# NAS Storage Analyzer: all settings. Copy to .env (or run ./scripts/init-env.sh, which also fills
# in the secrets). docker compose reads .env automatically.
# The variables were called NASA_* before v0.2.0. An .env that still has the old names is refused: sed -i 's/^NASA_/NASSA_/' .env

# ---- Which build -------------------------------------------------------------------------------
# latest: the stable image (the default). beta: the build every change lands in first; it shows a "beta"
# label in the interface. Or a version number to pin, for example 0.2.0. Use a separate DATA_PATH for beta.
# Until the first promotion to main has been published there is no "latest" image: use beta, or build it
# yourself (docker compose -f docker-compose.yml -f docker-compose.build.yml up -d --build).
NASSA_TAG=latest

# ---- Where the data lives (required) ------------------------------------------------------------
# Everything that must not be lost (the database: DATA_PATH/postgres) lives in this one folder on the host.
# They are plain folders, never Docker volumes, so a rebuild, an update or `docker compose down -v` cannot lose them.
# It MUST be an ABSOLUTE folder of the machine Docker runs on, never ./data: a relative path is resolved by
# whatever tool starts the stack (Dockhand on Unraid has put it in the RAM disk, gone at the next reboot; a fresh
# checkout starts with an empty database).
# Unraid: a folder on the array or cache, for example /mnt/cache/appdata/nas-storage-analyzer (a disk path skips the
# FUSE layer of /mnt/user) or /mnt/user/appdata/nas-storage-analyzer; never /appdata or /data, which are the RAM disk.
# Other servers: /srv/nas-storage-analyzer, on a local disk.
# An installation that kept its database in the Docker volume db-data (before this setting existed) is moved with
# `sh scripts/migrate_data.sh` on the host; docs/deploy.md has the steps. Back up the whole folder.
DATA_PATH=/srv/nas-storage-analyzer

# ---- Secrets (required) -------------------------------------------------------------------------
# Password of the database user. Letters and digits are safest.
NASSA_DB_PASSWORD=
# 32 random bytes, base64: `openssl rand -base64 32` (or `docker run --rm nas-storage-analyzer genkey`).
# Encrypts the stored SMB passwords. Back it up together with the database.
NASSA_ENCRYPTION_KEY=
# Needed once to create the first administrator. Empty: a random token is printed in the log of the
# app container (`docker compose logs app`).
NASSA_SETUP_TOKEN=

# ---- Where it listens ---------------------------------------------------------------------------
# 127.0.0.1: only this machine (put a reverse proxy in front). 0.0.0.0: every network interface.
NASSA_HTTP_BIND=127.0.0.1
NASSA_HTTP_PORT=8080

# ---- Behind a reverse proxy (see docs/deploy.md) ------------------------------------------------
# The proxy's address(es) or network(s). Only from these are X-Forwarded-For/-Proto/-Host believed.
NASSA_TRUSTED_PROXIES=
# Refuse sign-in over plain http (unless a trusted proxy says the browser used https).
NASSA_REQUIRE_HTTPS=false
# Passkeys (WebAuthn) are bound to a host name: set it explicitly in production. The ID is the host
# name without port, the origins are the full addresses people open in the browser.
#   NASSA_RP_ID=nas.example.com
#   NASSA_RP_ORIGINS=https://nas.example.com
NASSA_RP_ID=
NASSA_RP_ORIGINS=
# The address people reach the app on, for the invitation links an administrator makes (Settings > Users): https://nas.example.com
# Empty: the first NASSA_RP_ORIGINS, then the address the administrator is using. Set it when the administrator opens the app on a LAN address
# but the guest has to use the public one.
NASSA_PUBLIC_URL=
NASSA_RP_NAME=NAS Storage Analyzer
# Bearer token for /metrics (Prometheus). Empty: /metrics answers only to loopback clients, which
# from outside the container means nobody.
NASSA_METRICS_TOKEN=

# ---- Scanning -----------------------------------------------------------------------------------
# The ABSOLUTE folder on the Docker host that holds the mounted shares. Shared read-only with app and worker.
# Required, and never relative: a relative path is resolved by the tool that starts the stack (under Dockhand
# ./shares became a folder inside Dockhand's own data folder, not your shares).
NASSA_SHARES_DIR=/srv/shares
# Where that folder appears inside the containers, and so the path you type in the interface when
# you add a share. Default /mnt/shares. Set it to the same value as NASSA_SHARES_DIR and the paths in
# the interface are the paths on the host, for example on Unraid:
#   NASSA_SHARES_DIR=/mnt/user
#   NASSA_SHARES_MOUNT=/mnt/user
# Must be an absolute path that the image does not use itself: not /, /usr, /etc, /tmp or /run.
NASSA_SHARES_MOUNT=/mnt/shares
# A group the containers join so they can read your shares. They run as uid 10001, which is neither the owner nor in
# the group of a folder with mode 770 (drwxrwx---), the usual case on Unraid: the folder picker and the scan then say
# "permission denied". Set it to the numeric group that owns the shares: on Unraid that is 100 (users); `ls -ln` on a
# share shows it. The default is the image's own group, which changes nothing.
NASSA_SHARES_GID=10001
# rprivate (default) works everywhere and shows the mounts that exist when the containers start; restart
# the containers after the host remounts a share. rslave also shows mounts the host makes later (autofs, a
# NAS that boots later), but Docker refuses it unless the host mount is shared or slave (not on Unraid).
NASSA_SHARES_PROPAGATION=rprivate
# Time zone for cron schedules and the day/night throttle.
NASSA_TZ=Europe/Amsterdam
# Scans that may run at the same time.
NASSA_WORKER_PARALLEL=2

# ---- Database tuning (docs/deploy.md has a table by RAM) ----------------------------------------
PG_SHARED_BUFFERS=512MB
PG_EFFECTIVE_CACHE_SIZE=2GB
PG_WORK_MEM=32MB
PG_PARALLEL_WORKERS=2
PG_RANDOM_PAGE_COST=1.5

# ---- Update check ---------------------------------------------------------------------------------
# The app asks github.com whether a newer release exists and tells the administrator (a banner, and Settings > System). It only announces:
# nothing is updated, restarted or downloaded. It sends nothing about your installation (a fixed User-Agent: no version, no id, no user data;
# GitHub sees your server's address like for any request). On by default; false, 0, no or off switches it off, for a server that must not call out.
NASSA_UPDATE_CHECK=true

# ---- Rarely needed ------------------------------------------------------------------------------
NASSA_DB_NAME=nasa
NASSA_DB_USER=nasa
# Only read by docker-compose.build.yml, which builds the image from a checkout: the version and commit it reports.
#NASSA_VERSION=dev
#NASSA_COMMIT=