 hover:hx-text-gray-900 hx-rounded-md hx-p-1.5 dark:hx-bg-primary-300/10 dark:hx-border-white/10 dark:hx-text-gray-400 dark:hover:hx-text-gray-50&#34;
    title=&#34;Copy code&#34;
  &gt;
    &lt;div class=&#34;copy-icon group-[.copied]/copybtn:hx-hidden hx-pointer-events-none hx-h-4 hx-w-4&#34;&gt;&lt;/div&gt;
    &lt;div class=&#34;success-icon hx-hidden group-[.copied]/copybtn:hx-block hx-pointer-events-none hx-h-4 hx-w-4&#34;&gt;&lt;/div&gt;
  &lt;/button&gt;
&lt;/div&gt;
&lt;/div&gt;
&lt;p&gt;&lt;strong&gt;See Docker Env Configuration page for complete OAuth2 options and details.&lt;/strong&gt;&lt;/p&gt;
&lt;h4&gt;Step 3: Update docker-compose.yml&lt;span class=&#34;hx-absolute -hx-mt-20&#34; id=&#34;step-3-update-docker-composeyml&#34;&gt;&lt;/span&gt;
    &lt;a href=&#34;#step-3-update-docker-composeyml&#34; class=&#34;subheading-anchor&#34; aria-label=&#34;Permalink for this section&#34;&gt;&lt;/a&gt;&lt;/h4&gt;&lt;p&gt;Uncomment the oauth2_proxy container block:&lt;/p&gt;
&lt;div class=&#34;hextra-code-block hx-relative hx-mt-6 first:hx-mt-0 hx-group/code&#34;&gt;

&lt;div&gt;&lt;div class=&#34;highlight&#34;&gt;&lt;pre tabindex=&#34;0&#34; class=&#34;chroma&#34;&gt;&lt;code class=&#34;language-yaml&#34; data-lang=&#34;yaml&#34;&gt;&lt;span class=&#34;line&#34;&gt;&lt;span class=&#34;cl&#34;&gt;&lt;span class=&#34;nt&#34;&gt;oauth2_proxy&lt;/span&gt;&lt;span class=&#34;p&#34;&gt;:&lt;/span&gt;&lt;span class=&#34;w&#34;&gt;
&lt;/span&gt;&lt;/span&gt;&lt;/span&gt;&lt;span class=&#34;line&#34;&gt;&lt;span class=&#34;cl&#34;&gt;&lt;span class=&#34;w&#34;&gt;  &lt;/span&gt;&lt;span class=&#34;nt&#34;&gt;image&lt;/span&gt;&lt;span class=&#34;p&#34;&gt;:&lt;/span&gt;&lt;span class=&#34;w&#34;&gt; &lt;/span&gt;&lt;span class=&#34;l&#34;&gt;quay.io/oauth2-proxy/oauth2-proxy:latest&lt;/span&gt;&lt;span class=&#34;w&#34;&gt;
&lt;/span&gt;&lt;/span&gt;&lt;/span&gt;&lt;span class=&#34;line&#34;&gt;&lt;span class=&#34;cl&#34;&gt;&lt;span class=&#34;w&#34;&gt;  &lt;/span&gt;&lt;span class=&#34;nt&#34;&gt;container_name&lt;/span&gt;&lt;span class=&#34;p&#34;&gt;:&lt;/span&gt;&lt;span class=&#34;w&#34;&gt; &lt;/span&gt;&lt;span class=&#34;l&#34;&gt;${CAVALIBA_TENANT}_oauth2&lt;/span&gt;&lt;span class=&#34;w&#34;&gt;
&lt;/span&gt;&lt;/span&gt;&lt;/span&gt;&lt;span class=&#34;line&#34;&gt;&lt;span class=&#34;cl&#34;&gt;&lt;span class=&#34;w&#34;&gt;  &lt;/span&gt;&lt;span class=&#34;nt&#34;&gt;networks&lt;/span&gt;&lt;span class=&#34;p&#34;&gt;:&lt;/span&gt;&lt;span class=&#34;w&#34;&gt;
&lt;/span&gt;&lt;/span&gt;&lt;/span&gt;&lt;span class=&#34;line&#34;&gt;&lt;span class=&#34;cl&#34;&gt;&lt;span class=&#34;w&#34;&gt;    &lt;/span&gt;- &lt;span class=&#34;l&#34;&gt;cavaliba_network&lt;/span&gt;&lt;span class=&#34;w&#34;&gt;
&lt;/span&gt;&lt;/span&gt;&lt;/span&gt;&lt;span class=&#34;line&#34;&gt;&lt;span class=&#34;cl&#34;&gt;&lt;span class=&#34;w&#34;&gt;  &lt;/span&gt;&lt;span class=&#34;nt&#34;&gt;ports&lt;/span&gt;&lt;span class=&#34;p&#34;&gt;:&lt;/span&gt;&lt;span class=&#34;w&#34;&gt;
&lt;/span&gt;&lt;/span&gt;&lt;/span&gt;&lt;span class=&#34;line&#34;&gt;&lt;span class=&#34;cl&#34;&gt;&lt;span class=&#34;w&#34;&gt;    &lt;/span&gt;- &lt;span class=&#34;s2&#34;&gt;&amp;#34;4180:4180&amp;#34;&lt;/span&gt;&lt;span class=&#34;w&#34;&gt;
&lt;/span&gt;&lt;/span&gt;&lt;/span&gt;&lt;span class=&#34;line&#34;&gt;&lt;span class=&#34;cl&#34;&gt;&lt;span class=&#34;w&#34;&gt;  &lt;/span&gt;&lt;span class=&#34;nt&#34;&gt;environment&lt;/span&gt;&lt;span class=&#34;p&#34;&gt;:&lt;/span&gt;&lt;span class=&#34;w&#34;&gt;
&lt;/span&gt;&lt;/span&gt;&lt;/span&gt;&lt;span class=&#34;line&#34;&gt;&lt;span class=&#34;cl&#34;&gt;&lt;span class=&#34;w&#34;&gt;    &lt;/span&gt;&lt;span class=&#34;nt&#34;&gt;OAUTH2_PROXY_PROVIDER&lt;/span&gt;&lt;span class=&#34;p&#34;&gt;:&lt;/span&gt;&lt;span class=&#34;w&#34;&gt; &lt;/span&gt;&lt;span class=&#34;l&#34;&gt;${OAUTH2_PROXY_PROVIDER}&lt;/span&gt;&lt;span class=&#34;w&#34;&gt;
&lt;/span&gt;&lt;/span&gt;&lt;/span&gt;&lt;span class=&#34;line&#34;&gt;&lt;span class=&#34;cl&#34;&gt;&lt;span class=&#34;w&#34;&gt;    &lt;/span&gt;&lt;span class=&#34;nt&#34;&gt;OAUTH2_PROXY_CLIENT_ID&lt;/span&gt;&lt;span class=&#34;p&#34;&gt;:&lt;/span&gt;&lt;span class=&#34;w&#34;&gt; &lt;/span&gt;&lt;span class=&#34;l&#34;&gt;${OAUTH2_PROXY_CLIENT_ID}&lt;/span&gt;&lt;span class=&#34;w&#34;&gt;
&lt;/span&gt;&lt;/span&gt;&lt;/span&gt;&lt;span class=&#34;line&#34;&gt;&lt;span class=&#34;cl&#34;&gt;&lt;span class=&#34;w&#34;&gt;    &lt;/span&gt;&lt;span class=&#34;nt&#34;&gt;OAUTH2_PROXY_CLIENT_SECRET&lt;/span&gt;&lt;span class=&#34;p&#34;&gt;:&lt;/span&gt;&lt;span class=&#34;w&#34;&gt; &lt;/span&gt;&lt;span class=&#34;l&#34;&gt;${OAUTH2_PROXY_CLIENT_SECRET}&lt;/span&gt;&lt;span class=&#34;w&#34;&gt;
&lt;/span&gt;&lt;/span&gt;&lt;/span&gt;&lt;span class=&#34;line&#34;&gt;&lt;span class=&#34;cl&#34;&gt;&lt;span class=&#34;w&#34;&gt;    &lt;/span&gt;&lt;span class=&#34;c&#34;&gt;# ... other settings from .env ...&lt;/span&gt;&lt;span class=&#34;w&#34;&gt;
&lt;/span&gt;&lt;/span&gt;&lt;/span&gt;&lt;span class=&#34;line&#34;&gt;&lt;span class=&#34;cl&#34;&gt;&lt;span class=&#34;w&#34;&gt;  &lt;/span&gt;&lt;span class=&#34;nt&#34;&gt;depends_on&lt;/span&gt;&lt;span class=&#34;p&#34;&gt;:&lt;/span&gt;&lt;span class=&#34;w&#34;&gt;
&lt;/span&gt;&lt;/span&gt;&lt;/span&gt;&lt;span class=&#34;line&#34;&gt;&lt;span class=&#34;cl&#34;&gt;&lt;span class=&#34;w&#34;&gt;    &lt;/span&gt;- &lt;span class=&#34;l&#34;&gt;redis&lt;/span&gt;&lt;/span&gt;&lt;/span&gt;&lt;/code&gt;&lt;/pre&gt;&lt;/div&gt;&lt;/div&gt;&lt;div class=&#34;hextra-code-copy-btn-container hx-opacity-0 hx-transition group-hover/code:hx-opacity-100 hx-flex hx-gap-1 hx-absolute hx-m-[11px] hx-right-0 hx-top-0&#34;&gt;
  &lt;button
    class=&#34;hextra-code-copy-btn hx-group/copybtn hx-transition-all active:hx-opacity-50 hx-bg-primary-700/5 hx-border hx-border-black/5 hx-text-gray-600 hover:hx-text-gray-900 hx-rounded-md hx-p-1.5 dark:hx-bg-primary-300/10 dark:hx-border-white/10 dark:hx-text-gray-400 dark:hover:hx-text-gray-50&#34;
    title=&#34;Copy code&#34;
  &gt;
    &lt;div class=&#34;copy-icon group-[.copied]/copybtn:hx-hidden hx-pointer-events-none hx-h-4 hx-w-4&#34;&gt;&lt;/div&gt;
    &lt;div class=&#34;success-icon hx-hidden group-[.copied]/copybtn:hx-block hx-pointer-events-none hx-h-4 hx-w-4&#34;&gt;&lt;/div&gt;
  &lt;/button&gt;
&lt;/div&gt;
&lt;/div&gt;
&lt;h4&gt;Step 4: Update nginx.conf&lt;span class=&#34;hx-absolute -hx-mt-20&#34; id=&#34;step-4-update-nginxconf&#34;&gt;&lt;/span&gt;
    &lt;a href=&#34;#step-4-update-nginxconf&#34; class=&#34;subheading-anchor&#34; aria-label=&#34;Permalink for this section&#34;&gt;&lt;/a&gt;&lt;/h4&gt;&lt;p&gt;Comment out Basic Auth configuration and uncomment OAuth2 Proxy configuration:&lt;/p&gt;
&lt;div class=&#34;hextra-code-block hx-relative hx-mt-6 first:hx-mt-0 hx-group/code&#34;&gt;

&lt;div&gt;&lt;div class=&#34;highlight&#34;&gt;&lt;pre tabindex=&#34;0&#34; class=&#34;chroma&#34;&gt;&lt;code class=&#34;language-nginx&#34; data-lang=&#34;nginx&#34;&gt;&lt;span class=&#34;line&#34;&gt;&lt;span class=&#34;cl&#34;&gt;&lt;span class=&#34;k&#34;&gt;location&lt;/span&gt; &lt;span class=&#34;s&#34;&gt;/&lt;/span&gt; &lt;span class=&#34;p&#34;&gt;{&lt;/span&gt;
&lt;/span&gt;&lt;/span&gt;&lt;span class=&#34;line&#34;&gt;&lt;span class=&#34;cl&#34;&gt;    &lt;span class=&#34;c1&#34;&gt;# Comment out basic auth:
&lt;/span&gt;&lt;/span&gt;&lt;/span&gt;&lt;span class=&#34;line&#34;&gt;&lt;span class=&#34;cl&#34;&gt;&lt;span class=&#34;c1&#34;&gt;&lt;/span&gt;    &lt;span class=&#34;c1&#34;&gt;# auth_basic &amp;#34;Cavaliba&amp;#34;;
&lt;/span&gt;&lt;/span&gt;&lt;/span&gt;&lt;span class=&#34;line&#34;&gt;&lt;span class=&#34;cl&#34;&gt;&lt;span class=&#34;c1&#34;&gt;&lt;/span&gt;    &lt;span class=&#34;c1&#34;&gt;# auth_basic_user_file ...
&lt;/span&gt;&lt;/span&gt;&lt;/span&gt;&lt;span class=&#34;line&#34;&gt;&lt;span class=&#34;cl&#34;&gt;&lt;span class=&#34;c1&#34;&gt;&lt;/span&gt;
&lt;/span&gt;&lt;/span&gt;&lt;span class=&#34;line&#34;&gt;&lt;span class=&#34;cl&#34;&gt;    &lt;span class=&#34;c1&#34;&gt;# Uncomment OAuth2 proxy:
&lt;/span&gt;&lt;/span&gt;&lt;/span&gt;&lt;span class=&#34;line&#34;&gt;&lt;span class=&#34;cl&#34;&gt;&lt;span class=&#34;c1&#34;&gt;&lt;/span&gt;    &lt;span class=&#34;kn&#34;&gt;auth_request&lt;/span&gt; &lt;span class=&#34;s&#34;&gt;/oauth2/auth&lt;/span&gt;&lt;span class=&#34;p&#34;&gt;;&lt;/span&gt;
&lt;/span&gt;&lt;/span&gt;&lt;span class=&#34;line&#34;&gt;&lt;span class=&#34;cl&#34;&gt;    &lt;span class=&#34;kn&#34;&gt;error_page&lt;/span&gt; &lt;span class=&#34;mi&#34;&gt;401&lt;/span&gt; &lt;span class=&#34;p&#34;&gt;=&lt;/span&gt;&lt;span class=&#34;mi&#34;&gt;302&lt;/span&gt; &lt;span class=&#34;s&#34;&gt;/oauth2/sign_in&lt;/span&gt;&lt;span class=&#34;p&#34;&gt;;&lt;/span&gt;
&lt;/span&gt;&lt;/span&gt;&lt;span class=&#34;line&#34;&gt;&lt;span class=&#34;cl&#34;&gt;
&lt;/span&gt;&lt;/span&gt;&lt;span class=&#34;line&#34;&gt;&lt;span class=&#34;cl&#34;&gt;    &lt;span class=&#34;c1&#34;&gt;# Pass OAuth2 headers to backend:
&lt;/span&gt;&lt;/span&gt;&lt;/span&gt;&lt;span class=&#34;line&#34;&gt;&lt;span class=&#34;cl&#34;&gt;&lt;span class=&#34;c1&#34;&gt;&lt;/span&gt;    &lt;span class=&#34;kn&#34;&gt;auth_request_set&lt;/span&gt; &lt;span class=&#34;nv&#34;&gt;$user&lt;/span&gt;   &lt;span class=&#34;nv&#34;&gt;$upstream_http_x_auth_request_preferred_username&lt;/span&gt;&lt;span class=&#34;p&#34;&gt;;&lt;/span&gt;
&lt;/span&gt;&lt;/span&gt;&lt;span class=&#34;line&#34;&gt;&lt;span class=&#34;cl&#34;&gt;    &lt;span class=&#34;kn&#34;&gt;auth_request_set&lt;/span&gt; &lt;span class=&#34;nv&#34;&gt;$email&lt;/span&gt;  &lt;span class=&#34;nv&#34;&gt;$upstream_http_x_auth_request_mail&lt;/span&gt;&lt;span class=&#34;p&#34;&gt;;&lt;/span&gt;
&lt;/span&gt;&lt;/span&gt;&lt;span class=&#34;line&#34;&gt;&lt;span class=&#34;cl&#34;&gt;
&lt;/span&gt;&lt;/span&gt;&lt;span class=&#34;line&#34;&gt;&lt;span class=&#34;cl&#34;&gt;    &lt;span class=&#34;kn&#34;&gt;proxy_set_header&lt;/span&gt; &lt;span class=&#34;s&#34;&gt;X-User&lt;/span&gt; &lt;span class=&#34;nv&#34;&gt;$user&lt;/span&gt;&lt;span class=&#34;p&#34;&gt;;&lt;/span&gt;
&lt;/span&gt;&lt;/span&gt;&lt;span class=&#34;line&#34;&gt;&lt;span class=&#34;cl&#34;&gt;    &lt;span class=&#34;kn&#34;&gt;proxy_set_header&lt;/span&gt; &lt;span class=&#34;s&#34;&gt;X-Email&lt;/span&gt; &lt;span class=&#34;nv&#34;&gt;$email&lt;/span&gt;&lt;span class=&#34;p&#34;&gt;;&lt;/span&gt;
&lt;/span&gt;&lt;/span&gt;&lt;span class=&#34;line&#34;&gt;&lt;span class=&#34;cl&#34;&gt;
&lt;/span&gt;&lt;/span&gt;&lt;span class=&#34;line&#34;&gt;&lt;span class=&#34;cl&#34;&gt;    &lt;span class=&#34;kn&#34;&gt;proxy_pass&lt;/span&gt; &lt;span class=&#34;s&#34;&gt;http://cavaliba_app:8001&lt;/span&gt;&lt;span class=&#34;p&#34;&gt;;&lt;/span&gt;
&lt;/span&gt;&lt;/span&gt;&lt;span class=&#34;line&#34;&gt;&lt;span class=&#34;cl&#34;&gt;    &lt;span class=&#34;c1&#34;&gt;# ... other proxy settings ...
&lt;/span&gt;&lt;/span&gt;&lt;/span&gt;&lt;span class=&#34;line&#34;&gt;&lt;span class=&#34;cl&#34;&gt;&lt;span class=&#34;c1&#34;&gt;&lt;/span&gt;&lt;span class=&#34;p&#34;&gt;}&lt;/span&gt;
&lt;/span&gt;&lt;/span&gt;&lt;span class=&#34;line&#34;&gt;&lt;span class=&#34;cl&#34;&gt;
&lt;/span&gt;&lt;/span&gt;&lt;span class=&#34;line&#34;&gt;&lt;span class=&#34;cl&#34;&gt;&lt;span class=&#34;k&#34;&gt;location&lt;/span&gt; &lt;span class=&#34;s&#34;&gt;/oauth2/&lt;/span&gt; &lt;span class=&#34;p&#34;&gt;{&lt;/span&gt;
&lt;/span&gt;&lt;/span&gt;&lt;span class=&#34;line&#34;&gt;&lt;span class=&#34;cl&#34;&gt;    &lt;span class=&#34;kn&#34;&gt;proxy_pass&lt;/span&gt; &lt;span class=&#34;s&#34;&gt;http://oauth2_proxy:4180&lt;/span&gt;&lt;span class=&#34;p&#34;&gt;;&lt;/span&gt;
&lt;/span&gt;&lt;/span&gt;&lt;span class=&#34;line&#34;&gt;&lt;span class=&#34;cl&#34;&gt;    &lt;span class=&#34;kn&#34;&gt;proxy_set_header&lt;/span&gt; &lt;span class=&#34;s&#34;&gt;Host&lt;/span&gt; &lt;span class=&#34;nv&#34;&gt;$host&lt;/span&gt;&lt;span class=&#34;p&#34;&gt;;&lt;/span&gt;
&lt;/span&gt;&lt;/span&gt;&lt;span class=&#34;line&#34;&gt;&lt;span class=&#34;cl&#34;&gt;    &lt;span class=&#34;kn&#34;&gt;proxy_set_header&lt;/span&gt; &lt;span class=&#34;s&#34;&gt;X-Real-IP&lt;/span&gt; &lt;span class=&#34;nv&#34;&gt;$remote_addr&lt;/span&gt;&lt;span class=&#34;p&#34;&gt;;&lt;/span&gt;
&lt;/span&gt;&lt;/span&gt;&lt;span class=&#34;line&#34;&gt;&lt;span class=&#34;cl&#34;&gt;&lt;span class=&#34;p&#34;&gt;}&lt;/span&gt;&lt;/span&gt;&lt;/span&gt;&lt;/code&gt;&lt;/pre&gt;&lt;/div&gt;&lt;/div&gt;&lt;div class=&#34;hextra-code-copy-btn-container hx-opacity-0 hx-transition group-hover/code:hx-opacity-100 hx-flex hx-gap-1 hx-absolute hx-m-[11px] hx-right-0 hx-top-0&#34;&gt;
  &lt;button
    class=&#34;hextra-code-copy-btn hx-group/copybtn hx-transition-all active:hx-opacity-50 hx-bg-primary-700/5 hx-border hx-border-black/5 hx-text-gray-600 hover:hx-text-gray-900 hx-rounded-md hx-p-1.5 dark:hx-bg-primary-300/10 dark:hx-border-white/10 dark:hx-text-gray-400 dark:hover:hx-text-gray-50&#34;
    title=&#34;Copy code&#34;
  &gt;
    &lt;div class=&#34;copy-icon group-[.copied]/copybtn:hx-hidden hx-pointer-events-none hx-h-4 hx-w-4&#34;&gt;&lt;/div&gt;
    &lt;div class=&#34;success-icon hx-hidden group-[.copied]/copybtn:hx-block hx-pointer-events-none hx-h-4 hx-w-4&#34;&gt;&lt;/div&gt;
  &lt;/button&gt;
&lt;/div&gt;
&lt;/div&gt;
&lt;h4&gt;Step 5: Ensure Users Exist in Cavaliba&lt;span class=&#34;hx-absolute -hx-mt-20&#34; id=&#34;step-5-ensure-users-exist-in-cavaliba&#34;&gt;&lt;/span&gt;
    &lt;a href=&#34;#step-5-ensure-users-exist-in-cavaliba&#34; class=&#34;subheading-anchor&#34; aria-label=&#34;Permalink for this section&#34;&gt;&lt;/a&gt;&lt;/h4&gt;&lt;p&gt;Before login attempts, provision users in Cavaliba:&lt;/p&gt;
&lt;div class=&#34;hextra-code-block hx-relative hx-mt-6 first:hx-mt-0 hx-group/code&#34;&gt;

&lt;div&gt;&lt;div class=&#34;highlight&#34;&gt;&lt;pre tabindex=&#34;0&#34; class=&#34;chroma&#34;&gt;&lt;code class=&#34;language-bash&#34; data-lang=&#34;bash&#34;&gt;&lt;span class=&#34;line&#34;&gt;&lt;span class=&#34;cl&#34;&gt;docker &lt;span class=&#34;nb&#34;&gt;exec&lt;/span&gt; -it cavaliba_app python manage.py shell&lt;/span&gt;&lt;/span&gt;&lt;/code&gt;&lt;/pre&gt;&lt;/div&gt;&lt;/div&gt;&lt;div class=&#34;hextra-code-copy-btn-container hx-opacity-0 hx-transition group-hover/code:hx-opacity-100 hx-flex hx-gap-1 hx-absolute hx-m-[11px] hx-right-0 hx-top-0&#34;&gt;
  &lt;button
    class=&#34;hextra-code-copy-btn hx-group/copybtn hx-transition-all active:hx-opacity-50 hx-bg-primary-700/5 hx-border hx-border-black/5 hx-text-gray-600 hover:hx-text-gray-900 hx-rounded-md hx-p-1.5 dark:hx-bg-primary-300/10 dark:hx-border-white/10 dark:hx-text-gray-400 dark:hover:hx-text-gray-50&#34;
    title=&#34;Copy code&#34;
  &gt;
    &lt;div class=&#34;copy-icon group-[.copied]/copybtn:hx-hidden hx-pointer-events-none hx-h-4 hx-w-4&#34;&gt;&lt;/div&gt;
    &lt;div class=&#34;success-icon hx-hidden group-[.copied]/copybtn:hx-block hx-pointer-events-none hx-h-4 hx-w-4&#34;&gt;&lt;/div&gt;
  &lt;/button&gt;
&lt;/div&gt;
&lt;/div&gt;
&lt;div class=&#34;hextra-code-block hx-relative hx-mt-6 first:hx-mt-0 hx-group/code&#34;&gt;

&lt;div&gt;&lt;div class=&#34;highlight&#34;&gt;&lt;pre tabindex=&#34;0&#34; class=&#34;chroma&#34;&gt;&lt;code class=&#34;language-python&#34; data-lang=&#34;python&#34;&gt;&lt;span class=&#34;line&#34;&gt;&lt;span class=&#34;cl&#34;&gt;&lt;span class=&#34;kn&#34;&gt;from&lt;/span&gt; &lt;span class=&#34;nn&#34;&gt;app_user.models&lt;/span&gt; &lt;span class=&#34;kn&#34;&gt;import&lt;/span&gt; &lt;span class=&#34;n&#34;&gt;SireneUser&lt;/span&gt;
&lt;/span&gt;&lt;/span&gt;&lt;span class=&#34;line&#34;&gt;&lt;span class=&#34;cl&#34;&gt;
&lt;/span&gt;&lt;/span&gt;&lt;span class=&#34;line&#34;&gt;&lt;span class=&#34;cl&#34;&gt;&lt;span class=&#34;n&#34;&gt;user&lt;/span&gt; &lt;span class=&#34;o&#34;&gt;=&lt;/span&gt; &lt;span class=&#34;n&#34;&gt;SireneUser&lt;/span&gt;&lt;span class=&#34;o&#34;&gt;.&lt;/span&gt;&lt;span class=&#34;n&#34;&gt;objects&lt;/span&gt;&lt;span class=&#34;o&#34;&gt;.&lt;/span&gt;&lt;span class=&#34;n&#34;&gt;create_user&lt;/span&gt;&lt;span class=&#34;p&#34;&gt;(&lt;/span&gt;
&lt;/span&gt;&lt;/span&gt;&lt;span class=&#34;line&#34;&gt;&lt;span class=&#34;cl&#34;&gt;    &lt;span class=&#34;n&#34;&gt;username&lt;/span&gt;&lt;span class=&#34;o&#34;&gt;=&lt;/span&gt;&lt;span class=&#34;s2&#34;&gt;&amp;#34;john.smith&amp;#34;&lt;/span&gt;&lt;span class=&#34;p&#34;&gt;,&lt;/span&gt;
&lt;/span&gt;&lt;/span&gt;&lt;span class=&#34;line&#34;&gt;&lt;span class=&#34;cl&#34;&gt;    &lt;span class=&#34;n&#34;&gt;email&lt;/span&gt;&lt;span class=&#34;o&#34;&gt;=&lt;/span&gt;&lt;span class=&#34;s2&#34;&gt;&amp;#34;john.smith@company.com&amp;#34;&lt;/span&gt;
&lt;/span&gt;&lt;/span&gt;&lt;span class=&#34;line&#34;&gt;&lt;span class=&#34;cl&#34;&gt;&lt;span class=&#34;p&#34;&gt;)&lt;/span&gt;
&lt;/span&gt;&lt;/span&gt;&lt;span class=&#34;line&#34;&gt;&lt;span class=&#34;cl&#34;&gt;&lt;span class=&#34;n&#34;&gt;user&lt;/span&gt;&lt;span class=&#34;o&#34;&gt;.&lt;/span&gt;&lt;span class=&#34;n&#34;&gt;save&lt;/span&gt;&lt;span class=&#34;p&#34;&gt;()&lt;/span&gt;&lt;/span&gt;&lt;/span&gt;&lt;/code&gt;&lt;/pre&gt;&lt;/div&gt;&lt;/div&gt;&lt;div class=&#34;hextra-code-copy-btn-container hx-opacity-0 hx-transition group-hover/code:hx-opacity-100 hx-flex hx-gap-1 hx-absolute hx-m-[11px] hx-right-0 hx-top-0&#34;&gt;
  &lt;button
    class=&#34;hextra-code-copy-btn hx-group/copybtn hx-transition-all active:hx-opacity-50 hx-bg-primary-700/5 hx-border hx-border-black/5 hx-text-gray-600 hover:hx-text-gray-900 hx-rounded-md hx-p-1.5 dark:hx-bg-primary-300/10 dark:hx-border-white/10 dark:hx-text-gray-400 dark:hover:hx-text-gray-50&#34;
    title=&#34;Copy code&#34;
  &gt;
    &lt;div class=&#34;copy-icon group-[.copied]/copybtn:hx-hidden hx-pointer-events-none hx-h-4 hx-w-4&#34;&gt;&lt;/div&gt;
    &lt;div class=&#34;success-icon hx-hidden group-[.copied]/copybtn:hx-block hx-pointer-events-none hx-h-4 hx-w-4&#34;&gt;&lt;/div&gt;
  &lt;/button&gt;
&lt;/div&gt;
&lt;/div&gt;
&lt;p&gt;Or create users manually in Cavaliba admin after first OAuth2 login (if auto-provisioning is enabled).&lt;/p&gt;
&lt;h4&gt;Step 6: Restart Containers&lt;span class=&#34;hx-absolute -hx-mt-20&#34; id=&#34;step-6-restart-containers&#34;&gt;&lt;/span&gt;
    &lt;a href=&#34;#step-6-restart-containers&#34; class=&#34;subheading-anchor&#34; aria-label=&#34;Permalink for this section&#34;&gt;&lt;/a&gt;&lt;/h4&gt;&lt;div class=&#34;hextra-code-block hx-relative hx-mt-6 first:hx-mt-0 hx-group/code&#34;&gt;

&lt;div&gt;&lt;div class=&#34;highlight&#34;&gt;&lt;pre tabindex=&#34;0&#34; class=&#34;chroma&#34;&gt;&lt;code class=&#34;language-bash&#34; data-lang=&#34;bash&#34;&gt;&lt;span class=&#34;line&#34;&gt;&lt;span class=&#34;cl&#34;&gt;docker compose down
&lt;/span&gt;&lt;/span&gt;&lt;span class=&#34;line&#34;&gt;&lt;span class=&#34;cl&#34;&gt;docker compose up -d&lt;/span&gt;&lt;/span&gt;&lt;/code&gt;&lt;/pre&gt;&lt;/div&gt;&lt;/div&gt;&lt;div class=&#34;hextra-code-copy-btn-container hx-opacity-0 hx-transition group-hover/code:hx-opacity-100 hx-flex hx-gap-1 hx-absolute hx-m-[11px] hx-right-0 hx-top-0&#34;&gt;
  &lt;button
    class=&#34;hextra-code-copy-btn hx-group/copybtn hx-transition-all active:hx-opacity-50 hx-bg-primary-700/5 hx-border hx-border-black/5 hx-text-gray-600 hover:hx-text-gray-900 hx-rounded-md hx-p-1.5 dark:hx-bg-primary-300/10 dark:hx-border-white/10 dark:hx-text-gray-400 dark:hover:hx-text-gray-50&#34;
    title=&#34;Copy code&#34;
  &gt;
    &lt;div class=&#34;copy-icon group-[.copied]/copybtn:hx-hidden hx-pointer-events-none hx-h-4 hx-w-4&#34;&gt;&lt;/div&gt;
    &lt;div class=&#34;success-icon hx-hidden group-[.copied]/copybtn:hx-block hx-pointer-events-none hx-h-4 hx-w-4&#34;&gt;&lt;/div&gt;
  &lt;/button&gt;
&lt;/div&gt;
&lt;/div&gt;
&lt;h3&gt;Example Configurations&lt;span class=&#34;hx-absolute -hx-mt-20&#34; id=&#34;example-configurations&#34;&gt;&lt;/span&gt;
    &lt;a href=&#34;#example-configurations&#34; class=&#34;subheading-anchor&#34; aria-label=&#34;Permalink for this section&#34;&gt;&lt;/a&gt;&lt;/h3&gt;&lt;h4&gt;Keycloak (Self-Hosted)&lt;span class=&#34;hx-absolute -hx-mt-20&#34; id=&#34;keycloak-self-hosted&#34;&gt;&lt;/span&gt;
    &lt;a href=&#34;#keycloak-self-hosted&#34; class=&#34;subheading-anchor&#34; aria-label=&#34;Permalink for this section&#34;&gt;&lt;/a&gt;&lt;/h4&gt;&lt;div class=&#34;hextra-code-block hx-relative hx-mt-6 first:hx-mt-0 hx-group/code&#34;&gt;

&lt;div&gt;&lt;div class=&#34;highlight&#34;&gt;&lt;pre tabindex=&#34;0&#34; class=&#34;chroma&#34;&gt;&lt;code class=&#34;language-bash&#34; data-lang=&#34;bash&#34;&gt;&lt;span class=&#34;line&#34;&gt;&lt;span class=&#34;cl&#34;&gt;&lt;span class=&#34;c1&#34;&gt;# .env&lt;/span&gt;
&lt;/span&gt;&lt;/span&gt;&lt;span class=&#34;line&#34;&gt;&lt;span class=&#34;cl&#34;&gt;&lt;span class=&#34;nv&#34;&gt;OAUTH2_PROXY_PROVIDER&lt;/span&gt;&lt;span class=&#34;o&#34;&gt;=&lt;/span&gt;&lt;span class=&#34;s2&#34;&gt;&amp;#34;keycloak-oidc&amp;#34;&lt;/span&gt;
&lt;/span&gt;&lt;/span&gt;&lt;span class=&#34;line&#34;&gt;&lt;span class=&#34;cl&#34;&gt;&lt;span class=&#34;nv&#34;&gt;OAUTH2_PROXY_PROVIDER_DISPLAY_NAME&lt;/span&gt;&lt;span class=&#34;o&#34;&gt;=&lt;/span&gt;&lt;span class=&#34;s2&#34;&gt;&amp;#34;Keycloak&amp;#34;&lt;/span&gt;
&lt;/span&gt;&lt;/span&gt;&lt;span class=&#34;line&#34;&gt;&lt;span class=&#34;cl&#34;&gt;&lt;span class=&#34;nv&#34;&gt;OAUTH2_PROXY_OIDC_ISSUER_URL&lt;/span&gt;&lt;span class=&#34;o&#34;&gt;=&lt;/span&gt;&lt;span class=&#34;s2&#34;&gt;&amp;#34;https://keycloak.example.com/realms/cavaliba&amp;#34;&lt;/span&gt;
&lt;/span&gt;&lt;/span&gt;&lt;span class=&#34;line&#34;&gt;&lt;span class=&#34;cl&#34;&gt;&lt;span class=&#34;nv&#34;&gt;OAUTH2_PROXY_CLIENT_ID&lt;/span&gt;&lt;span class=&#34;o&#34;&gt;=&lt;/span&gt;&lt;span class=&#34;s2&#34;&gt;&amp;#34;cavaliba-client&amp;#34;&lt;/span&gt;
&lt;/span&gt;&lt;/span&gt;&lt;span class=&#34;line&#34;&gt;&lt;span class=&#34;cl&#34;&gt;&lt;span class=&#34;nv&#34;&gt;OAUTH2_PROXY_CLIENT_SECRET&lt;/span&gt;&lt;span class=&#34;o&#34;&gt;=&lt;/span&gt;&lt;span class=&#34;s2&#34;&gt;&amp;#34;your-client-secret-from-keycloak&amp;#34;&lt;/span&gt;
&lt;/span&gt;&lt;/span&gt;&lt;span class=&#34;line&#34;&gt;&lt;span class=&#34;cl&#34;&gt;&lt;span class=&#34;nv&#34;&gt;OAUTH2_PROXY_COOKIE_SECRET&lt;/span&gt;&lt;span class=&#34;o&#34;&gt;=&lt;/span&gt;&lt;span class=&#34;s2&#34;&gt;&amp;#34;generate-with-python-secrets&amp;#34;&lt;/span&gt;
&lt;/span&gt;&lt;/span&gt;&lt;span class=&#34;line&#34;&gt;&lt;span class=&#34;cl&#34;&gt;&lt;span class=&#34;nv&#34;&gt;OAUTH2_PROXY_REDIRECT_URL&lt;/span&gt;&lt;span class=&#34;o&#34;&gt;=&lt;/span&gt;&lt;span class=&#34;s2&#34;&gt;&amp;#34;https://cavaliba.example.com/oauth2/callback&amp;#34;&lt;/span&gt;&lt;/span&gt;&lt;/span&gt;&lt;/code&gt;&lt;/pre&gt;&lt;/div&gt;&lt;/div&gt;&lt;div class=&#34;hextra-code-copy-btn-container hx-opacity-0 hx-transition group-hover/code:hx-opacity-100 hx-flex hx-gap-1 hx-absolute hx-m-[11px] hx-right-0 hx-top-0&#34;&gt;
  &lt;button
    class=&#34;hextra-code-copy-btn hx-group/copybtn hx-transition-all active:hx-opacity-50 hx-bg-primary-700/5 hx-border hx-border-black/5 hx-text-gray-600 hover:hx-text-gray-900 hx-rounded-md hx-p-1.5 dark:hx-bg-primary-300/10 dark:hx-border-white/10 dark:hx-text-gray-400 dark:hover:hx-text-gray-50&#34;
    title=&#34;Copy code&#34;
  &gt;
    &lt;div class=&#34;copy-icon group-[.copied]/copybtn:hx-hidden hx-pointer-events-none hx-h-4 hx-w-4&#34;&gt;&lt;/div&gt;
    &lt;div class=&#34;success-icon hx-hidden group-[.copied]/copybtn:hx-block hx-pointer-events-none hx-h-4 hx-w-4&#34;&gt;&lt;/div&gt;
  &lt;/button&gt;
&lt;/div&gt;
&lt;/div&gt;
&lt;h4&gt;Okta&lt;span class=&#34;hx-absolute -hx-mt-20&#34; id=&#34;okta&#34;&gt;&lt;/span&gt;
    &lt;a href=&#34;#okta&#34; class=&#34;subheading-anchor&#34; aria-label=&#34;Permalink for this section&#34;&gt;&lt;/a&gt;&lt;/h4&gt;&lt;div class=&#34;hextra-code-block hx-relative hx-mt-6 first:hx-mt-0 hx-group/code&#34;&gt;

&lt;div&gt;&lt;div class=&#34;highlight&#34;&gt;&lt;pre tabindex=&#34;0&#34; class=&#34;chroma&#34;&gt;&lt;code class=&#34;language-bash&#34; data-lang=&#34;bash&#34;&gt;&lt;span class=&#34;line&#34;&gt;&lt;span class=&#34;cl&#34;&gt;&lt;span class=&#34;c1&#34;&gt;# .env&lt;/span&gt;
&lt;/span&gt;&lt;/span&gt;&lt;span class=&#34;line&#34;&gt;&lt;span class=&#34;cl&#34;&gt;&lt;span class=&#34;nv&#34;&gt;OAUTH2_PROXY_PROVIDER&lt;/span&gt;&lt;span class=&#34;o&#34;&gt;=&lt;/span&gt;&lt;span class=&#34;s2&#34;&gt;&amp;#34;oidc&amp;#34;&lt;/span&gt;
&lt;/span&gt;&lt;/span&gt;&lt;span class=&#34;line&#34;&gt;&lt;span class=&#34;cl&#34;&gt;&lt;span class=&#34;nv&#34;&gt;OAUTH2_PROXY_PROVIDER_DISPLAY_NAME&lt;/span&gt;&lt;span class=&#34;o&#34;&gt;=&lt;/span&gt;&lt;span class=&#34;s2&#34;&gt;&amp;#34;Okta&amp;#34;&lt;/span&gt;
&lt;/span&gt;&lt;/span&gt;&lt;span class=&#34;line&#34;&gt;&lt;span class=&#34;cl&#34;&gt;&lt;span class=&#34;nv&#34;&gt;OAUTH2_PROXY_OIDC_ISSUER_URL&lt;/span&gt;&lt;span class=&#34;o&#34;&gt;=&lt;/span&gt;&lt;span class=&#34;s2&#34;&gt;&amp;#34;https://your-okta-domain.okta.com&amp;#34;&lt;/span&gt;
&lt;/span&gt;&lt;/span&gt;&lt;span class=&#34;line&#34;&gt;&lt;span class=&#34;cl&#34;&gt;&lt;span class=&#34;nv&#34;&gt;OAUTH2_PROXY_CLIENT_ID&lt;/span&gt;&lt;span class=&#34;o&#34;&gt;=&lt;/span&gt;&lt;span class=&#34;s2&#34;&gt;&amp;#34;okta-app-client-id&amp;#34;&lt;/span&gt;
&lt;/span&gt;&lt;/span&gt;&lt;span class=&#34;line&#34;&gt;&lt;span class=&#34;cl&#34;&gt;&lt;span class=&#34;nv&#34;&gt;OAUTH2_PROXY_CLIENT_SECRET&lt;/span&gt;&lt;span class=&#34;o&#34;&gt;=&lt;/span&gt;&lt;span class=&#34;s2&#34;&gt;&amp;#34;okta-app-secret&amp;#34;&lt;/span&gt;
&lt;/span&gt;&lt;/span&gt;&lt;span class=&#34;line&#34;&gt;&lt;span class=&#34;cl&#34;&gt;&lt;span class=&#34;nv&#34;&gt;OAUTH2_PROXY_COOKIE_SECRET&lt;/span&gt;&lt;span class=&#34;o&#34;&gt;=&lt;/span&gt;&lt;span class=&#34;s2&#34;&gt;&amp;#34;generate-with-python-secrets&amp;#34;&lt;/span&gt;
&lt;/span&gt;&lt;/span&gt;&lt;span class=&#34;line&#34;&gt;&lt;span class=&#34;cl&#34;&gt;&lt;span class=&#34;nv&#34;&gt;OAUTH2_PROXY_REDIRECT_URL&lt;/span&gt;&lt;span class=&#34;o&#34;&gt;=&lt;/span&gt;&lt;span class=&#34;s2&#34;&gt;&amp;#34;https://cavaliba.example.com/oauth2/callback&amp;#34;&lt;/span&gt;
&lt;/span&gt;&lt;/span&gt;&lt;span class=&#34;line&#34;&gt;&lt;span class=&#34;cl&#34;&gt;&lt;span class=&#34;nv&#34;&gt;OAUTH2_PROXY_EMAIL_DOMAINS&lt;/span&gt;&lt;span class=&#34;o&#34;&gt;=&lt;/span&gt;&lt;span class=&#34;s2&#34;&gt;&amp;#34;company.com&amp;#34;&lt;/span&gt;&lt;/span&gt;&lt;/span&gt;&lt;/code&gt;&lt;/pre&gt;&lt;/div&gt;&lt;/div&gt;&lt;div class=&#34;hextra-code-copy-btn-container hx-opacity-0 hx-transition group-hover/code:hx-opacity-100 hx-flex hx-gap-1 hx-absolute hx-m-[11px] hx-right-0 hx-top-0&#34;&gt;
  &lt;button
    class=&#34;hextra-code-copy-btn hx-group/copybtn hx-transition-all active:hx-opacity-50 hx-bg-primary-700/5 hx-border hx-border-black/5 hx-text-gray-600 hover:hx-text-gray-900 hx-rounded-md hx-p-1.5 dark:hx-bg-primary-300/10 dark:hx-border-white/10 dark:hx-text-gray-400 dark:hover:hx-text-gray-50&#34;
    title=&#34;Copy code&#34;
  &gt;
    &lt;div class=&#34;copy-icon group-[.copied]/copybtn:hx-hidden hx-pointer-events-none hx-h-4 hx-w-4&#34;&gt;&lt;/div&gt;
    &lt;div class=&#34;success-icon hx-hidden group-[.copied]/copybtn:hx-block hx-pointer-events-none hx-h-4 hx-w-4&#34;&gt;&lt;/div&gt;
  &lt;/button&gt;
&lt;/div&gt;
&lt;/div&gt;
&lt;h4&gt;Azure AD&lt;span class=&#34;hx-absolute -hx-mt-20&#34; id=&#34;azure-ad&#34;&gt;&lt;/span&gt;
    &lt;a href=&#34;#azure-ad&#34; class=&#34;subheading-anchor&#34; aria-label=&#34;Permalink for this section&#34;&gt;&lt;/a&gt;&lt;/h4&gt;&lt;div class=&#34;hextra-code-block hx-relative hx-mt-6 first:hx-mt-0 hx-group/code&#34;&gt;

&lt;div&gt;&lt;div class=&#34;highlight&#34;&gt;&lt;pre tabindex=&#34;0&#34; class=&#34;chroma&#34;&gt;&lt;code class=&#34;language-bash&#34; data-lang=&#34;bash&#34;&gt;&lt;span class=&#34;line&#34;&gt;&lt;span class=&#34;cl&#34;&gt;&lt;span class=&#34;c1&#34;&gt;# .env&lt;/span&gt;
&lt;/span&gt;&lt;/span&gt;&lt;span class=&#34;line&#34;&gt;&lt;span class=&#34;cl&#34;&gt;&lt;span class=&#34;nv&#34;&gt;OAUTH2_PROXY_PROVIDER&lt;/span&gt;&lt;span class=&#34;o&#34;&gt;=&lt;/span&gt;&lt;span class=&#34;s2&#34;&gt;&amp;#34;azure&amp;#34;&lt;/span&gt;
&lt;/span&gt;&lt;/span&gt;&lt;span class=&#34;line&#34;&gt;&lt;span class=&#34;cl&#34;&gt;&lt;span class=&#34;nv&#34;&gt;OAUTH2_PROXY_PROVIDER_DISPLAY_NAME&lt;/span&gt;&lt;span class=&#34;o&#34;&gt;=&lt;/span&gt;&lt;span class=&#34;s2&#34;&gt;&amp;#34;Azure AD&amp;#34;&lt;/span&gt;
&lt;/span&gt;&lt;/span&gt;&lt;span class=&#34;line&#34;&gt;&lt;span class=&#34;cl&#34;&gt;&lt;span class=&#34;nv&#34;&gt;OAUTH2_PROXY_OIDC_ISSUER_URL&lt;/span&gt;&lt;span class=&#34;o&#34;&gt;=&lt;/span&gt;&lt;span class=&#34;s2&#34;&gt;&amp;#34;https://login.microsoftonline.com/your-tenant-id/v2.0&amp;#34;&lt;/span&gt;
&lt;/span&gt;&lt;/span&gt;&lt;span class=&#34;line&#34;&gt;&lt;span class=&#34;cl&#34;&gt;&lt;span class=&#34;nv&#34;&gt;OAUTH2_PROXY_CLIENT_ID&lt;/span&gt;&lt;span class=&#34;o&#34;&gt;=&lt;/span&gt;&lt;span class=&#34;s2&#34;&gt;&amp;#34;azure-app-id&amp;#34;&lt;/span&gt;
&lt;/span&gt;&lt;/span&gt;&lt;span class=&#34;line&#34;&gt;&lt;span class=&#34;cl&#34;&gt;&lt;span class=&#34;nv&#34;&gt;OAUTH2_PROXY_CLIENT_SECRET&lt;/span&gt;&lt;span class=&#34;o&#34;&gt;=&lt;/span&gt;&lt;span class=&#34;s2&#34;&gt;&amp;#34;azure-app-secret&amp;#34;&lt;/span&gt;
&lt;/span&gt;&lt;/span&gt;&lt;span class=&#34;line&#34;&gt;&lt;span class=&#34;cl&#34;&gt;&lt;span class=&#34;nv&#34;&gt;OAUTH2_PROXY_COOKIE_SECRET&lt;/span&gt;&lt;span class=&#34;o&#34;&gt;=&lt;/span&gt;&lt;span class=&#34;s2&#34;&gt;&amp;#34;generate-with-python-secrets&amp;#34;&lt;/span&gt;
&lt;/span&gt;&lt;/span&gt;&lt;span class=&#34;line&#34;&gt;&lt;span class=&#34;cl&#34;&gt;&lt;span class=&#34;nv&#34;&gt;OAUTH2_PROXY_REDIRECT_URL&lt;/span&gt;&lt;span class=&#34;o&#34;&gt;=&lt;/span&gt;&lt;span class=&#34;s2&#34;&gt;&amp;#34;https://cavaliba.example.com/oauth2/callback&amp;#34;&lt;/span&gt;&lt;/span&gt;&lt;/span&gt;&lt;/code&gt;&lt;/pre&gt;&lt;/div&gt;&lt;/div&gt;&lt;div class=&#34;hextra-code-copy-btn-container hx-opacity-0 hx-transition group-hover/code:hx-opacity-100 hx-flex hx-gap-1 hx-absolute hx-m-[11px] hx-right-0 hx-top-0&#34;&gt;
  &lt;button
    class=&#34;hextra-code-copy-btn hx-group/copybtn hx-transition-all active:hx-opacity-50 hx-bg-primary-700/5 hx-border hx-border-black/5 hx-text-gray-600 hover:hx-text-gray-900 hx-rounded-md hx-p-1.5 dark:hx-bg-primary-300/10 dark:hx-border-white/10 dark:hx-text-gray-400 dark:hover:hx-text-gray-50&#34;
    title=&#34;Copy code&#34;
  &gt;
    &lt;div class=&#34;copy-icon group-[.copied]/copybtn:hx-hidden hx-pointer-events-none hx-h-4 hx-w-4&#34;&gt;&lt;/div&gt;
    &lt;div class=&#34;success-icon hx-hidden group-[.copied]/copybtn:hx-block hx-pointer-events-none hx-h-4 hx-w-4&#34;&gt;&lt;/div&gt;
  &lt;/button&gt;
&lt;/div&gt;
&lt;/div&gt;
&lt;h3&gt;User Provisioning&lt;span class=&#34;hx-absolute -hx-mt-20&#34; id=&#34;user-provisioning&#34;&gt;&lt;/span&gt;
    &lt;a href=&#34;#user-provisioning&#34; class=&#34;subheading-anchor&#34; aria-label=&#34;Permalink for this section&#34;&gt;&lt;/a&gt;&lt;/h3&gt;&lt;h4&gt;Just-In-Time Provisioning (Recommended)&lt;span class=&#34;hx-absolute -hx-mt-20&#34; id=&#34;just-in-time-provisioning-recommended&#34;&gt;&lt;/span&gt;
    &lt;a href=&#34;#just-in-time-provisioning-recommended&#34; class=&#34;subheading-anchor&#34; aria-label=&#34;Permalink for this section&#34;&gt;&lt;/a&gt;&lt;/h4&gt;&lt;p&gt;Enable automatic user creation on first login:&lt;/p&gt;
&lt;p&gt;In Cavaliba configuration (application settings):&lt;/p&gt;
&lt;div class=&#34;hextra-code-block hx-relative hx-mt-6 first:hx-mt-0 hx-group/code&#34;&gt;

&lt;div&gt;&lt;pre&gt;&lt;code&gt;USER / AUTH_PROVISIONING = &amp;#34;create&amp;#34;  (or &amp;#34;update&amp;#34; or &amp;#34;sync&amp;#34;)&lt;/code&gt;&lt;/pre&gt;&lt;/div&gt;&lt;div class=&#34;hextra-code-copy-btn-container hx-opacity-0 hx-transition group-hover/code:hx-opacity-100 hx-flex hx-gap-1 hx-absolute hx-m-[11px] hx-right-0 hx-top-0&#34;&gt;
  &lt;button
    class=&#34;hextra-code-copy-btn hx-group/copybtn hx-transition-all active:hx-opacity-50 hx-bg-primary-700/5 hx-border hx-border-black/5 hx-text-gray-600 hover:hx-text-gray-900 hx-rounded-md hx-p-1.5 dark:hx-bg-primary-300/10 dark:hx-border-white/10 dark:hx-text-gray-400 dark:hover:hx-text-gray-50&#34;
    title=&#34;Copy code&#34;
  &gt;
    &lt;div class=&#34;copy-icon group-[.copied]/copybtn:hx-hidden hx-pointer-events-none hx-h-4 hx-w-4&#34;&gt;&lt;/div&gt;
    &lt;div class=&#34;success-icon hx-hidden group-[.copied]/copybtn:hx-block hx-pointer-events-none hx-h-4 hx-w-4&#34;&gt;&lt;/div&gt;
  &lt;/button&gt;
&lt;/div&gt;
&lt;/div&gt;
&lt;p&gt;Options:&lt;/p&gt;
&lt;ul&gt;
&lt;li&gt;&lt;strong&gt;manual&lt;/strong&gt;: No auto-creation, users must pre-exist in Cavaliba&lt;/li&gt;
&lt;li&gt;&lt;strong&gt;visitor&lt;/strong&gt;: Temporary access without permanent account&lt;/li&gt;
&lt;li&gt;&lt;strong&gt;create&lt;/strong&gt;: Create new account on first login with basic role&lt;/li&gt;
&lt;li&gt;&lt;strong&gt;update&lt;/strong&gt;: Update existing account attributes from IdP&lt;/li&gt;
&lt;li&gt;&lt;strong&gt;sync&lt;/strong&gt;: Full synchronization of user attributes and groups&lt;/li&gt;
&lt;/ul&gt;
&lt;h4&gt;Pre-Provisioning&lt;span class=&#34;hx-absolute -hx-mt-20&#34; id=&#34;pre-provisioning&#34;&gt;&lt;/span&gt;
    &lt;a href=&#34;#pre-provisioning&#34; class=&#34;subheading-anchor&#34; aria-label=&#34;Permalink for this section&#34;&gt;&lt;/a&gt;&lt;/h4&gt;&lt;p&gt;Manually create all users before they first log in:&lt;/p&gt;
&lt;div class=&#34;hextra-code-block hx-relative hx-mt-6 first:hx-mt-0 hx-group/code&#34;&gt;

&lt;div&gt;&lt;div class=&#34;highlight&#34;&gt;&lt;pre tabindex=&#34;0&#34; class=&#34;chroma&#34;&gt;&lt;code class=&#34;language-bash&#34; data-lang=&#34;bash&#34;&gt;&lt;span class=&#34;line&#34;&gt;&lt;span class=&#34;cl&#34;&gt;docker &lt;span class=&#34;nb&#34;&gt;exec&lt;/span&gt; -it cavaliba_app python manage.py shell&lt;/span&gt;&lt;/span&gt;&lt;/code&gt;&lt;/pre&gt;&lt;/div&gt;&lt;/div&gt;&lt;div class=&#34;hextra-code-copy-btn-container hx-opacity-0 hx-transition group-hover/code:hx-opacity-100 hx-flex hx-gap-1 hx-absolute hx-m-[11px] hx-right-0 hx-top-0&#34;&gt;
  &lt;button
    class=&#34;hextra-code-copy-btn hx-group/copybtn hx-transition-all active:hx-opacity-50 hx-bg-primary-700/5 hx-border hx-border-black/5 hx-text-gray-600 hover:hx-text-gray-900 hx-rounded-md hx-p-1.5 dark:hx-bg-primary-300/10 dark:hx-border-white/10 dark:hx-text-gray-400 dark:hover:hx-text-gray-50&#34;
    title=&#34;Copy code&#34;
  &gt;
    &lt;div class=&#34;copy-icon group-[.copied]/copybtn:hx-hidden hx-pointer-events-none hx-h-4 hx-w-4&#34;&gt;&lt;/div&gt;
    &lt;div class=&#34;success-icon hx-hidden group-[.copied]/copybtn:hx-block hx-pointer-events-none hx-h-4 hx-w-4&#34;&gt;&lt;/div&gt;
  &lt;/button&gt;
&lt;/div&gt;
&lt;/div&gt;
&lt;div class=&#34;hextra-code-block hx-relative hx-mt-6 first:hx-mt-0 hx-group/code&#34;&gt;

&lt;div&gt;&lt;div class=&#34;highlight&#34;&gt;&lt;pre tabindex=&#34;0&#34; class=&#34;chroma&#34;&gt;&lt;code class=&#34;language-python&#34; data-lang=&#34;python&#34;&gt;&lt;span class=&#34;line&#34;&gt;&lt;span class=&#34;cl&#34;&gt;&lt;span class=&#34;kn&#34;&gt;from&lt;/span&gt; &lt;span class=&#34;nn&#34;&gt;app_user.models&lt;/span&gt; &lt;span class=&#34;kn&#34;&gt;import&lt;/span&gt; &lt;span class=&#34;n&#34;&gt;SireneUser&lt;/span&gt;
&lt;/span&gt;&lt;/span&gt;&lt;span class=&#34;line&#34;&gt;&lt;span class=&#34;cl&#34;&gt;&lt;span class=&#34;kn&#34;&gt;from&lt;/span&gt; &lt;span class=&#34;nn&#34;&gt;app_user.models&lt;/span&gt; &lt;span class=&#34;kn&#34;&gt;import&lt;/span&gt; &lt;span class=&#34;n&#34;&gt;SireneRole&lt;/span&gt;
&lt;/span&gt;&lt;/span&gt;&lt;span class=&#34;line&#34;&gt;&lt;span class=&#34;cl&#34;&gt;
&lt;/span&gt;&lt;/span&gt;&lt;span class=&#34;line&#34;&gt;&lt;span class=&#34;cl&#34;&gt;&lt;span class=&#34;c1&#34;&gt;# Create user&lt;/span&gt;
&lt;/span&gt;&lt;/span&gt;&lt;span class=&#34;line&#34;&gt;&lt;span class=&#34;cl&#34;&gt;&lt;span class=&#34;n&#34;&gt;user&lt;/span&gt; &lt;span class=&#34;o&#34;&gt;=&lt;/span&gt; &lt;span class=&#34;n&#34;&gt;SireneUser&lt;/span&gt;&lt;span class=&#34;o&#34;&gt;.&lt;/span&gt;&lt;span class=&#34;n&#34;&gt;objects&lt;/span&gt;&lt;span class=&#34;o&#34;&gt;.&lt;/span&gt;&lt;span class=&#34;n&#34;&gt;create_user&lt;/span&gt;&lt;span class=&#34;p&#34;&gt;(&lt;/span&gt;
&lt;/span&gt;&lt;/span&gt;&lt;span class=&#34;line&#34;&gt;&lt;span class=&#34;cl&#34;&gt;    &lt;span class=&#34;n&#34;&gt;username&lt;/span&gt;&lt;span class=&#34;o&#34;&gt;=&lt;/span&gt;&lt;span class=&#34;s2&#34;&gt;&amp;#34;john.smith&amp;#34;&lt;/span&gt;&lt;span class=&#34;p&#34;&gt;,&lt;/span&gt;
&lt;/span&gt;&lt;/span&gt;&lt;span class=&#34;line&#34;&gt;&lt;span class=&#34;cl&#34;&gt;    &lt;span class=&#34;n&#34;&gt;email&lt;/span&gt;&lt;span class=&#34;o&#34;&gt;=&lt;/span&gt;&lt;span class=&#34;s2&#34;&gt;&amp;#34;john.smith@company.com&amp;#34;&lt;/span&gt;
&lt;/span&gt;&lt;/span&gt;&lt;span class=&#34;line&#34;&gt;&lt;span class=&#34;cl&#34;&gt;&lt;span class=&#34;p&#34;&gt;)&lt;/span&gt;
&lt;/span&gt;&lt;/span&gt;&lt;span class=&#34;line&#34;&gt;&lt;span class=&#34;cl&#34;&gt;
&lt;/span&gt;&lt;/span&gt;&lt;span class=&#34;line&#34;&gt;&lt;span class=&#34;cl&#34;&gt;&lt;span class=&#34;c1&#34;&gt;# Assign roles/groups (example)&lt;/span&gt;
&lt;/span&gt;&lt;/span&gt;&lt;span class=&#34;line&#34;&gt;&lt;span class=&#34;cl&#34;&gt;&lt;span class=&#34;n&#34;&gt;user&lt;/span&gt;&lt;span class=&#34;o&#34;&gt;.&lt;/span&gt;&lt;span class=&#34;n&#34;&gt;save&lt;/span&gt;&lt;span class=&#34;p&#34;&gt;()&lt;/span&gt;&lt;/span&gt;&lt;/span&gt;&lt;/code&gt;&lt;/pre&gt;&lt;/div&gt;&lt;/div&gt;&lt;div class=&#34;hextra-code-copy-btn-container hx-opacity-0 hx-transition group-hover/code:hx-opacity-100 hx-flex hx-gap-1 hx-absolute hx-m-[11px] hx-right-0 hx-top-0&#34;&gt;
  &lt;button
    class=&#34;hextra-code-copy-btn hx-group/copybtn hx-transition-all active:hx-opacity-50 hx-bg-primary-700/5 hx-border hx-border-black/5 hx-text-gray-600 hover:hx-text-gray-900 hx-rounded-md hx-p-1.5 dark:hx-bg-primary-300/10 dark:hx-border-white/10 dark:hx-text-gray-400 dark:hover:hx-text-gray-50&#34;
    title=&#34;Copy code&#34;
  &gt;
    &lt;div class=&#34;copy-icon group-[.copied]/copybtn:hx-hidden hx-pointer-events-none hx-h-4 hx-w-4&#34;&gt;&lt;/div&gt;
    &lt;div class=&#34;success-icon hx-hidden group-[.copied]/copybtn:hx-block hx-pointer-events-none hx-h-4 hx-w-4&#34;&gt;&lt;/div&gt;
  &lt;/button&gt;
&lt;/div&gt;
&lt;/div&gt;
&lt;h3&gt;Troubleshooting&lt;span class=&#34;hx-absolute -hx-mt-20&#34; id=&#34;troubleshooting&#34;&gt;&lt;/span&gt;
    &lt;a href=&#34;#troubleshooting&#34; class=&#34;subheading-anchor&#34; aria-label=&#34;Permalink for this section&#34;&gt;&lt;/a&gt;&lt;/h3&gt;&lt;h4&gt;Users can&amp;rsquo;t log in after OAuth2 setup&lt;span class=&#34;hx-absolute -hx-mt-20&#34; id=&#34;users-cant-log-in-after-oauth2-setup&#34;&gt;&lt;/span&gt;
    &lt;a href=&#34;#users-cant-log-in-after-oauth2-setup&#34; class=&#34;subheading-anchor&#34; aria-label=&#34;Permalink for this section&#34;&gt;&lt;/a&gt;&lt;/h4&gt;&lt;ol&gt;
&lt;li&gt;&lt;strong&gt;Check IdP registration&lt;/strong&gt;: Ensure Redirect URI exactly matches &lt;code&gt;OAUTH2_PROXY_REDIRECT_URL&lt;/code&gt;&lt;/li&gt;
&lt;li&gt;&lt;strong&gt;Verify HTTPS&lt;/strong&gt;: IdP may reject non-HTTPS redirect URIs&lt;/li&gt;
&lt;li&gt;&lt;strong&gt;Check nginx logs&lt;/strong&gt;: &lt;code&gt;docker logs cavaliba_nginx&lt;/code&gt;&lt;/li&gt;
&lt;li&gt;&lt;strong&gt;Check oauth2_proxy logs&lt;/strong&gt;: &lt;code&gt;docker logs cavaliba_oauth2&lt;/code&gt;&lt;/li&gt;
&lt;li&gt;&lt;strong&gt;Verify user exists&lt;/strong&gt;: Check Cavaliba User module for the user account&lt;/li&gt;
&lt;/ol&gt;
&lt;h4&gt;&amp;ldquo;email mismatch&amp;rdquo; or similar errors&lt;span class=&#34;hx-absolute -hx-mt-20&#34; id=&#34;email-mismatch-or-similar-errors&#34;&gt;&lt;/span&gt;
    &lt;a href=&#34;#email-mismatch-or-similar-errors&#34; class=&#34;subheading-anchor&#34; aria-label=&#34;Permalink for this section&#34;&gt;&lt;/a&gt;&lt;/h4&gt;&lt;ul&gt;
&lt;li&gt;Check that IdP is configured to return email address&lt;/li&gt;
&lt;li&gt;Check &lt;code&gt;OAUTH2_PROXY_EMAIL_DOMAINS&lt;/code&gt; setting matches user email domains&lt;/li&gt;
&lt;li&gt;Review oauth2_proxy logs for detailed error messages&lt;/li&gt;
&lt;/ul&gt;
&lt;h4&gt;Session issues after IdP changes&lt;span class=&#34;hx-absolute -hx-mt-20&#34; id=&#34;session-issues-after-idp-changes&#34;&gt;&lt;/span&gt;
    &lt;a href=&#34;#session-issues-after-idp-changes&#34; class=&#34;subheading-anchor&#34; aria-label=&#34;Permalink for this section&#34;&gt;&lt;/a&gt;&lt;/h4&gt;&lt;ul&gt;
&lt;li&gt;Clear browser cookies&lt;/li&gt;
&lt;li&gt;Restart oauth2_proxy container: &lt;code&gt;docker restart cavaliba_oauth2&lt;/code&gt;&lt;/li&gt;
&lt;/ul&gt;
&lt;h3&gt;Security Considerations&lt;span class=&#34;hx-absolute -hx-mt-20&#34; id=&#34;security-considerations&#34;&gt;&lt;/span&gt;
    &lt;a href=&#34;#security-considerations&#34; class=&#34;subheading-anchor&#34; aria-label=&#34;Permalink for this section&#34;&gt;&lt;/a&gt;&lt;/h3&gt;&lt;ul&gt;
&lt;li&gt;&lt;strong&gt;Always use HTTPS&lt;/strong&gt; in production - OAuth2 credentials travel in headers&lt;/li&gt;
&lt;li&gt;&lt;strong&gt;Keep Client Secret secure&lt;/strong&gt; - Never commit to version control, use environment files&lt;/li&gt;
&lt;li&gt;&lt;strong&gt;Set COOKIE_SECURE to true&lt;/strong&gt; - Prevents cookies over HTTP&lt;/li&gt;
&lt;li&gt;&lt;strong&gt;Set COOKIE_HTTPONLY to true&lt;/strong&gt; - Prevents JavaScript access to cookies&lt;/li&gt;
&lt;li&gt;&lt;strong&gt;Use COOKIE_SAMESITE=&amp;ldquo;lax&amp;rdquo;&lt;/strong&gt; - Prevents CSRF attacks&lt;/li&gt;
&lt;li&gt;&lt;strong&gt;Regularly rotate secrets&lt;/strong&gt; - Keycloak, Okta, etc. provide secret rotation&lt;/li&gt;
&lt;li&gt;&lt;strong&gt;Monitor logs&lt;/strong&gt; - Review authentication failures regularly&lt;/li&gt;
&lt;/ul&gt;
&lt;hr&gt;
&lt;h2&gt;Comparing Authentication Methods&lt;span class=&#34;hx-absolute -hx-mt-20&#34; id=&#34;comparing-authentication-methods&#34;&gt;&lt;/span&gt;
    &lt;a href=&#34;#comparing-authentication-methods&#34; class=&#34;subheading-anchor&#34; aria-label=&#34;Permalink for this section&#34;&gt;&lt;/a&gt;&lt;/h2&gt;&lt;h3&gt;Feature Comparison&lt;span class=&#34;hx-absolute -hx-mt-20&#34; id=&#34;feature-comparison&#34;&gt;&lt;/span&gt;
    &lt;a href=&#34;#feature-comparison&#34; class=&#34;subheading-anchor&#34; aria-label=&#34;Permalink for this section&#34;&gt;&lt;/a&gt;&lt;/h3&gt;&lt;table&gt;
  &lt;thead&gt;
      &lt;tr&gt;
          &lt;th style=&#34;text-align: left&#34;&gt;Feature&lt;/th&gt;
          &lt;th style=&#34;text-align: left&#34;&gt;Local&lt;/th&gt;
          &lt;th style=&#34;text-align: left&#34;&gt;Basic&lt;/th&gt;
          &lt;th style=&#34;text-align: left&#34;&gt;Forced&lt;/th&gt;
          &lt;th style=&#34;text-align: left&#34;&gt;LDAP&lt;/th&gt;
          &lt;th style=&#34;text-align: left&#34;&gt;OIDC/SAML&lt;/th&gt;
      &lt;/tr&gt;
  &lt;/thead&gt;
  &lt;tbody&gt;
      &lt;tr&gt;
          &lt;td style=&#34;text-align: left&#34;&gt;Password Management&lt;/td&gt;
          &lt;td style=&#34;text-align: left&#34;&gt;Manual in Cavaliba&lt;/td&gt;
          &lt;td style=&#34;text-align: left&#34;&gt;External file/system&lt;/td&gt;
          &lt;td style=&#34;text-align: left&#34;&gt;No&lt;/td&gt;
          &lt;td style=&#34;text-align: left&#34;&gt;Via IdP/Keycloak&lt;/td&gt;
          &lt;td style=&#34;text-align: left&#34;&gt;Via IdP&lt;/td&gt;
      &lt;/tr&gt;
      &lt;tr&gt;
          &lt;td style=&#34;text-align: left&#34;&gt;User Synchronization&lt;/td&gt;
          &lt;td style=&#34;text-align: left&#34;&gt;Manual&lt;/td&gt;
          &lt;td style=&#34;text-align: left&#34;&gt;Manual&lt;/td&gt;
          &lt;td style=&#34;text-align: left&#34;&gt;N/A&lt;/td&gt;
          &lt;td style=&#34;text-align: left&#34;&gt;Automatic&lt;/td&gt;
          &lt;td style=&#34;text-align: left&#34;&gt;Automatic&lt;/td&gt;
      &lt;/tr&gt;
      &lt;tr&gt;
          &lt;td style=&#34;text-align: left&#34;&gt;Multi-Factor Auth (MFA)&lt;/td&gt;
          &lt;td style=&#34;text-align: left&#34;&gt;No&lt;/td&gt;
          &lt;td style=&#34;text-align: left&#34;&gt;No&lt;/td&gt;
          &lt;td style=&#34;text-align: left&#34;&gt;No&lt;/td&gt;
          &lt;td style=&#34;text-align: left&#34;&gt;Via Keycloak&lt;/td&gt;
          &lt;td style=&#34;text-align: left&#34;&gt;Yes&lt;/td&gt;
      &lt;/tr&gt;
      &lt;tr&gt;
          &lt;td style=&#34;text-align: left&#34;&gt;Central Directory Support&lt;/td&gt;
          &lt;td style=&#34;text-align: left&#34;&gt;No&lt;/td&gt;
          &lt;td style=&#34;text-align: left&#34;&gt;No&lt;/td&gt;
          &lt;td style=&#34;text-align: left&#34;&gt;No&lt;/td&gt;
          &lt;td style=&#34;text-align: left&#34;&gt;Yes (via Keycloak)&lt;/td&gt;
          &lt;td style=&#34;text-align: left&#34;&gt;Yes&lt;/td&gt;
      &lt;/tr&gt;
      &lt;tr&gt;
          &lt;td style=&#34;text-align: left&#34;&gt;Scalable for Many Users&lt;/td&gt;
          &lt;td style=&#34;text-align: left&#34;&gt;No&lt;/td&gt;
          &lt;td style=&#34;text-align: left&#34;&gt;No&lt;/td&gt;
          &lt;td style=&#34;text-align: left&#34;&gt;No&lt;/td&gt;
          &lt;td style=&#34;text-align: left&#34;&gt;Yes&lt;/td&gt;
          &lt;td style=&#34;text-align: left&#34;&gt;Yes&lt;/td&gt;
      &lt;/tr&gt;
      &lt;tr&gt;
          &lt;td style=&#34;text-align: left&#34;&gt;Self-Service Password Reset&lt;/td&gt;
          &lt;td style=&#34;text-align: left&#34;&gt;No&lt;/td&gt;
          &lt;td style=&#34;text-align: left&#34;&gt;No&lt;/td&gt;
          &lt;td style=&#34;text-align: left&#34;&gt;No&lt;/td&gt;
          &lt;td style=&#34;text-align: left&#34;&gt;Via Keycloak&lt;/td&gt;
          &lt;td style=&#34;text-align: left&#34;&gt;Via IdP&lt;/td&gt;
      &lt;/tr&gt;
      &lt;tr&gt;
          &lt;td style=&#34;text-align: left&#34;&gt;User Provisioning&lt;/td&gt;
          &lt;td style=&#34;text-align: left&#34;&gt;Manual&lt;/td&gt;
          &lt;td style=&#34;text-align: left&#34;&gt;Manual&lt;/td&gt;
          &lt;td style=&#34;text-align: left&#34;&gt;Fixed&lt;/td&gt;
          &lt;td style=&#34;text-align: left&#34;&gt;Automatic&lt;/td&gt;
          &lt;td style=&#34;text-align: left&#34;&gt;Automatic&lt;/td&gt;
      &lt;/tr&gt;
      &lt;tr&gt;
          &lt;td style=&#34;text-align: left&#34;&gt;Setup Complexity&lt;/td&gt;
          &lt;td style=&#34;text-align: left&#34;&gt;Very Low&lt;/td&gt;
          &lt;td style=&#34;text-align: left&#34;&gt;Low&lt;/td&gt;
          &lt;td style=&#34;text-align: left&#34;&gt;Very Low&lt;/td&gt;
          &lt;td style=&#34;text-align: left&#34;&gt;Medium&lt;/td&gt;
          &lt;td style=&#34;text-align: left&#34;&gt;High&lt;/td&gt;
      &lt;/tr&gt;
      &lt;tr&gt;
          &lt;td style=&#34;text-align: left&#34;&gt;Production Recommended&lt;/td&gt;
          &lt;td style=&#34;text-align: left&#34;&gt;Small only&lt;/td&gt;
          &lt;td style=&#34;text-align: left&#34;&gt;Small only&lt;/td&gt;
          &lt;td style=&#34;text-align: left&#34;&gt;Never&lt;/td&gt;
          &lt;td style=&#34;text-align: left&#34;&gt;Yes&lt;/td&gt;
          &lt;td style=&#34;text-align: left&#34;&gt;Yes&lt;/td&gt;
      &lt;/tr&gt;
      &lt;tr&gt;
          &lt;td style=&#34;text-align: left&#34;&gt;HTTPS Required&lt;/td&gt;
          &lt;td style=&#34;text-align: left&#34;&gt;Optional&lt;/td&gt;
          &lt;td style=&#34;text-align: left&#34;&gt;Recommended&lt;/td&gt;
          &lt;td style=&#34;text-align: left&#34;&gt;Optional&lt;/td&gt;
          &lt;td style=&#34;text-align: left&#34;&gt;Recommended&lt;/td&gt;
          &lt;td style=&#34;text-align: left&#34;&gt;Required&lt;/td&gt;
      &lt;/tr&gt;
  &lt;/tbody&gt;
&lt;/table&gt;
&lt;h3&gt;Decision Tree&lt;span class=&#34;hx-absolute -hx-mt-20&#34; id=&#34;decision-tree&#34;&gt;&lt;/span&gt;
    &lt;a href=&#34;#decision-tree&#34; class=&#34;subheading-anchor&#34; aria-label=&#34;Permalink for this section&#34;&gt;&lt;/a&gt;&lt;/h3&gt;&lt;div class=&#34;hextra-code-block hx-relative hx-mt-6 first:hx-mt-0 hx-group/code&#34;&gt;

&lt;div&gt;&lt;pre&gt;&lt;code&gt;How many users?
├─ &amp;lt; 10: Local or Basic
└─ ≥ 10:
   ├─ Existing LDAP/AD directory?
   │  └─ Yes: OIDC/SAML with Keycloak → LDAP
   └─ No:
      ├─ Need MFA or Single Sign-On?
      │  └─ Yes: OIDC/SAML with your IdP
      └─ No: Local or Basic&lt;/code&gt;&lt;/pre&gt;&lt;/div&gt;&lt;div class=&#34;hextra-code-copy-btn-container hx-opacity-0 hx-transition group-hover/code:hx-opacity-100 hx-flex hx-gap-1 hx-absolute hx-m-[11px] hx-right-0 hx-top-0&#34;&gt;
  &lt;button
    class=&#34;hextra-code-copy-btn hx-group/copybtn hx-transition-all active:hx-opacity-50 hx-bg-primary-700/5 hx-border hx-border-black/5 hx-text-gray-600 hover:hx-text-gray-900 hx-rounded-md hx-p-1.5 dark:hx-bg-primary-300/10 dark:hx-border-white/10 dark:hx-text-gray-400 dark:hover:hx-text-gray-50&#34;
    title=&#34;Copy code&#34;
  &gt;
    &lt;div class=&#34;copy-icon group-[.copied]/copybtn:hx-hidden hx-pointer-events-none hx-h-4 hx-w-4&#34;&gt;&lt;/div&gt;
    &lt;div class=&#34;success-icon hx-hidden group-[.copied]/copybtn:hx-block hx-pointer-events-none hx-h-4 hx-w-4&#34;&gt;&lt;/div&gt;
  &lt;/button&gt;
&lt;/div&gt;
&lt;/div&gt;
&lt;h3&gt;Migration Path&lt;span class=&#34;hx-absolute -hx-mt-20&#34; id=&#34;migration-path&#34;&gt;&lt;/span&gt;
    &lt;a href=&#34;#migration-path&#34; class=&#34;subheading-anchor&#34; aria-label=&#34;Permalink for this section&#34;&gt;&lt;/a&gt;&lt;/h3&gt;&lt;ol&gt;
&lt;li&gt;&lt;strong&gt;Start with Local&lt;/strong&gt; - Easy to configure and test&lt;/li&gt;
&lt;li&gt;&lt;strong&gt;Move to Basic&lt;/strong&gt; - When you have external auth system&lt;/li&gt;
&lt;li&gt;&lt;strong&gt;Upgrade to OIDC/SAML&lt;/strong&gt; - When you need enterprise features&lt;/li&gt;
&lt;li&gt;&lt;strong&gt;LDAP via Keycloak&lt;/strong&gt; - When you have existing directory service&lt;/li&gt;
&lt;/ol&gt;
&lt;p&gt;User data migration between modes requires:&lt;/p&gt;
&lt;ul&gt;
&lt;li&gt;Creating new user accounts in the target system&lt;/li&gt;
&lt;li&gt;Updating the &lt;code&gt;CAVALIBA_AUTH_MODE&lt;/code&gt; setting&lt;/li&gt;
&lt;li&gt;Testing login before going to production&lt;/li&gt;
&lt;li&gt;Optionally keeping old accounts for notification purposes&lt;/li&gt;
&lt;/ul&gt;
&lt;hr&gt;
&lt;h2&gt;Authentication Configuration Reference&lt;span class=&#34;hx-absolute -hx-mt-20&#34; id=&#34;authentication-configuration-reference&#34;&gt;&lt;/span&gt;
    &lt;a href=&#34;#authentication-configuration-reference&#34; class=&#34;subheading-anchor&#34; aria-label=&#34;Permalink for this section&#34;&gt;&lt;/a&gt;&lt;/h2&gt;&lt;p&gt;For detailed environment variable documentation, see:&lt;/p&gt;
&lt;ul&gt;
&lt;li&gt;&lt;strong&gt;Docker Env Configuration&lt;/strong&gt; - All CAVALIBA_AUTH_MODE and OAUTH2_PROXY_* settings&lt;/li&gt;
&lt;li&gt;&lt;strong&gt;Application Configuration&lt;/strong&gt; - USER/AUTH_* settings for provisioning and federated auth&lt;/li&gt;
&lt;/ul&gt;
&lt;hr&gt;
&lt;h2&gt;Related Documentation&lt;span class=&#34;hx-absolute -hx-mt-20&#34; id=&#34;related-documentation&#34;&gt;&lt;/span&gt;
    &lt;a href=&#34;#related-documentation&#34; class=&#34;subheading-anchor&#34; aria-label=&#34;Permalink for this section&#34;&gt;&lt;/a&gt;&lt;/h2&gt;&lt;ul&gt;
&lt;li&gt;&lt;strong&gt;Authorization and Permissions&lt;/strong&gt; - How to control what authenticated users can do&lt;/li&gt;
&lt;li&gt;&lt;strong&gt;User Management&lt;/strong&gt; - Managing users, groups, roles within Cavaliba&lt;/li&gt;
&lt;li&gt;&lt;strong&gt;Docker Environment&lt;/strong&gt; - Complete reference for all .env variables&lt;/li&gt;
&lt;/ul&gt;

      </description>
    </item>
    
    <item>
      <title>Email Configuration</title>
      <link>http://localhost:1313/docs/70configuration/email/</link>
      <pubDate>Mon, 01 Jan 0001 00:00:00 +0000</pubDate>
      
      <guid>http://localhost:1313/docs/70configuration/email/</guid>
      <description>
        
        
        &lt;p&gt;TBD&lt;/p&gt;

      </description>
    </item>
    
    <item>
      <title>SMS Configuration</title>
      <link>http://localhost:1313/docs/70configuration/sms/</link>
      <pubDate>Mon, 01 Jan 0001 00:00:00 +0000</pubDate>
      
      <guid>http://localhost:1313/docs/70configuration/sms/</guid>
      <description>
        
        
        
      </description>
    </item>
    
    <item>
      <title>Reverse-Proxy and TLS/SSL</title>
      <link>http://localhost:1313/docs/70configuration/tls_ssl/</link>
      <pubDate>Mon, 01 Jan 0001 00:00:00 +0000</pubDate>
      
      <guid>http://localhost:1313/docs/70configuration/tls_ssl/</guid>
      <description>
        
        
        &lt;p&gt;You should setup a TLS/SSL reverse-proxy in front of your Cavaliba docker deployment.&lt;/p&gt;
&lt;p&gt;A reverse-proxy would perform the following tasks:&lt;/p&gt;
&lt;ul&gt;
&lt;li&gt;offload (terminate) HTTPS SSL/TLS user connections and handle certificate configuration and renewal&lt;/li&gt;
&lt;li&gt;filter user source IP addresses if restricted network exposure is needed&lt;/li&gt;
&lt;li&gt;perform HTTP Basic/Digest user authentication if this auth mode is selected for Cavaliba&lt;/li&gt;
&lt;li&gt;produce log and audit-trail&lt;/li&gt;
&lt;li&gt;on large / fault-tolerant setups, perfom user trafic load-balancing accross multiple Cavaliba nodes&lt;/li&gt;
&lt;li&gt;display a Maintenance/Sorry page if it detects that cavalliba stack is down&lt;/li&gt;
&lt;/ul&gt;
&lt;p&gt;You may use an enterprise wide / netork managed load-balancer and reverse-proxy. You can also deploy a small NGINX or HA-PROXY component on your Cavaliba host virtual machine.&lt;/p&gt;
&lt;h2&gt;Node Healthcheck / status&lt;span class=&#34;hx-absolute -hx-mt-20&#34; id=&#34;node-healthcheck--status&#34;&gt;&lt;/span&gt;
    &lt;a href=&#34;#node-healthcheck--status&#34; class=&#34;subheading-anchor&#34; aria-label=&#34;Permalink for this section&#34;&gt;&lt;/a&gt;&lt;/h2&gt;&lt;p&gt;An external reverse-proxy or load-balancer should remove a failed node from its server pool and stop sending user traffic to failed nodes.&lt;/p&gt;
&lt;p&gt;Additionally, a monitoring tool should check the availability of services.&lt;/p&gt;
&lt;p&gt;Basic healthcheck can be implemented by verifying a simple TCP on http endpoint (TCP can connect). you can also check an HTTP 200 response.&lt;/p&gt;
&lt;p&gt;Better, you may implement a deeper healthcheck on the  &lt;strong&gt;/status/&lt;/strong&gt; page and check for an &amp;ldquo;OK&amp;rdquo; answer from Cavaliba. This check confirms that the application node is alive and healthy.&lt;/p&gt;
&lt;pre&gt;&lt;code&gt;curl http://cavaliba/status/
OK
&lt;/code&gt;&lt;/pre&gt;
&lt;h2&gt;Example : minimal NGINX / Let&amp;rsquo;s Encrypt SSL/TLS reverse-proxy&lt;span class=&#34;hx-absolute -hx-mt-20&#34; id=&#34;example--minimal-nginx--lets-encrypt-ssltls-reverse-proxy&#34;&gt;&lt;/span&gt;
    &lt;a href=&#34;#example--minimal-nginx--lets-encrypt-ssltls-reverse-proxy&#34; class=&#34;subheading-anchor&#34; aria-label=&#34;Permalink for this section&#34;&gt;&lt;/a&gt;&lt;/h2&gt;&lt;p&gt;Setup&lt;/p&gt;
&lt;div class=&#34;hextra-code-block hx-relative hx-mt-6 first:hx-mt-0 hx-group/code&#34;&gt;

&lt;div&gt;&lt;pre&gt;&lt;code&gt;$ sudo apt install nginx apache2-utils certbot python3-certbot-nginx
$ sudo certbot -n --agree-tos --email mycontact@mydomain.com --nginx -d mycavaliba.mydomain.com
$ sudo systemctl enable nginx&lt;/code&gt;&lt;/pre&gt;&lt;/div&gt;&lt;div class=&#34;hextra-code-copy-btn-container hx-opacity-0 hx-transition group-hover/code:hx-opacity-100 hx-flex hx-gap-1 hx-absolute hx-m-[11px] hx-right-0 hx-top-0&#34;&gt;
  &lt;button
    class=&#34;hextra-code-copy-btn hx-group/copybtn hx-transition-all active:hx-opacity-50 hx-bg-primary-700/5 hx-border hx-border-black/5 hx-text-gray-600 hover:hx-text-gray-900 hx-rounded-md hx-p-1.5 dark:hx-bg-primary-300/10 dark:hx-border-white/10 dark:hx-text-gray-400 dark:hover:hx-text-gray-50&#34;
    title=&#34;Copy code&#34;
  &gt;
    &lt;div class=&#34;copy-icon group-[.copied]/copybtn:hx-hidden hx-pointer-events-none hx-h-4 hx-w-4&#34;&gt;&lt;/div&gt;
    &lt;div class=&#34;success-icon hx-hidden group-[.copied]/copybtn:hx-block hx-pointer-events-none hx-h-4 hx-w-4&#34;&gt;&lt;/div&gt;
  &lt;/button&gt;
&lt;/div&gt;
&lt;/div&gt;
&lt;p&gt;Configuration&lt;/p&gt;
&lt;div class=&#34;hextra-code-block hx-relative hx-mt-6 first:hx-mt-0 hx-group/code&#34;&gt;

&lt;div&gt;&lt;pre&gt;&lt;code&gt;$ sudo cat /etc/nginx/sites-enabled/default

	upstream cavaliba {
	  keepalive 60;
	  server 127.0.0.1:8000;
	}
	server
	{
	    if ($host = mycavaliba.mydomain.com ) {
	        return 301 https://$host$request_uri;
	    } # managed by Certbot
	    listen 80 default_server;
	    server_name mycavaliba.mydomain.com;
	    return 404; # managed by Certbot
	}
	server
	{
	    server_name mycavaliba.mydomain.com;
	    listen 443 ssl; # managed by Certbot
	    ssl_certificate /etc/letsencrypt/live/mycavaliba.mydomain.com/fullchain.pem; # managed by Certbot
	    ssl_certificate_key /etc/letsencrypt/live/mycavaliba.mydomain.com/privkey.pem; # managed by Certbot
	    include /etc/letsencrypt/options-ssl-nginx.conf; # managed by Certbot
	    ssl_dhparam /etc/letsencrypt/ssl-dhparams.pem; # managed by Certbot

	    # -------------
	    location /
	    {
	        proxy_set_header Host $http_host;
	        proxy_set_header X-Forwarded-Host $host;
	        proxy_set_header X-Forwarded-Server $host;
	        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
	        #rewrite ^/cavaliba/(.*)$  /$1  break;
	        proxy_pass http://cavaliba;
	        proxy_http_version 1.1;
	        proxy_set_header Connection &amp;#34;&amp;#34;;
	    }
	}&lt;/code&gt;&lt;/pre&gt;&lt;/div&gt;&lt;div class=&#34;hextra-code-copy-btn-container hx-opacity-0 hx-transition group-hover/code:hx-opacity-100 hx-flex hx-gap-1 hx-absolute hx-m-[11px] hx-right-0 hx-top-0&#34;&gt;
  &lt;button
    class=&#34;hextra-code-copy-btn hx-group/copybtn hx-transition-all active:hx-opacity-50 hx-bg-primary-700/5 hx-border hx-border-black/5 hx-text-gray-600 hover:hx-text-gray-900 hx-rounded-md hx-p-1.5 dark:hx-bg-primary-300/10 dark:hx-border-white/10 dark:hx-text-gray-400 dark:hover:hx-text-gray-50&#34;
    title=&#34;Copy code&#34;
  &gt;
    &lt;div class=&#34;copy-icon group-[.copied]/copybtn:hx-hidden hx-pointer-events-none hx-h-4 hx-w-4&#34;&gt;&lt;/div&gt;
    &lt;div class=&#34;success-icon hx-hidden group-[.copied]/copybtn:hx-block hx-pointer-events-none hx-h-4 hx-w-4&#34;&gt;&lt;/div&gt;
  &lt;/button&gt;
&lt;/div&gt;
&lt;/div&gt;

      </description>
    </item>
    
  </channel>
</rss>
