# GeoMetrikks configuration - the short list. Full reference: docs/configuration.md

# Login for the web UI (required unless APP_AUTH_DISABLED=true)
APP_ADMIN_USER=admin
APP_ADMIN_PASSWORD=

# Set true ONLY behind an authenticating reverse proxy (Authelia, Tailscale...)
APP_AUTH_DISABLED=false

# Mark the session cookie Secure (browsers then only send it over HTTPS).
# Recommended when serving behind a TLS reverse proxy.
APP_SESSION_SECURE=false
# Reverse-proxy IPs/CIDRs allowed to supply X-Forwarded-For (used for login
# logging). One value, comma-separated, or a JSON list. Empty = never trust
# forwarded headers.
APP_TRUSTED_PROXIES=

# MaxMind GeoLite2 auto-download (free account: maxmind.com/en/geolite2/signup)
MAXMINDDB_USER_ID=
MAXMINDDB_LICENSE_KEY=

# CARTO basemap API key (free: carto.com/basemaps/apikey). CARTO's terms
# require one per deployment. The key is sent to the browser, so treat it
# as public. Optional today; keyless tiles may stop working at any time.
MAP_CARTO_API_KEY=

# Access log(s) to tail (nginx, Traefik JSON or Caddy JSON) - a single path
# or JSON list. The compose file mounts $ACCESS_LOG_DIR (default
# /var/log/nginx) read-only at /var/log/access inside the container. See
# the README for nginx, Nginx Proxy Manager, Traefik and Caddy setup.
LOGPARSER_LOG_PATHS=/var/log/access/access.log

# Format of the file(s) above: auto (default, detected per file),
# geometrikks-json, nginx, traefik-json, or caddy-json. Only needed if you
# want to pin a format instead of detecting.
#LOGPARSER_LOG_FORMATS=auto

# Or read the access log lines from Grafana Loki. See "Loki setup" in
# the README. To read Loki only, also comment out the LOGPARSER_LOG_PATHS
# line above, or that file is still tailed. Leave both set to read files and
# Loki side by side.
#LOKI_URL=http://loki:3100
#LOKI_QUERIES={job="traefik"}

# A name you choose for this server, stamped on every ingested event. Not your
# nginx server_name. Defaults to the machine hostname. The old name,
# LOGPARSER_HOST_NAME, still works until 1.0.
LOGPARSER_SERVER_NAME=my-server

# Database password (used by both containers; change from the default)
DB_PASSWORD=geopass

# Uid/gid the app runs as; ./logs is chowned to this at startup. Match your
# host user (id -u / id -g) if host tools need to manage the log files.
PUID=1000
PGID=1000

# Optional: CrowdSec integration (read-only decision views + ban stats)
# docker exec crowdsec cscli bouncers add geometrikks  -> prints the API key
#CROWDSEC_LAPI_URL=http://crowdsec:8080
#CROWDSEC_BOUNCER_API_KEY=jhsf77SJHhsg87
# Optional: also allow ban/unban from the UI
# docker exec crowdsec cscli machines add geometrikks --auto -> id + password
#CROWDSEC_MACHINE_ID=
#CROWDSEC_MACHINE_PASSWORD=