# deploy/docker/.env.example — Copy to .env and fill in the values.
#
# NEVER commit .env to version control — it contains secrets.

# ── Required (server) ─────────────────────────────────────────────────────────

# Secret key used to sign JWT access tokens. Must be at least 32 characters.
# Generate with: openssl rand -hex 32
ARKEEP_SECRET_KEY=

# Shared secret between server and all agents. Must match on both sides.
# Generate with: openssl rand -hex 24
ARKEEP_AGENT_SECRET=

# ── Required (agent only — docker-compose.agent.yml) ─────────────────────────

# gRPC address of the Arkeep server. Format: host:port — NO scheme (no https://).
# Example: ARKEEP_SERVER_ADDR=arkeep.example.com:9090
ARKEEP_SERVER_ADDR=

# ── Optional ──────────────────────────────────────────────────────────────────

# Host ports exposed by the server (defaults shown).
ARKEEP_HTTP_PORT=8080
ARKEEP_GRPC_PORT=9090

# Log verbosity: debug | info | warn | error
ARKEEP_LOG_LEVEL=info

# External base URL of the server, used to build links in outbound email
# (e.g. the password reset link). Include the scheme, no trailing slash.
# Example: ARKEEP_BASE_URL=https://arkeep.example.com
# Required for self-service password reset: when empty, reset emails are
# disabled (links are never derived from request headers, to prevent
# Host-header injection into password reset links).
ARKEEP_BASE_URL=

# Check GitHub (api.github.com) for new Arkeep releases to show the update
# indicator in the GUI. Set to false for air-gapped or egress-restricted
# installs: the server then never contacts GitHub.
ARKEEP_UPDATE_CHECK=true

# Timezone for log timestamps.
TZ=UTC

# Directory for server data (auto-PKI certs, JWT keys). Must be inside the
# mounted volume so it persists across container restarts.
ARKEEP_DATA_DIR=/var/lib/arkeep/data

# ── PostgreSQL (docker-compose.postgres.yml / docker-compose.postgres-all.yml) ──
#
# Set this when using the PostgreSQL variants. Leave empty for SQLite deployments.
#
# IMPORTANT: the full database DSN is constructed directly inside the compose
# YAML files and is NOT set here. .env values are treated as literal strings —
# variable interpolation (e.g. ${POSTGRES_PASSWORD}) does NOT work inside .env.
#
# Generate with: openssl rand -hex 16
POSTGRES_PASSWORD=

# ── gRPC TLS (server) ─────────────────────────────────────────────────────────
# Auto-PKI is active by default: the server generates a CA and server cert on
# first startup. No configuration is required for the standard setup.
#
# To use an external certificate instead (e.g. Let's Encrypt):
# mount the files into the container and uncomment the lines below.
# ARKEEP_GRPC_TLS_CERT=/etc/arkeep/tls/tls.crt
# ARKEEP_GRPC_TLS_KEY=/etc/arkeep/tls/tls.key

# ── gRPC TLS (agent) ──────────────────────────────────────────────────────────
# Auto-enrollment is active by default: the agent calls the server's HTTP API
# on first startup to obtain its client certificate. No configuration required.
#
# Override the enrollment HTTP address when the server is behind a reverse
# proxy (Traefik, Nginx, Caddy) — the derived http://<host>:8080 won't work:
# ARKEEP_SERVER_HTTP_ADDR=https://arkeep.example.com
# If port 8080 is exposed directly, the default is sufficient:
# ARKEEP_SERVER_HTTP_ADDR=http://arkeep.example.com:8080
#
# Only needed when the server uses an external cert from a non-system CA:
# ARKEEP_GRPC_TLS_CA=/etc/arkeep/tls/ca.crt
#
# Disable TLS on both server and agent (same-machine / dev only):
# ARKEEP_GRPC_INSECURE=true