# Meshtastic Node Configuration # IP address of your Meshtastic node MESHTASTIC_NODE_IP=192.168.1.100 # TCP port for Meshtastic node connection (default: 4403) MESHTASTIC_TCP_PORT=4403 # TCP Connection Timing (OPTIONAL - for advanced troubleshooting) # Initial TCP connection timeout in milliseconds (default: 10000 = 10 seconds) # MESHTASTIC_CONNECT_TIMEOUT_MS=10000 # Reconnect backoff: initial delay and maximum delay in milliseconds # Reconnects use exponential backoff: initial * 2^(attempt-1), capped at max # Set initial = max for a fixed delay between reconnects # MESHTASTIC_RECONNECT_INITIAL_DELAY_MS=1000 # MESHTASTIC_RECONNECT_MAX_DELAY_MS=60000 # Delay between consecutive module config requests in milliseconds (default: 100) # Increase if your node shows queue overflow during config loading # MESHTASTIC_MODULE_CONFIG_DELAY_MS=100 # Number of traceroute history rows to keep per node pair (default: 50) # Increase for longer-term route trend analysis. # TRACEROUTE_HISTORY_LIMIT=50 # MeshCore sources are configured through the UI (Sources sidebar). The legacy # 3.x `MESHCORE_*` environment-variable bootstrap was removed in 4.6 — add a # MeshCore source from the dashboard's Sources panel instead. # Virtual Node Server Configuration (OPTIONAL) # Enable virtual node server that acts as a proxy for mobile apps # When enabled, multiple Meshtastic mobile apps can connect to this server # instead of directly to the physical node, reducing load on the physical node # ENABLE_VIRTUAL_NODE=false # Virtual Node TCP port (default: 4404) # The port where mobile apps can connect using Meshtastic TCP protocol # VIRTUAL_NODE_PORT=4404 # Allow admin commands through virtual node (default: false) # WARNING: Enabling this reduces security by allowing clients to send admin commands # Only enable if you need multiple services (e.g., MeshMonitor + Home Assistant) accessing the same node # When disabled (default), only self-addressed admin commands are allowed for device info queries # VIRTUAL_NODE_ALLOW_ADMIN_COMMANDS=false # Security Notes: # - Admin commands (ADMIN_APP, NODEINFO_APP) are blocked by default for security # - Set VIRTUAL_NODE_ALLOW_ADMIN_COMMANDS=true to allow admin commands (use with caution) # - Messages are queued and serialized to prevent overwhelming the physical node # - All connected clients receive broadcasts from the physical node # - Text messages, positions, telemetry, and traceroutes are proxied bidirectionally # Base URL for serving the application (optional) # Set this if you're serving MeshMonitor from a subfolder (e.g., /meshmonitor) # Leave empty or comment out to serve from root (/) # BASE_URL=/meshmonitor # Authentication & Session Configuration # Session secret for cookie encryption (REQUIRED for production) # Generate a secure random string: openssl rand -base64 32 # SESSION_SECRET=your-secure-random-string-here # Session cookie lifetime in milliseconds (default: 86400000 = 24 hours) # SESSION_MAX_AGE=86400000 # Reset session expiry on each request (default: true) # When true, active users stay logged in indefinitely. When false, sessions expire at original login time + SESSION_MAX_AGE # SESSION_ROLLING=true # Cookie security settings # COOKIE_SECURE: Require HTTPS for cookies (default: true in production, false in development) # Set to false if accessing over HTTP in production (not recommended) # COOKIE_SECURE=false # COOKIE_SAMESITE: SameSite cookie policy (strict, lax, or none) # Default: lax (recommended for production with reverse proxies) # Use 'lax' for most cases - it's secure and works with reverse proxies # Use 'strict' only if you need extra security and don't use reverse proxies # COOKIE_SAMESITE=lax # Reverse Proxy Configuration # TRUST_PROXY: Trust reverse proxy headers (X-Forwarded-Proto, X-Forwarded-For, etc.) # Required when using HTTPS reverse proxy (nginx, Traefik, Caddy, etc.) # Values: true, false, 1 (number of hops), IP address, or CIDR range # Default: 1 in production, unset in development # TRUST_PROXY=true # CORS Configuration # ALLOWED_ORIGINS: Comma-separated list of allowed origins for CORS # Default: http://localhost:8080,http://localhost:3001 (if not specified) # # For localhost access (most common for Docker deployments): # ALLOWED_ORIGINS=http://localhost:8080 # # For access via server IP address: # ALLOWED_ORIGINS=http://192.168.1.50:8080 # # For multiple access methods (localhost AND server IP): # ALLOWED_ORIGINS=http://localhost:8080,http://192.168.1.50:8080 # # For production with HTTPS: # ALLOWED_ORIGINS=https://meshmonitor.example.com # # Multiple HTTPS domains: # ALLOWED_ORIGINS=https://meshmonitor.example.com,https://mesh.example.com # # Wildcard (NOT recommended for production, testing only): # ALLOWED_ORIGINS=* # # For production deployments, it's best practice to explicitly set this value ALLOWED_ORIGINS=http://localhost:8080 # Iframe Embedding Configuration # IFRAME_ALLOWED_ORIGINS: Comma-separated list of origins allowed to embed # MeshMonitor in an