# Standard Notes – self-hosted backend example .env
# Mirrors https://github.com/standardnotes/server/blob/main/.env.sample
# with annotations specific to the Unraid community template.
#
# This file is for reference / non-Unraid use only. The Unraid template
# exposes every variable below as a UI field.

######
# DB #
######

# IP address of your MariaDB container, reachable from the
# Standard Notes server. The Unraid template asks for an IP
# (e.g. 192.168.x.x) — IPs are unambiguous across bridge / br0 /
# VLAN setups. Use a static / DHCP-reserved address.
DB_HOST=192.168.x.x
DB_PORT=3306
DB_USERNAME=std_notes_user
DB_PASSWORD=replace-with-strong-password
DB_DATABASE=standard_notes_db
# Internal driver value REQUIRED for MariaDB. Standard Notes / TypeORM
# uses the "mysql" driver string to talk to MariaDB. Do not change.
DB_TYPE=mysql

#########
# CACHE #
#########

# IP address of your Redis container, e.g. 192.168.x.x.
# This template does not expose a Redis password — the official
# standardnotes/server image does not document a Redis-auth env var.
# Keep Redis on a trusted VLAN / private bridge.
REDIS_HOST=192.168.x.x
REDIS_PORT=6379
CACHE_TYPE=redis

########
# KEYS #
########
# Generate each with: openssl rand -hex 32
# Treat as write-once: rotating AUTH_SERVER_ENCRYPTION_SERVER_KEY
# renders existing server-side data unreadable.
AUTH_JWT_SECRET=
AUTH_SERVER_ENCRYPTION_SERVER_KEY=
VALET_TOKEN_SECRET=

############
# OPTIONAL #
############
# PUBLIC_FILES_SERVER_URL — FULL HTTPS URL of the files server,
# INCLUDES https://. Set only when you reverse-proxy the files server
# on its own subdomain (recommended for full attachment support).
# Leave empty (or commented out) if you do not need attachments — note
# creation, editing, and sync work without it. Single-domain path
# proxying (one host, /files/* prefix) is not reliably supported by
# the upstream image.
#
# Reminder: the files service listens on container port 3104; the
# upstream docker-compose.example.yml publishes that as host port
# 3125 (3125:3104). Forward your reverse proxy to host port 3125,
# NOT 3104.
# PUBLIC_FILES_SERVER_URL=https://files.standardnotesserver.mydomain.tld

# COOKIE_DOMAIN — BARE DOMAIN ONLY. No protocol, NO https://, no
# trailing slash, no path. Behind a reverse proxy this MUST match the
# public sync host, and the proxy must serve HTTPS — otherwise Secure
# cookies are dropped and the server logs:
#   "No cookies provided for cookie-based session token"
# which can trigger a /v1/items sync loop and (in turn) note
# duplication. Leave empty only for direct localhost access.
#
# Quick reference — where https:// belongs:
#   COOKIE_DOMAIN              = standardnotesserver.mydomain.tld         (bare domain, no https://)
#   PUBLIC_FILES_SERVER_URL    = https://files.standardnotesserver.mydomain.tld   (full HTTPS URL)
#   Custom Sync Server (client) = https://standardnotesserver.mydomain.tld         (full HTTPS URL)
#
# See docs/sync-loop-troubleshooting.md.
# COOKIE_DOMAIN=standardnotesserver.mydomain.tld