function New-Base64Secret {
    param([int] $ByteLength = 48)

    $bytes = [byte[]]::new($ByteLength)
    $rng = [System.Security.Cryptography.RNGCryptoServiceProvider]::new()
    try {
        $rng.GetBytes($bytes)
    }
    finally {
        $rng.Dispose()
    }
    [Convert]::ToBase64String($bytes)
}

function New-HexSecret {
    param([int] $ByteLength = 32)

    $bytes = [byte[]]::new($ByteLength)
    $rng = [System.Security.Cryptography.RNGCryptoServiceProvider]::new()
    try {
        $rng.GetBytes($bytes)
    }
    finally {
        $rng.Dispose()
    }
    -join ($bytes | ForEach-Object { $_.ToString("x2") })
}

"JWT_SECRET=$(New-Base64Secret)"
"TOTP_ENCRYPTION_KEY=$(New-HexSecret)"