# This is the list of supported environment variables.
# You can set them with docker command or in docker-compose file.

#region Tugtainer App
# Application wide log level.
# Possible values: critical, error, warning, info, debug, trace.
# Default is info
LOG_LEVEL=
# This variable can be used to disable internal tugtainer-agent,
# for instance, if you cannot use docker.sock on this host, but want to monitor other remote hosts.
# Default is true (agent enabled)
AGENT_ENABLED=
# Secret for backend-agent requests signature.
# This variable is mandatory unless ALLOW_UNAUTHENTICATED_AGENT is true.
# Note that agent secret should be specified in the UI for each host (even local),
# because this variable applies to the agent only.
AGENT_SECRET=
# Allow unsigned requests to the agent.
# This setting is for development purposes.
# Default is false (AGENT_SECRET is mandatory)
ALLOW_UNAUTHENTICATED_AGENT=
# Disable authentication
# Default is empty which become False
DISABLE_AUTH=
# JWT tokens secret key.
# Default secret is autogenerated, so on every container startup
# the access tokens will become invalid and you have to login again.
JWT_SECRET_KEY=
# Default is HS256
JWT_ALGORITHM=
# Lifetime of the access token in minutes.
# Default is 5
ACCESS_TOKEN_LIFETIME_MIN=
# Lifetime of the refresh token in minutes.
# Default is 43200 (a month)
REFRESH_TOKEN_LIFETIME_MIN=
# Currently only sqlite is supported.
# Default is "sqlite+aiosqlite:////tugtainer/tugtainer.db"
DB_URL=
# Disable password authentication, in case you only want OIDC provider
# Default is empty which become False (password auth enabled)
DISABLE_PASSWORD=
# Path to the file with the password hash.
# Default is "/tugtainer/password_hash"
PASSWORD_FILE=
# Whether to use strict cookies.
# If true, you won't be able to sign-in without https access.
# Default is FALSE.
HTTPS=
# Authentication will only be possible on this domain.
# Default is empty, so any domain is allowed.
DOMAIN=
# Enable public API endpoints without authentication.
# Default is False
ENABLE_PUBLIC_API=
# Enable container update/rollback hooks (arbitrary shell commands run
# inside containers at points of the update lifecycle).
# This is a feature gate on top of the agent-side ALLOW_EXEC gate — both
# must be true for hooks to actually run on a given host.
# Default is False
ALLOW_HOOKS=
# Github API token to avoid rate limits when checking for a new version of the app
# Default is empty which limits the number of gh api requests and may cause errors
GH_TOKEN=
# Location of docker client config files
# Default is ~/.docker
# https://docs.docker.com/reference/cli/docker/#environment-variables
DOCKER_CONFIG=

#region Network security
# Allow only these schemes to be used in Apprise notifications.
# Default is empty, which allows all schemes.
# Example: "tgram,discord"
NOTIFICATION_ALLOW_SCHEMES=
# Allow these networks to be used in Apprise notifications.
# The app restricts access to local, private and reserved networks.
# You can use this variable to override the behavior.
# Default is empty.
# Example: "192.168.0.0/24,10.0.0.0/16"
NOTIFICATION_ALLOW_NETWORKS=
# Allow these endpoints to be used in Apprise notifications.
# This is more precise alternative to NOTIFICATION_ALLOW_NETWORKS.
# Default is empty.
# Example: "192.168.0.5:8888,10.0.0.5:9999"
NOTIFICATION_ALLOW_ENDPOINTS=
#endregion
#endregion

#region Tugtainer Agent
# Same as for the main image
LOG_LEVEL=
AGENT_SECRET=
ALLOW_UNAUTHENTICATED_AGENT=
# Allow the agent to execute arbitrary shell commands inside containers via
# POST /api/container/exec (used by the backend's container update hooks
# feature). Off by default so a single opted-in host can't be forced into
# running arbitrary commands just because ALLOW_HOOKS is true elsewhere.
# Default is false
ALLOW_EXEC=
AGENT_SIGNATURE_TTL=
DOCKER_CONFIG=
# This value is used to run the agent without direct socket mount.
# Address of the socket proxy, e.g. tcp://:socket-proxy:2375
# Default is empty
# https://docs.docker.com/reference/cli/docker/#environment-variables
DOCKER_HOST=
# Docker CLI timeout in seconds for typically fast operations e.g. inspect.
# It does not affect potentially long operations such as container create or image pull.
# Default is 15
DOCKER_TIMEOUT=
#endregion

#region OIDC Authentication
# Enable OIDC authentication
# Default is empty which become False
OIDC_ENABLED=
# OIDC provider's well-known configuration endpoint
# e.g. https://auth.example.com/.well-known/openid-configuration
OIDC_WELL_KNOWN_URL=
# OIDC client credentials
OIDC_CLIENT_ID=
OIDC_CLIENT_SECRET=
# Must match what's registered in your OIDC provider
# e.g. https://your-tugtainer-domain.com/api/auth/oidc/callback
OIDC_REDIRECT_URI=
# Space-separated scopes
# Default is "openid profile email"
OIDC_SCOPES=
#endregion