.env.example

# ========================================
# ServerSupervisor - Environment Variables
# ========================================
# Copy this file to .env and adjust values
# cp .env.example .env

# ----------------------------------------
# Server
# ----------------------------------------

SERVER_PORT=8080

# Docker image published by the release workflow (ghcr.io, multi-arch, cosign-signed).
# Pin SERVERSUPERVISOR_VERSION to a specific tag (e.g. v9.2.0) for a reproducible
# deployment instead of tracking "latest"; leave commented to use the default in
# docker-compose.yml.
# SERVERSUPERVISOR_IMAGE=ghcr.io/rem7474/serversupervisor
# SERVERSUPERVISOR_VERSION=latest

# Deployment environment. Set to "dev" or "development" for local work — the
# server will then auto-generate a JWT_SECRET when none is provided and skip
# the strict secret validation. Any other value (or unset) is treated as
# production and the server refuses to start with default credentials.
APP_ENV=production

# Demo mode — disables every poller/background job that makes a real outbound
# network call (Proxmox VE, Nginx Proxy Manager, uptime/SSL probes, Git
# release tracking). Used by docker-compose.demo.yml and the seed-demo binary
# (cmd/seed-demo) for local demo data / the release screenshot pipeline. Never
# enable this against a real deployment. Orthogonal to APP_ENV — set both for
# local demo mode.
DEMO_MODE=false

# Structured logging (slog). LOG_LEVEL: debug|info|warn|error (default info).
# LOG_FORMAT: json|text — defaults to text in APP_ENV=dev, json otherwise.
# Each HTTP request is tagged with a correlation ID (request_id), echoed in the
# X-Request-ID response header and attached to every log line for that request.
LOG_LEVEL=info
# LOG_FORMAT=json

# Public URL of the application — REQUIRED when behind a reverse proxy (NPM, Traefik, Caddy...)
# Used for WebSocket origin validation and CORS.
# Must match exactly what the browser uses (scheme + domain + port if non-standard).
# Examples:
#   BASE_URL=https://supervisor.yourdomain.com
#   BASE_URL=http://192.168.1.10:8080
BASE_URL=http://localhost:8080

# Timezone the server interprets Global Scheduled Tasks' cron expressions in,
# and uses to compute their "next run" times. Any standard IANA/tzdata name
# (Go's time.Local honors this natively). Left unset, the container defaults
# to UTC: a task cron-built for "23h00" will actually fire at 23:00 UTC, which
# is 01:00 the next day in a UTC+2 timezone — set this to your own timezone to
# avoid that mismatch.
#   TZ=Europe/Paris
TZ=UTC

# Trusted reverse proxy IPs or CIDR ranges (comma-separated)
# Allows reading real client IP from X-Forwarded-For header.
# Set to the IP/subnet of your NPM, Traefik, or Nginx container.
# Leave empty if running without a reverse proxy.
# Examples:
#   TRUSTED_PROXIES=172.18.0.0/16
#   TRUSTED_PROXIES=172.18.0.5,172.19.0.0/16
TRUSTED_PROXIES=

# ----------------------------------------
# Database
# ----------------------------------------

# Only needed if not using docker-compose (where DB_HOST=postgres is set automatically)
DB_HOST=localhost
DB_PORT=5432
DB_USER=supervisor
DB_NAME=serversupervisor
DB_SSLMODE=disable

# Required — database password
DB_PASSWORD=your-secure-password-here

# ----------------------------------------
# Authentication
# ----------------------------------------

# Secret used to sign JWT tokens.
# Optional: if left empty, a secure random 64-character hex secret will be
# generated on first boot and persisted in the database settings table.
# To generate manually: openssl rand -hex 32
JWT_SECRET=

# JWT access token lifetime (default: 24h)
# Supported units: h (hours), m (minutes), s (seconds)
JWT_EXPIRATION=24h

# Refresh token lifetime (default: 168h = 7 days)
REFRESH_TOKEN_EXPIRATION=168h

# Default admin credentials (created on first startup if no user exists).
# - ADMIN_USER: username for initial account (default: admin).
# - ADMIN_PASSWORD: if left empty, a secure random 16-character password is
#   generated at first boot and printed in `docker compose logs server`. You will
#   be prompted to change it upon first login.
ADMIN_USER=admin
ADMIN_PASSWORD=

# ----------------------------------------
# Rate Limiting
# ----------------------------------------

# Requests per second per IP (default: 100)
RATE_LIMIT_RPS=100

# Maximum burst size per IP (default: 200)
RATE_LIMIT_BURST=200

# Same, for the /api/agent/* routes. Agents report on a fixed interval and
# must not be throttled like a browser.
AGENT_RATE_LIMIT_RPS=20
AGENT_RATE_LIMIT_BURST=40

# ----------------------------------------
# GitHub Release Tracking (optional)
# ----------------------------------------

# Personal access token — increases rate limit from 60 to 5000 req/hour
# Required if you track many repositories.
# Create at: https://github.com/settings/tokens (no scopes needed for public repos)
GITHUB_TOKEN=

# How often to check for new releases (default: 15m)
GITHUB_POLL_INTERVAL=15m

# How often the ambient Docker image-version engine refreshes the latest digest
# of every image:tag running across the fleet (default: 6h). Much slower than
# GITHUB_POLL_INTERVAL on purpose: it scans every running image, not just the
# ones with a release tracker, and registries rate limit per source IP.
DOCKER_IMAGE_POLL_INTERVAL=6h

# ----------------------------------------
# Alerts & Notifications (optional)
# ----------------------------------------

# ntfy server base URL. Alert rules using the "ntfy" channel take the scheme
# and host from here; each rule can override the topic.
# Example: https://ntfy.sh/your-topic
#
# This URL is ALSO the target of the deprecated "notify" channel, which POSTs
# raw JSON to it. That payload matches no third-party schema in particular —
# it will not render correctly as a Discord or Slack webhook. A real
# Slack/Teams/Discord channel is ROADMAP.md item #6, not yet implemented.
NOTIFY_URL=

# SMTP configuration for email alerts
# Leave SMTP_HOST empty to disable email alerts.
SMTP_HOST=
SMTP_PORT=587
SMTP_USER=
SMTP_PASS=
SMTP_FROM=serversupervisor@yourdomain.com
SMTP_TO=admin@yourdomain.com
SMTP_TLS=true

# ntfy auth token, for a protected topic. Leave empty for a public topic.
NTFY_AUTH_TOKEN=

# ----------------------------------------
# Metrics
# ----------------------------------------

# How many days to keep raw metrics (default: 30)
METRICS_RETENTION_DAYS=30

# How many days to keep audit log rows (default: 90). Can be refined per
# category from Settings only (audit_retention_days_by_category) — a
# per-category map doesn't fit a flat KEY=value env var.
AUDIT_RETENTION_DAYS=90

# How many days to keep web-log requests (default: 30) and network flows
# (default: 14). Both tables grow fast on a busy reverse proxy.
WEB_LOGS_RETENTION_DAYS=30
NETWORK_FLOWS_RETENTION_DAYS=14

# ----------------------------------------
# Backups (docker-compose "postgres-backup" service)
# ----------------------------------------
# Scheduled pg_dump of the ServerSupervisor database, gzip'd and rotated. This
# is disaster recovery for the volume (corruption, accidental deletion) — it is
# separate from METRICS_RETENTION_DAYS, which only expires old metric rows.
# See README.md "Sauvegarde & restauration" for the restore procedure.

# Cron-like schedule understood by the backup image (e.g. @daily, @weekly, or
# a 5-field cron expression). Default: once a day.
BACKUP_SCHEDULE=@daily

# How many daily/weekly/monthly backups to retain before older ones are pruned.
BACKUP_KEEP_DAYS=7
BACKUP_KEEP_WEEKS=4
BACKUP_KEEP_MONTHS=6

# ----------------------------------------
# TLS/Security
# ----------------------------------------

# NOTE: this does NOT make the server serve HTTPS — it only listens over
# plain HTTP and is meant to sit behind a TLS-terminating reverse proxy.
# TLS_ENABLED only forces the `Secure` flag on session cookies, so set it to
# true whenever the app is reached over https://, even (especially) when the
# proxy is the one terminating TLS.
TLS_ENABLED=false

# Extra allowed WebSocket origins (comma-separated)
# Use when the app is behind a reverse proxy with a different domain
# Examples:
#   ALLOWED_ORIGINS=https://supervisor.yourdomain.com
#   ALLOWED_ORIGINS=https://supervisor.yourdomain.com,https://backup.yourdomain.com
ALLOWED_ORIGINS=

# WebAuthn (passkeys / security keys). Both are derived from BASE_URL and
# ALLOWED_ORIGINS when left empty — only set them if the frontend genuinely
# isn't served from the API's own origin.
# WEBAUTHN_RP_ID=supervisor.yourdomain.com
# WEBAUTHN_RP_ORIGINS=https://supervisor.yourdomain.com

# ----------------------------------------
# Web-log threat scoring (optional)
# ----------------------------------------

# The threat score of an IP in the Traffic/Threats views is a weighted sum of
# signals. Defaults are calibrated for ordinary traffic — only touch these if
# the scoring is too noisy or too lax on yours. Full table in the README.
# THREAT_THRESHOLD_MEDIUM=15
# THREAT_THRESHOLD_HIGH=50
# THREAT_THRESHOLD_CRITICAL=150
# THREAT_WEIGHT_HITS=2
# THREAT_WEIGHT_BREADTH=3
# THREAT_WEIGHT_STATUS_404=2
# THREAT_WEIGHT_STATUS_4XX=1.5
# THREAT_WEIGHT_STATUS_5XX=3
# THREAT_WEIGHT_STATUS_3XX=1
# THREAT_WEIGHT_STATUS_2XX=0.1
# THREAT_WEIGHT_ADMIN_PANEL=3
# THREAT_WEIGHT_WORDPRESS=2
# THREAT_WEIGHT_PATH_TRAVERSAL=5
# THREAT_WEIGHT_SUSPICIOUS_METHOD=2
# THREAT_WEIGHT_KNOWN_SCANNER=4

# WebAuthn (passkeys / security keys, an additional MFA factor alongside TOTP).
# By default the Relying Party ID/origins are derived from BASE_URL/ALLOWED_ORIGINS
# above, which is correct for the vast majority of deployments (frontend served
# from the same origin as this API). Only set these if that assumption doesn't
# hold (e.g. a reverse proxy that rewrites the host between the browser and here).
# WEBAUTHN_RP_ID=supervisor.yourdomain.com
# WEBAUTHN_RP_ORIGINS=https://supervisor.yourdomain.com