# Poznote Configuration
# Copy this file to .env and customize the values.
# Lines starting with # are optional settings left at their default.
# Changes apply when the containers are recreated: docker compose up -d

# =============================================================================
# WEB SERVER
# =============================================================================

# Port on which Poznote is reachable from your browser.
HTTP_WEB_PORT=8040

# Port the web server listens on inside the container (default 80, 8080 for
# the rootless image). Only needed with network_mode: host, where there is no
# port mapping and HTTP_WEB_PORT is unused. Leave it unset otherwise.
#POZNOTE_LISTEN_PORT=8040

# =============================================================================
# SIGN-IN (OIDC / SSO)
# =============================================================================

# Most OIDC settings (enabled, issuer, scopes, access control...) are managed
# from Settings > Admin Tools > OIDC / SSO. Only the client credentials and the
# SSO-only switch stay here.

# Client ID and secret from your OIDC application registration.
# Keep the secret private.
POZNOTE_OIDC_CLIENT_ID=your_client_id
POZNOTE_OIDC_CLIENT_SECRET=your_client_secret

# SSO-only sign-in. false (default) keeps the username/password login.
# true removes the login form, rejects password submissions server-side and
# hides the "Change Password" setting.
#
# IMPORTANT: while this is true nobody can sign in with a password, admins
# included, so there is no way back in from the browser if your identity
# provider goes down. Recovery needs server access: set it back to false,
# recreate the container and sign in with a local password. Before turning it
# on, make sure at least one admin account has a password set
# (Settings > Admin Tools > Users). Profiles created through OIDC have no
# password until an administrator sets one.
POZNOTE_OIDC_DISABLE_NORMAL_LOGIN=false

# =============================================================================
# SETTINGS PAGE PROTECTION
# =============================================================================

# Optional password asked before opening the Settings page.
# Leave empty for unrestricted access (default).
POZNOTE_SETTINGS_PASSWORD=

# =============================================================================
# MCP SERVER (AI ASSISTANTS)
# =============================================================================
# Details: docs/MCP-SERVER.md

# Port of the MCP server, published on 127.0.0.1 only (default 8045).
#POZNOTE_MCP_PORT=8045

# Profile the MCP server acts as when a request names none (default 1, the
# first admin).
#POZNOTE_USER_ID=1

# --- Shared token ------------------------------------------------------------
# Bearer token every MCP client must send (Authorization: Bearer <token>).
# Leave empty to keep the endpoint open, which is safe while the port stays on
# 127.0.0.1. Set it if you expose the port beyond localhost.
# Generate one with: openssl rand -hex 32
#POZNOTE_MCP_AUTH_TOKEN=

# --- Per-caller tokens (advanced) --------------------------------------------
# Instead of one shared token, each client presents its own token, resolved
# against your identity provider and mapped to that caller's Poznote profile.
# When set, it replaces POZNOTE_MCP_AUTH_TOKEN, which is then ignored.
#
# Two consequences: an explicit user_id argument must match the caller's own
# profile, and the tools that take no user_id (get_system_info, list_backups,
# create_backup, delete_backup) are limited to administrators, so the default
# profile (POZNOTE_USER_ID) has to be an administrator.

# userinfo       GET  <url> with Authorization: Bearer <token> (OpenID Connect
#                UserInfo, works for opaque tokens as well as JWTs)
# introspection  POST <url> with token=<token> (RFC 7662)
#POZNOTE_MCP_AUTH_PROVIDER=userinfo
#POZNOTE_MCP_AUTH_URL=https://idp.example.com/userinfo

# Claims that identify the caller, as <poznote-profile-field>:<claim>, tried
# left to right. The first one present that matches exactly one profile wins;
# an identity matching no profile is refused. The default matches the subject
# only. preferred_username or email are weaker matches, opt in deliberately.
#POZNOTE_MCP_IDENTITY_MATCH=oidc_subject:sub

# Expected token audience, comma separated. Refuses a token the same provider
# issued for another application.
#POZNOTE_MCP_AUTH_AUDIENCE=

# Header this server sends TO the provider (not the one clients use).
#POZNOTE_MCP_AUTH_HEADER=Authorization

# introspection only, sent as HTTP Basic.
#POZNOTE_MCP_AUTH_CLIENT_ID=
#POZNOTE_MCP_AUTH_CLIENT_SECRET=

# Provider request timeout, and how long a resolved token is cached (seconds).
#POZNOTE_MCP_AUTH_TIMEOUT=5
#POZNOTE_MCP_AUTH_CACHE_TTL=60

# =============================================================================
# PERFORMANCE
# =============================================================================

# PHP requests handled at the same time (php-fpm pm.max_children, default 10).
# Short requests never fill it; long ones do (AI chat streaming, S3, git sync,
# large uploads). Raise it on a busy instance with several users; each busy
# worker costs about 25-30 MB.
#POZNOTE_PHP_FPM_MAX_CHILDREN=10

# PHP memory limit per request, in MB (default 512). A ceiling, not a
# reservation: backups, restores, exports and downloads are streamed, so only
# a single note of tens of MB can need more. Never set it above the host's
# memory, the kernel would kill the container instead of PHP reporting a clean
# error.
#POZNOTE_PHP_MEMORY_LIMIT=512

# =============================================================================
# TROUBLESHOOTING
# =============================================================================

# Show PHP errors in the browser and enable verbose MCP server logs.
# Keep it off outside troubleshooting: error output can leak paths and
# configuration details.
#POZNOTE_DEBUG=false