# Copy to .env next to compose.yaml and fill in. docker compose reads it on every command.
# Any setting in compose.yaml can be overridden here the same way (NAME=value).

# --- required ---

# Hashes scanner tokens and sign-in sessions. A long random string, for example the output of
# `openssl rand -hex 32`. Keep it for good: changing it invalidates every token and session.
JAVV_SECRET_KEY=

# The first admin's password. Used once, when the admin does not exist yet; the first sign-in
# asks for a new one of 12 characters or more.
JAVV_BOOTSTRAP_ADMIN_PASSWORD=

# --- the one choice to make ---

# How browsers reach JAVV.
#   Through https (a proxy or load balancer in front that terminates TLS): leave this line out.
#   Over plain http, for example http://<this machine>:8080 on a LAN: keep it, or sign-in fails
#   on the next request, since a browser keeps a Secure cookie only from https or localhost.
JAVV_SESSION_COOKIE_SECURE=false

# --- often changed ---

# The zone the background job schedules are read in, for example Europe/Bucharest.
# TZ=UTC

# OpenSearch heap. Raise it with the data: 1g suits a few clusters.
# OPENSEARCH_JAVA_OPTS=-Xms1g -Xmx1g

# OpenSearch's admin password: the compose store takes it on its first start with its login on.
# Used once: to change it later, see docs/UPGRADING.md.
# OpenSearch's rules: 8 characters or more, with an upper-case letter, a lower-case letter, a
# digit and a special character, and not a common password such as Password123!.
# Compose substitutes an unquoted $name in this file: write a $ as $$, or single-quote
# the whole value. A space before # ends an unquoted value, and trailing spaces are dropped.
# OpenSearch's admin password: it stays with OpenSearch, the backend never gets it
JAVV_OPENSEARCH_ADMIN_PASSWORD=
# the javv user's password: the backend signs in to OpenSearch with it
JAVV_OPENSEARCH_PASSWORD=