55 lines
1.6 KiB
Bash
55 lines
1.6 KiB
Bash
# Copy this file to .env in the Unraid deployment directory
|
|
# (/mnt/tank/appdata/notizarr/.env) and fill in real values.
|
|
# Never commit a real .env.
|
|
|
|
# ---- Identity / URLs ----
|
|
PUBLIC_BASE_URL=https://notizarr.example.com
|
|
PORT_WEB=8080
|
|
PORT_INGEST=8081
|
|
|
|
# Host bind addresses used by docker/docker-compose.prod.yml.
|
|
# BIND_ADDR_INGEST defaults to 127.0.0.1 on purpose (see docs/phase1/02-threat-model.md) -
|
|
# set it to your LAN interface IP (e.g. 192.168.1.10) so LAN devices can publish,
|
|
# but never set it to 0.0.0.0 on a host with any WAN exposure.
|
|
BIND_ADDR_WEB=0.0.0.0
|
|
BIND_ADDR_INGEST=127.0.0.1
|
|
|
|
# ---- Auth ----
|
|
# oidc | proxy | disabled
|
|
AUTH_MODE=oidc
|
|
OIDC_ISSUER_URL=
|
|
OIDC_CLIENT_ID=
|
|
OIDC_CLIENT_SECRET=
|
|
OIDC_REDIRECT_URL=https://notizarr.example.com/api/v1/auth/oidc/callback
|
|
OIDC_SCOPES=openid profile email
|
|
|
|
AUTH_PROXY_USER_HEADER=
|
|
AUTH_PROXY_EMAIL_HEADER=
|
|
AUTH_PROXY_GROUPS_HEADER=
|
|
TRUSTED_PROXY_CIDRS=
|
|
|
|
# ---- Database ----
|
|
POSTGRES_USER=notizarr
|
|
POSTGRES_PASSWORD=change-me
|
|
POSTGRES_DB=notizarr
|
|
|
|
# ---- Push ----
|
|
VAPID_SUBJECT=mailto:admin@example.com
|
|
|
|
# ---- Ingestion safety ----
|
|
# Comma-separated CIDRs allowed to hit the :8081 ingestion listener,
|
|
# enforced in-app as defense in depth beyond network-level firewalling.
|
|
INGESTION_ALLOWED_CIDRS=10.0.0.0/8,172.16.0.0/12,192.168.0.0/16
|
|
|
|
# ---- Retention / rate limiting defaults (editable later in Admin > Settings) ----
|
|
RETENTION_DEFAULT_DAYS=90
|
|
RATE_LIMIT_SUSTAINED_PER_MIN=60
|
|
RATE_LIMIT_BURST_PER_10S=20
|
|
|
|
# ---- Ops ----
|
|
LOG_LEVEL=info
|
|
DOCS_ENABLED=true
|
|
|
|
# Image tag to run, if not building in place
|
|
NOTIZARR_IMAGE=notizarr:latest
|