Details behind the summary in the README.

• APP_SECRET_KEY is mandatory: random, ≥32 characters. The app refuses to start with a weak/default key. Generate one with:

  python -c "import secrets;print(secrets.token_urlsafe(48))"

• Only in dev/test you can bypass the check with ALLOW_INSECURE_SECRET=true. Never in production.
• Application secrets (Plex token, SMTP password, Telegram token) are encrypted at rest with Fernet, using APP_SECRET_KEY as the key material.

If SUPERADMIN_PASSWORD is left empty or default, a random password is generated and logged once on first boot (as a warning in the container logs). Log in with it and change it right away from /profile.

FORWARDED_ALLOW_IPS tells uvicorn which source IPs are allowed to set X-Forwarded-* headers. Set it to your reverse proxy's IP or subnet (e.g. 172.18.0.0/16).

Do not leave it as * on an app exposed directly to the internet: a spoofable X-Forwarded-For header would let an attacker bypass the per-IP login lockout.

The image also honors X-Forwarded-Proto (--proxy-headers), so behind an HTTPS proxy generated URLs come out as https, and the session cookie gets the Secure flag automatically when PUBLIC_BASE_URL starts with https://.

• The image never contains .env, data/, or *.db files — they're excluded via .dockerignore, so a leaked/pushed image can't leak your secrets or database.
• Data persists only in the appdata volume mounted at /data (database + backups).
• The container runs as an unprivileged user (uid 10001): make sure the /data volume is writable by that uid.