Your dashboard is a file.

# signet.toml: the whole configuration surface, in your repo.
# Secrets are env:/file: refs, never literals in the file.

[server]
base_url        = "https://auth.example.com"
trusted_origins = ["https://app.example.com"]

[database]
adapter = "postgres"          # your Postgres. A hosted console has no such key
# dsn supplied out-of-band via env:SIGNET_DATABASE_URL

[session]
expires_in = 604800           # 7 days, in seconds
fresh_age  = 900              # step-up window for sensitive actions

[password]
min = 12
max = 128
min_strength = 3             # strength score 0–4; 0 keeps length-only compatibility

[rate_limit]
window = 10
max    = 100

[[rate_limit.rules]]
path   = "/sign-in/email"     # throttle the door you most want bounded
window = 60
max    = 5

[lockout]
max_failures       = 5
window             = 600      # seconds; state persists in Postgres
lock_duration      = 900
backoff_multiplier = 2
max_lock_duration  = 86400

[email_policy]
allow = ["example.com", "*.partners.example"]
block = ["blocked.example", "abuse@example.com"]

[disposable_email]
enabled    = true
extra_deny = ["throwaway.example"]
# list_path = "/etc/signet/disposable.txt"  # replaces bundled list

[plugins]
haveibeenpwned = true         # breach-password check (HIBP)

[[social_providers]]
id            = "google"
client_id     = "env:GOOGLE_CLIENT_ID"
client_secret = "env:GOOGLE_CLIENT_SECRET"

[events]
url    = "https://app.example.com/webhooks/signet"
secret = "env:SIGNET_EVENTS_SECRET"   # must resolve to >=32 characters
# Generate the signing secret with: openssl rand -hex 32

[admin]
enabled = true                # the /admin operator surface
# key supplied via env:SIGNET_ADMIN_KEY