init

.env.example

@@ -0,0 +1,7 @@
+# Secret token — k8s pods must send this in X-Proxy-Token header
+# Generate with: openssl rand -hex 32
+PROXY_SECRET=change-me-generate-with-openssl-rand-hex-32
+
+# Allowed source CIDRs (comma-separated), leave empty to allow all (dev mode)
+# Example: "10.0.0.0/8,172.16.0.0/12"
+ALLOWED_CIDR=