.env.example

# ┌──────────────────────────────────────────────────────────┐
# │  Docker Dash — Environment Configuration                │
# │  Copy to .env and fill in your values                   │
# │  Generate secrets:                                       │
# │    node -e "console.log(require('crypto').randomBytes(48).toString('hex'))"  │
# └──────────────────────────────────────────────────────────┘

# ── Application ──────────────────────────────────────────
APP_ENV=production
APP_PORT=8101
# Auto-generated on first boot if left as default
APP_SECRET=generate-a-random-string-here
# BASE_URL=http://localhost:8101
# PUBLIC_URL=http://localhost:8101

# ── Admin Bootstrap ──────────────────────────────────────
# Initial admin password (used on first launch only, change it after login)
ADMIN_PASSWORD=admin

# ── Session ──────────────────────────────────────────────
SESSION_TTL_HOURS=24
# COOKIE_SECURE=false

# ── Security ─────────────────────────────────────────────
BCRYPT_ROUNDS=12
LOCKOUT_ATTEMPTS=10
LOCKOUT_DURATION_MS=1800000

# ── Rate Limiting ────────────────────────────────────────
RATE_LIMIT_API_MAX=100
RATE_LIMIT_API_WINDOW_MS=60000
RATE_LIMIT_LOGIN_MAX=5
RATE_LIMIT_LOGIN_WINDOW_MS=900000

# ── Data Retention ───────────────────────────────────────
STATS_INTERVAL_MS=10000
STATS_RAW_RETENTION_HOURS=24
STATS_1M_RETENTION_DAYS=7
STATS_1H_RETENTION_DAYS=7
STATS_1D_RETENTION_DAYS=90
AUDIT_RETENTION_DAYS=7
EVENT_RETENTION_DAYS=7

# ── Encryption ───────────────────────────────────────────
# Used to encrypt Git credentials, registry passwords, notification tokens
# Generate: node -e "console.log(require('crypto').randomBytes(32).toString('hex'))"
# Auto-generated on first boot if left as default
ENCRYPTION_KEY=change-me-to-a-random-32-char-hex

# ── Git Integration ──────────────────────────────────────
# GIT_DEPLOYMENT_RETENTION_DAYS=90
# GIT_POLLING_MIN_INTERVAL=60

# ── SSO / Header-Based Auth ─────────────────────────────
# Enable to trust X-Forwarded-User headers from Authelia/Authentik/Traefik
# WARNING: Only enable behind a trusted reverse proxy!
# ENABLE_SSO_HEADERS=false

# ── SMTP (optional, for email notifications) ─────────────
# SMTP_HOST=smtp.gmail.com
# SMTP_PORT=587
# SMTP_SECURE=false
# SMTP_USER=
# SMTP_PASSWORD=
# SMTP_FROM_NAME=Docker Dash
# SMTP_FROM_EMAIL=noreply@example.com

# ── Container Runtime Socket ─────────────────────────────
# Docker (default):    /var/run/docker.sock
# Podman (rootful):    /run/podman/podman.sock
# Podman (rootless):   /run/user/1000/podman/podman.sock
# DOCKER_SOCKET=/var/run/docker.sock

# ── Feature Flags ────────────────────────────────────────
# ENABLE_EXEC=true
# ENABLE_PRUNE=true
# ENABLE_CREATE=true
# ENABLE_REMOVE=true
# ENABLE_MULTI_HOST=false
# READ_ONLY_MODE=false

# ── Enterprise Security ─────────────────────────────────
# SECURITY_MODE=standard
# When 'strict': no token in login response body, no WS query-string auth,
# forced Secure+SameSite=Strict cookies, 8h session TTL, 90-day password expiry.
# Note: Bearer and API key auth still work via Authorization header (by design).
# SECURITY_MODE=strict
# PASSWORD_MAX_AGE_DAYS=90

# ── OIDC / OAuth2 (SSO via OpenID Connect) ────────
# Enable OIDC to allow "Sign in with SSO" on login page
# Supports any OIDC provider: Keycloak, Authentik, Azure AD, Google, Okta, etc.
# OIDC_ENABLED=false
# OIDC_ISSUER_URL=https://auth.example.com/realms/my-realm
# OIDC_CLIENT_ID=docker-dash
# OIDC_CLIENT_SECRET=your-client-secret
# OIDC_REDIRECT_URI=https://docker-dash.example.com/api/auth/oidc/callback
# OIDC_DEFAULT_ROLE=viewer

# ── S3 Cloud Backup ──────────────────────────────────────
# Automatically upload database backups to S3-compatible storage
# Supports: AWS S3, MinIO, Backblaze B2, DigitalOcean Spaces, Wasabi
# S3_ENABLED=false
# S3_ENDPOINT=https://s3.amazonaws.com
# S3_BUCKET=my-docker-dash-backups
# S3_ACCESS_KEY=AKIA...
# S3_SECRET_KEY=your-secret-key
# S3_REGION=us-east-1
# S3_BACKUP_SCHEDULE=0 3 * * *

# ── Advanced (rarely needed) ───────────────────────────
# APP_NAME=Docker Dash
# APP_HOST=0.0.0.0
# DB_PATH=/data/docker-dash.db
# SESSION_COOKIE=dd_session

# ── HTTPS (via Caddy reverse proxy) ─────────────────────
# To enable HTTPS: docker compose --profile tls up -d
# TLS_PORT=8443

# ── Proxy Configuration ─────────────────────────────
# Trust proxy setting for Express (affects req.ip, req.secure)
# 'loopback' = trust localhost only (production default)
# '10.0.0.1' = trust specific proxy IP
# 'true' = trust all proxies (development only!)
# TRUST_PROXY=loopback

# ── Onboarding as code (v8.16.0) ────────────────────────
# Path to an onboarding-declaration v1 JSON file. On startup Docker Dash applies
# it ONLY when the instance is still EMPTY — i.e. initial setup has not been
# completed, no non-default tenant exists, and no provisioning run has ever
# completed. On an already-provisioned instance it REFUSES, logs a warning and
# boots normally; it never overwrites an existing configuration. After a
# successful apply, initial setup is marked complete, so the very next boot with
# the same file is a no-op. To provision a populated instance use the
# authenticated, admin-only POST /api/onboarding/apply instead.
# The file may contain credentials — mount it read-only and keep it out of VCS.
# DD_ONBOARD_FILE=/data/onboarding.json