298 lines
9.9 KiB
Bash
298 lines
9.9 KiB
Bash
# ============================================================================
|
|
# Journiv Environment Configuration Template
|
|
# Copy this file to .env and customize for your deployment.
|
|
#
|
|
# Usage:
|
|
# cp env.template .env
|
|
# nano .env
|
|
# Required settings:
|
|
# - SECRET_KEY
|
|
# - DOMAIN_NAME
|
|
#
|
|
# If using PostgreSQL (DB_DRIVER=postgres), also set:
|
|
# - Either POSTGRES_PASSWORD (with optional components), OR
|
|
# - DATABASE_URL with a PostgreSQL URL (postgresql:// or postgres://)
|
|
# NOT BOTH - specifying both will cause startup to fail
|
|
#
|
|
# All other settings are optional.
|
|
# ============================================================================
|
|
|
|
|
|
# ============================================================================
|
|
# REQUIRED SETTINGS
|
|
# ============================================================================
|
|
|
|
# Secret key for JWT token signing and encryption
|
|
# Generate with:
|
|
# python -c "import secrets; print(secrets.token_urlsafe(32))"
|
|
# Or:
|
|
# openssl rand -base64 32
|
|
SECRET_KEY=gjQ/6282Fdf3p4hK61nx/OHmLJCluIQauz/mm5idPls
|
|
|
|
|
|
# ============================================================================
|
|
# DOMAIN CONFIGURATION
|
|
# ============================================================================
|
|
|
|
# Public domain name where Journiv is accessible.
|
|
# DO NOT include http:// or https://.
|
|
# DO NOT include trailing slashes.
|
|
#
|
|
# Examples:
|
|
DOMAIN_NAME=journiv.domr.ovh
|
|
DOMAIN_NAME=journal.domr.ovh
|
|
# DOMAIN_NAME=192.168.1.10
|
|
#
|
|
# WRONG:
|
|
# DOMAIN_NAME=https://journiv.example.com
|
|
# DOMAIN_NAME=journiv.example.com/
|
|
|
|
# Protocol scheme for public URLs: http or https
|
|
# IMPORTANT: Set to "https" for production deployments, especially when behind a reverse proxy (Traefik, Caddy, Nginx, etc.).
|
|
# - Default: "http" (for local development only)
|
|
# - Production: "https" (REQUIRED when behind reverse proxy or using SSL/TLS)
|
|
#
|
|
# Journiv uses this to generate correct public redirect URLs:
|
|
# {DOMAIN_SCHEME}://{DOMAIN_NAME}/#/oidc-finish
|
|
# {DOMAIN_SCHEME}://{DOMAIN_NAME}/#/login?logout=success
|
|
#
|
|
DOMAIN_SCHEME=https
|
|
|
|
|
|
# ============================================================================
|
|
# DATABASE CONFIGURATION
|
|
# ============================================================================
|
|
|
|
# Database driver selection: "sqlite" (default) or "postgres"
|
|
DB_DRIVER=sqlite
|
|
|
|
# Primary database URL (defaults to SQLite)
|
|
# For SQLite: sqlite:////data/journiv.db
|
|
# For PostgreSQL: postgresql://user:password@host:5432/dbname
|
|
DATABASE_URL=sqlite:////data/journiv.db
|
|
|
|
# When DB_DRIVER=postgres, you must specify EITHER:
|
|
# Option 1: POSTGRES_PASSWORD (with optional components below)
|
|
# Option 2: DATABASE_URL with a PostgreSQL URL (postgresql:// or postgres://)
|
|
# NOT BOTH - specifying both will cause startup to fail
|
|
|
|
# PostgreSQL password (required when DB_DRIVER=postgres and using Option 1)
|
|
POSTGRES_PASSWORD=oUPnKDY3stjREg7ctUYWrbnn4wNs0Yy3
|
|
|
|
# (Optional) PostgreSQL components for Docker deployments (used with POSTGRES_PASSWORD)
|
|
# Defaults are used if not specified:
|
|
# POSTGRES_HOST=postgres
|
|
# POSTGRES_USER=journiv
|
|
# POSTGRES_DB=journiv_prod (production) or journiv_dev (development)
|
|
# POSTGRES_PORT=5432
|
|
# POSTGRES_HOST=
|
|
#POSTGRES_USER=journiv
|
|
#POSTGRES_DB=journiv_prod
|
|
#POSTGRES_PORT=5432
|
|
|
|
|
|
|
|
# ============================================================================
|
|
# APPLICATION SETTINGS
|
|
# ============================================================================
|
|
|
|
APP_NAME=Journiv
|
|
# APP_VERSION=latest # Pin to a specific version for production if needed
|
|
# DEBUG=false
|
|
ENVIRONMENT=production
|
|
APP_PORT=8198
|
|
|
|
|
|
# ============================================================================
|
|
# API CONFIGURATION
|
|
# ============================================================================
|
|
|
|
# API_V1_PREFIX=/api/v1
|
|
|
|
# Enable CORS only when the frontend runs on a different origin.
|
|
# ENABLE_CORS=false
|
|
|
|
# Required when ENABLE_CORS=true.
|
|
# Example:
|
|
# CORS_ORIGINS=https://journiv.example.com,https://myapp.example.net
|
|
# CORS_ORIGINS=
|
|
|
|
|
|
# ============================================================================
|
|
# SECURITY SETTINGS
|
|
# ============================================================================
|
|
|
|
# ALGORITHM=HS256
|
|
# ACCESS_TOKEN_EXPIRE_MINUTES=15
|
|
# REFRESH_TOKEN_EXPIRE_DAYS=7
|
|
|
|
# Disable user signup
|
|
# DISABLE_SIGNUP=false
|
|
|
|
|
|
# ============================================================================
|
|
# OIDC CONFIGURATION
|
|
# ============================================================================
|
|
|
|
# Enable OIDC login (Pocket-ID, Keycloak, Authentik, etc.)
|
|
OIDC_ENABLED=true
|
|
|
|
# OIDC provider issuer
|
|
# Example: https://id.example.com or https://auth.example.com/realms/default
|
|
OIDC_ISSUER=https://auth.domr.ovh/application/o/journiv
|
|
|
|
# OIDC client credentials
|
|
OIDC_CLIENT_ID="L1wmsh8BqoGlQRO6ZULMkTCRGOhu9M0L3Im7tiGd"
|
|
OIDC_CLIENT_SECRET=MPhUBLM8p4soNCfpfbp0pgAxoaqRHj36EvTzALVicoVy7Tf1UrVh2ckXJtciGYNscuQpQ78c8j8MXb1a1pn3bvOcnGERSYC2uT9s4AXhchD5yTKBBfFEz4l15OMZNqvG
|
|
|
|
# OIDC redirect URI
|
|
# Must match provider configuration EXACTLY.
|
|
# Example:
|
|
# OIDC_REDIRECT_URI=https://journiv.example.com/api/v1/auth/oidc/callback
|
|
OIDC_REDIRECT_URI=https://journal.domr.ovh/api/v1/auth/oidc/callback
|
|
|
|
# OIDC scopes to request
|
|
# OIDC_SCOPES="openid email profile"
|
|
|
|
# Automatically create users from OIDC claims
|
|
# OIDC_AUTO_PROVISION=true
|
|
|
|
# Disable SSL verification (ONLY for local development with self-signed certs)
|
|
# OIDC_DISABLE_SSL_VERIFY=false
|
|
|
|
# Allow OIDC over HTTP (INSECURE). Recommended only for advanced users in isolated homelabs.
|
|
# Default: false
|
|
# OIDC_ALLOW_INSECURE_PROD=false
|
|
|
|
|
|
# ============================================================================
|
|
# REDIS CONFIGURATION (Optional)
|
|
# ============================================================================
|
|
|
|
# Optional Redis URL for OIDC state caching, rate-limit persistence, and Celery
|
|
# Example: redis://localhost:6379/0
|
|
# REDIS_URL=
|
|
|
|
|
|
# ============================================================================
|
|
# CELERY CONFIGURATION (For Import/Export)
|
|
# ============================================================================
|
|
|
|
# Celery broker and result backend
|
|
# If not set, defaults to REDIS_URL
|
|
# Examples:
|
|
# CELERY_BROKER_URL=redis://localhost:6379/0
|
|
# CELERY_RESULT_BACKEND=redis://localhost:6379/0
|
|
# CELERY_BROKER_URL=
|
|
# CELERY_RESULT_BACKEND=
|
|
|
|
# Celery task serialization (default: json)
|
|
# CELERY_TASK_SERIALIZER=json
|
|
# CELERY_RESULT_SERIALIZER=json
|
|
# CELERY_TIMEZONE=UTC
|
|
# CELERY_ENABLE_UTC=true
|
|
|
|
|
|
# ============================================================================
|
|
# IMPORT/EXPORT CONFIGURATION
|
|
# ============================================================================
|
|
|
|
# Maximum file size for import/export operations (in MB)
|
|
# IMPORT_EXPORT_MAX_FILE_SIZE_MB=500
|
|
|
|
# Days to keep export files before automatic cleanup
|
|
# Set to -1 to disable automatic cleanup.
|
|
# EXPORT_CLEANUP_DAYS=7
|
|
|
|
# Directories for import/export operations
|
|
# IMPORT_TEMP_DIR=/data/imports/temp
|
|
# EXPORT_DIR=/data/exports
|
|
|
|
|
|
# ============================================================================
|
|
# INTEGRATIONS (IMMICH)
|
|
# ============================================================================
|
|
|
|
# Default Immich base URL for all users on the instance.
|
|
# If set, users can leave the Immich URL field empty in the UI.
|
|
# Immich URL specified per user level in settting screens can be used to override this.
|
|
# Example: IMMICH_BASE_URL=https://immich.example.com
|
|
# Example: IMMICH_BASE_URL=http://192.168.1.1:2283
|
|
# IMMICH_BASE_URL=
|
|
|
|
|
|
# ============================================================================
|
|
# CONTENT SECURITY POLICY (CSP)
|
|
# ============================================================================
|
|
|
|
# ENABLE_CSP=true
|
|
# ENABLE_HSTS=true
|
|
# ENABLE_CSP_REPORTING=true
|
|
|
|
# Where browsers should POST CSP violation reports
|
|
# CSP_REPORT_URI=/api/v1/security/csp-report
|
|
|
|
|
|
# ============================================================================
|
|
# FILE STORAGE
|
|
# ============================================================================
|
|
|
|
# Directory for user-uploaded files and media
|
|
# MEDIA_ROOT=/data/media
|
|
|
|
# Maximum allowed upload size in MB
|
|
# MAX_FILE_SIZE_MB=50
|
|
|
|
# Allowed media MIME types (comma-separated)
|
|
# ALLOWED_MEDIA_TYPES=image/jpeg,image/png,image/gif,image/webp,image/heic,video/mp4,video/avi,video/mov,video/webm,video/x-m4v,audio/mpeg,audio/wav,audio/ogg,audio/m4a,audio/aac
|
|
|
|
# Allowed file extensions (comma-separated)
|
|
# ALLOWED_FILE_EXTENSIONS=.jpg,.jpeg,.png,.gif,.webp,.heic,.mp4,.avi,.mov,.webm,.m4v,.mp3,.wav,.ogg,.m4a,.aac
|
|
|
|
# Signed media URL TTL in seconds (for images and general media)
|
|
# Default 5 minutes
|
|
# MEDIA_SIGNED_URL_TTL_SECONDS=300
|
|
|
|
# Signed video URL TTL in seconds (for video streaming, longer to support playback of large files)
|
|
# Default 20 mins
|
|
# MEDIA_SIGNED_URL_VIDEO_TTL_SECONDS=1200
|
|
|
|
# Signed thumbnail URL TTL in seconds (used for caching thumbnails)
|
|
# Default 24 hours
|
|
# MEDIA_THUMBNAIL_SIGNED_URL_TTL_SECONDS=86400
|
|
|
|
# Grace period in seconds for signed media URL expiration checks
|
|
# MEDIA_SIGNED_URL_GRACE_SECONDS=60
|
|
|
|
|
|
# ============================================================================
|
|
# LOGGING
|
|
# ============================================================================
|
|
|
|
# LOG_LEVEL=INFO
|
|
# LOG_FILE=
|
|
# LOG_DIR=/data/logs
|
|
|
|
|
|
# ============================================================================
|
|
# EXTERNAL API CONFIGURATION
|
|
# ============================================================================
|
|
|
|
# OpenWeather API keys for weather data fetching
|
|
# Get your free API key at: https://openweathermap.org/api
|
|
# Weather service is optional - if not configured, weather features will be disabled
|
|
# OPEN_WEATHER_API_KEY_25=your-openweather-2-5-api-key-here
|
|
# OPEN_WEATHER_API_KEY_30=your-openweather-3-0-api-key-here
|
|
|
|
|
|
# ============================================================================
|
|
# RATE LIMITING
|
|
# ============================================================================
|
|
|
|
# Enable rate limiting (protects login endpoints)
|
|
# RATE_LIMITING_ENABLED=true
|
|
|
|
# Backend for rate-limit storage (default: in-memory)
|
|
# Example for Redis: redis://localhost:6379/1
|
|
# RATE_LIMIT_STORAGE_URI=memory://
|