# WireHub install settings — all optional. The stack runs with no .env at all:
# the bootstrap service generates every secret into the `secrets` volume on
# first run. Copy this file to .env (or paste the lines you need into your
# Docker UI's environment box) only to change something. Every line is
# commented out; uncomment and edit. The config generator writes a ready .env
# for you: https://formless63.github.io/wirehub/
#
# This file is for the install: where things are, ports, the optional parts.
# How the hub behaves — sign-in methods, allowed emails, alerts, the git
# mirror, job settings — is set in the app under Settings and applies without
# a redeploy (docs/self-hosting.md, "What lives where"). Those variables are
# listed at the end: optional, usually set in Settings.
#
# compose.yaml reads these. Never commit a .env with secrets in it.

# --- optional parts ------------------------------------------------------
# Profiles to start beside the default stack (app + Postgres + Garage),
# comma-separated:
#   backup   restic backups through Backrest (see "backups" below)
#   pdf      the browser PDF engine (see "printed PDFs" below)
# COMPOSE_PROFILES=backup

# --- the app -------------------------------------------------------------
# The image. Pinned to the release this compose.yaml came from; set a newer
# tag to upgrade, or a locally built image (docs/self-hosting.md, development).
# WIREHUB_IMAGE=ghcr.io/formless63/wirehub:0.8.0 # x-release-please-version
# The address people open WireHub at (sign-in links and the setup banner use it).
# Behind a reverse proxy: https://wirehub.example.com
# WIREHUB_PUBLIC_URL=http://localhost:5183
# Host address and port the app is published on. 127.0.0.1 keeps it on this
# machine; 0.0.0.0 serves your network (put a TLS proxy in front).
# WIREHUB_BIND=127.0.0.1
# WIREHUB_PORT=5183
# Container time zone (log timestamps, the backup schedule).
# TZ=UTC
# Domain modules to pre-tick at first-run setup (you still decide there):
# pc-serial, networking, pro-audio, av-video, automotive.
# WIREHUB_SUGGESTED_MODULES=pc-serial,networking
# Storage backend: pg (the default) keeps the catalog, designs, versions,
# accounts and the history of every save in PostgreSQL; files keeps them as
# JSON in the `catalog` volume (a small single-user hub; with
# WIREHUB_ENV=prod it also needs WIREHUB_ALLOW_FILES_IN_PROD=1).
# WIREHUB_BACKEND=pg
# WIREHUB_ALLOW_FILES_IN_PROD=
# The organisation this hub serves, when the database holds more than one.
# WIREHUB_ORG=
# prod (default) or dev: a development copy shows a DEV badge, and refuses to
# start when its database or bucket matches a production marker below
# (comma-separated pieces of production's database host/name and bucket).
# WIREHUB_ENV=prod
# WIREHUB_PROD_MARKERS=
# Behind a reverse proxy you trust (Caddy, Traefik, nginx): 1 makes the
# studio read X-Forwarded-For / -Proto / -Host (client addresses for rate
# limits, the address people opened). Leave unset otherwise.
# WIREHUB_TRUST_PROXY=1
# Who a hub without sign-in names in versions and the audit log.
# WIREHUB_LOCAL_USER=Workshop

# Catalog store (Library, Browse store): the signed store indexes this hub
# trusts, comma separated, each "<https index url> <minisign public key>".
# An index whose signature does not match its key is refused. `official` is
# WireHub's own index once its key is published; unset = that default (none
# yet); empty or `none` = no store. See docs/catalog-store.md.
# WIREHUB_STORE_INDEXES=https://packs.example.com/store/index.json RW<the store public key>
# --- printed PDFs (profile pdf) -------------------------------------------
# The build sheet, BOM, continuity spec, drawing and wire spec sheets as PDF,
# exactly as a browser prints them, through Gotenberg (headless Chromium) in
# the `pdf` profile's service. Needs COMPOSE_PROFILES to include pdf, and
# about 1 GB of memory more. Unset = the plain text-layout PDFs, and the
# X-WireHub-PDF-Fallback response header says so (the address can also be
# set later in Settings > Integrations). docs/self-hosting.md.
# WIREHUB_PDF_ENGINE_URL=http://pdf:3000

# --- secrets (generated by the bootstrap service) -------------------------
# Leave these unset and they are generated once and kept in the `secrets`
# volume. Set one to choose it yourself; an explicit value always wins (and
# is written to the volume). scripts/setup-env.sh fills them in for you.
# POSTGRES_PASSWORD=
# BETTER_AUTH_SECRET=
# Encrypts the secrets entered in Settings (SMTP password, OIDC client
# secret, webhook): keep a copy with your backup password.
# WIREHUB_SETTINGS_KEY=
# GARAGE_RPC_SECRET=
# GARAGE_ADMIN_TOKEN=
# The one-time code /setup asks for; printed in the wirehub service's log.
# WIREHUB_SETUP_CODE=

# --- your own PostgreSQL (instead of the bundled one) ----------------------
# Delete the "bundled-postgres" blocks from compose.yaml, then:
# An admin connection (a role that may create roles and the database): the
# migrate service creates WireHub's roles (studio_owner, studio_app, studio_ro)
# through it, and their connections are derived from it.
# DATABASE_ADMIN_URL=postgres://postgres:password@db.example.com:5432/wirehub
# Or give each connection yourself (a managed database without a superuser):
# DATABASE_OWNER_URL=
# DATABASE_URL=
# The roles' passwords (generated when unset):
# WIREHUB_OWNER_PASSWORD=
# WIREHUB_APP_PASSWORD=
# WIREHUB_RO_PASSWORD=

# --- uploaded files: S3-compatible storage --------------------------------
# s3: the bundled Garage (default) or your own S3; fs:/data/blobs: a volume
# instead (the fallback without object storage).
# WIREHUB_BLOBS=s3
# Your own S3 (AWS, MinIO, RustFS, Backblaze B2, Cloudflare R2 …; path-style
# addressing): delete the "bundled-s3" blocks from compose.yaml, then set:
# S3_ENDPOINT=https://s3.example.com
# S3_REGION=us-east-1
# S3_BUCKET=wirehub
# S3_ACCESS_KEY_ID=
# S3_SECRET_ACCESS_KEY=
# A read-only key for the backup mirror (else the app's key is used):
# S3_BACKUP_ACCESS_KEY_ID=
# S3_BACKUP_SECRET_ACCESS_KEY=
# With the bundled Garage, its keys are created by Garage and kept in the
# `secrets` volume; set the four S3_*KEY* variables only to import your own.
# Space Garage may use (K, M, G, T; powers of 1000):
# GARAGE_CAPACITY=100G

# --- code modules (docs/self-hosting.md, "Code modules") ---------------------
# Owners install modules that run code from a store or a signed upload. false
# turns every one of them off, whatever Settings says (the built-in modules
# still run); set it on the app and the worker:
# WIREHUB_ALLOW_CODE_MODULES=false
# Settings > Restart WireHub exits the app for its restart policy to start it
# again; compose sets this, another supervisor should too:
# WIREHUB_RESTART_SUPERVISED=true
# Where imported code modules are written (a cache; default the temp directory):
# WIREHUB_MODULE_CACHE_DIR=/tmp/wirehub-code-modules

# --- background jobs: the worker service (docs/self-hosting.md, "Jobs") ----
# off: the app runs the jobs itself (then remove the worker service from
# compose.yaml, and give the app the worker's memory for STEP conversion).
# WIREHUB_WORKER=off
# A STEP conversion that needs more than this (MB) is refused, inside the
# worker's 1.5 GiB cap:
# WIREHUB_STEP_RSS_LIMIT_MB=1280
# The folder imported models are built from (mount it into the worker):
# WIREHUB_MODEL_SOURCES=/data/model-sources

# --- the git mirror (optional; docs/self-hosting.md, "History and the git mirror")
# Every change set as a commit to a git remote: set it up in Settings >
# Integrations (remote, branch, schedule, deploy key or token). Here only the
# other form, a repository mounted into the worker (a mount is the install's):
# WIREHUB_GIT_MIRROR_PATH=/data/git-mirror

# --- sign-in (apps/studio/README.md, "Auth") --------------------------------
# On by default: first-run setup (/setup) makes the admin's email + password
# account; the admin invites everyone else (People, in the studio's rail).
# Single sign-on (OIDC), magic links (SMTP) and allowed emails are set in the
# app, Settings > Sign-in & accounts. false lets anyone who can reach the port
# edit — only on a machine nobody else reaches.
# AUTH_ENABLED=true

# --- backups (COMPOSE_PROFILES=backup) --------------------------------------
# Where restic keeps snapshots. Unset: a repository in the `restic_repo`
# volume on this machine — it protects against mistakes, not against losing
# the disk. Set one elsewhere: rest:https://user:pass@nas.example:8000/wirehub,
# s3:https://s3.example.com/bucket/wirehub, sftp:user@host:/srv/wirehub …
# Read at first start only; afterwards change it in Backrest's UI.
# BACKUP_REPOSITORY=
# The repository's password. Unset: generated and kept in the `secrets`
# volume — copy it somewhere safe, a backup cannot be restored without it.
# Required to use an existing repository.
# BACKUP_REPOSITORY_PASSWORD=
# Credentials for an s3: repository.
# BACKUP_AWS_ACCESS_KEY_ID=
# BACKUP_AWS_SECRET_ACCESS_KEY=
# When snapshots run (cron: minute hour day month weekday).
# BACKUP_SCHEDULE=0 3 * * *
# Daily pg_dump time (HH:MM, TZ above) and how many dumps to keep locally.
# The dump connects as the read-only role studio_ro.
# BACKUP_DUMP_AT=02:30
# BACKUP_KEEP_DUMPS=7
# The weekly restore check (0-6, 0 = Sunday): the newest dump restored into a
# scratch database and its row counts compared.
# BACKUP_CHECK_DAY=0
# Seconds between mirrors of the bucket.
# BACKUP_MIRROR_INTERVAL=3600
# Backrest's web UI.
# BACKREST_BIND=127.0.0.1
# BACKREST_PORT=9898

# --- set in the app (Settings): optional here, usually set there -----------
# Each of these is a runtime setting (docs/self-hosting.md, "What lives
# where"): an owner sets it under Settings and it applies at once. Set here,
# it wins and Settings shows it read-only ("set by the server") — but the
# default compose.yaml no longer passes them to the containers: to pin one,
# add it under the service's `environment:` in a compose.override.yaml (the
# wirehub service; the worker too for alerts, the git mirror and job settings).
#
# Settings > Notifications
# WIREHUB_NOTIFY_URL=https://ntfy.example.com/wirehub
# WIREHUB_NOTIFY_FORMAT=ntfy
# WIREHUB_NOTIFY_TOKEN=
# Settings > Sign-in & accounts
# AUTH_LOCAL_ACCOUNTS=true
# AUTH_ALLOWED_EMAILS=you@example.com
# GitHub / Google are off by default. Prefer Settings; first-run provider-only
# setup needs an explicit compose override. Set WIREHUB_PUBLIC_URL first.
# Exact callbacks: <public URL>/api/auth/callback/github
# and <public URL>/api/auth/callback/google.
# AUTH_GITHUB_ENABLED=false
# AUTH_GITHUB_CLIENT_ID=
# AUTH_GITHUB_CLIENT_SECRET=
# AUTH_GOOGLE_ENABLED=false
# AUTH_GOOGLE_CLIENT_ID=
# AUTH_GOOGLE_CLIENT_SECRET=
# Secrets also support AUTH_GITHUB_CLIENT_SECRET_FILE / AUTH_GOOGLE_CLIENT_SECRET_FILE.
# AUTH_OIDC_ISSUER=https://id.example.com
# AUTH_OIDC_CLIENT_ID=
# AUTH_OIDC_CLIENT_SECRET=
# AUTH_OIDC_SCOPES=openid email profile
# AUTH_OIDC_EMAIL_CLAIM=email
# AUTH_OIDC_PROVIDER_ID=oidc
# AUTH_OIDC_NAME=Single sign-on
# AUTH_SMTP_HOST=
# AUTH_SMTP_PORT=587
# AUTH_SMTP_SECURE=false
# AUTH_SMTP_USER=
# AUTH_SMTP_PASS=
# AUTH_SMTP_FROM=wirehub@example.com
# WIREHUB_TOKEN_READS_PER_MINUTE=600
# WIREHUB_TOKEN_WRITES_PER_MINUTE=60
# WIREHUB_TOKEN_WRITES_PER_DAY=1000
# Settings > Integrations
# WIREHUB_STORE_HIDE_UNREVIEWED=true
# WIREHUB_STORE_ALLOW_USER_SOURCES=true
# WIREHUB_PDF_ENGINE_TIMEOUT_MS=30000
# WIREHUB_GIT_MIRROR_URL=ssh://git@git.example.com/workshop/catalog.git
# WIREHUB_GIT_MIRROR_BRANCH=main
# WIREHUB_GIT_MIRROR_CRON=*/5 * * * *
# WIREHUB_GIT_MIRROR_USER=wirehub
# WIREHUB_GIT_MIRROR_TOKEN_FILE=/run/secrets/git-mirror-token
# WIREHUB_GIT_MIRROR_SSH_KEY_FILE=/run/secrets/git-mirror-key
# WIREHUB_GIT_MIRROR_KNOWN_HOSTS_FILE=/run/secrets/git-mirror-known-hosts
# Settings > Jobs & limits
# WIREHUB_CONVERT_WINDOW=01:00-06:00
# WIREHUB_IMPORT_MAX_MB=100
# WIREHUB_BACKUP_MAX_AGE_HOURS=30
# Outbound event webhooks (Settings > Webhooks): seconds to wait before each retry (default 30,120,600,3600,21600)
# WIREHUB_WEBHOOK_BACKOFF=30,120,600,3600,21600