.env.example

# Part of the sovereign-stack project.
# .env Template
# Version: See version.py
#
# Copyright (C) 2026 Henk van Hoek
#
# This program is free software: you can redistribute it and/or modify
# it under the terms of the GNU General Public License as published by
# the Free Software Foundation, either version 3 of the License, or
# (at your option) any later version.
#
# This program is distributed in the hope that it will be useful,
# but WITHOUT ANY WARRANTY; without even the implied warranty of
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
# GNU General Public License for more details.
#
# You should have received a copy of the GNU General Public License
# along with this program.  If not, see https://www.gnu.org/licenses/.

# Place all your secrets here. DO NOT commit the actual .env file.

# Global Settings
TZ="Europe/Amsterdam"
DOMAIN="example.com"
SECOND_DOMAIN="example.net"
DOCKER_ROOT="/home/<YOUR_LINUX_USER>/docker"
SYSTEM_USER="<YOUR_LINUX_USER>"
INTERNAL_HOST_IP="192.168.xxx.xxx"

# Frigate Settings
FRIGATE_RTSP_PASSWORD="<REPLACE_WITH_SECURE_PASSWORD>"
FRIGATE_MQTT_USER="frigate_user"
FRIGATE_MQTT_PASSWORD="<REPLACE_WITH_PASSWORD>"
# Setting to store snapshots in
GARAGE_FRIGATE_SNAPSHOTS="storage/<your defined location>"

# Home Assistant Settings
HA_USER="admin"
HA_PASSWORD="<REPLACE_WITH_PASSWORD>"
HA_MQTT_USER="homeassistant"
HA_MQTT_PASSWORD="<REPLACE_WITH_PASSWORD>"

# SMTP Relay Settings
SMTP_HOST="smtp.freedom.nl"
SMTP_PORT="587"
SMTP_TLS="yes"

# Nextcloud Database
NEXTCLOUD_DB_ROOT_PASSWORD="<REPLACE_WITH_DB_ROOT_PASSWORD>"
NEXTCLOUD_DB_PASSWORD="<REPLACE_WITH_DB_USER_PASSWORD>"
NEXTCLOUD_DB_USER="nextcloud"
NEXTCLOUD_DB_NAME="nextcloud"
NEXTCLOUD_TRUSTED_DOMAINS="nextcloud.example.com"

# Nextcloud Mail Settings
NEXTCLOUD_MAIL_FROM_ADDRESS="nextcloud"
NEXTCLOUD_MAIL_DOMAIN="example.com"
NEXTCLOUD_MAIL_SMTPHOST="smtp.freedom.nl"
NEXTCLOUD_MAIL_SMTPPORT="465"
NEXTCLOUD_MAIL_SMTPSECURE="ssl"
NEXTCLOUD_MAIL_SMTPAUTH="true"
NEXTCLOUD_MAIL_SMTPNAME="your_email@freedom.nl"
NEXTCLOUD_MAIL_SMTPPASSWORD="your_app_password"

# Forgejo
FORGEJO_USER="git"
FORGEJO_DB_USER="forgejo"
FORGEJO_DB_NAME="forgejo"
FORGEJO_DB_PASSWORD="<REPLACE_WITH_FORGEJO_DB_PASSWORD>"

# Step-CA & Security
STEP_CA_EMAIL="admin@example.com"
STEPCA_PASSWORD="<REPLACE_WITH_PASSWORD>"
STEPCA_PROVISIONER_NAME="admin@example.com"
STEPCA_PROVISIONER_PASSWORD="<REPLACE_WITH_STRONG_PASSWORD>"
STEP_CA_DNS_IP="<YOUR_SERVER_LOCAL_IP>"
STEPCAT_FINGERPRINT="<FINGERPRINT_FROM_STEP_CA>"
NPM_CERT_ID="npm-x"
CHAT_NPM_CERT_ID="npm-y"
SIGNUPS_ALLOWED="false"

# Signal API
SIGNAL_CLI_API_PASSWORD="<REPLACE_WITH_PASSWORD>"
SIGNAL_API_PORT="8090"

# Homarr / Dashboard
ICON_BLACKLIST_LOCAL="false"
ICON_DOWNLOAD_TIMEOUT=5000

# Backup & Automation
BACKUP_EMAIL="your_email@provider.com"
BACKUP_PASSWORD="<REPLACE_WITH_ENCRYPTION_PASSWORD>"
BACKUP_RETENTION_DAYS=7
INCLUDE_FRIGATE_DATA="false"
INCLUDE_NEXTCLOUD_DATA="true"

# Remote Target Configuration
BACKUP_TARGET_OS="windows"
BACKUP_TARGET_IP="192.168.xxx.xxx"
BACKUP_TARGET_MAC="00:00:00:00:00:00"
BACKUP_TARGET_USER="<REMOTE_USER>"
BACKUP_TARGET_PATH="/X:/Your/Path"
BACKUP_MAX_RETRIES=15
BACKUP_RETRY_WAIT=6

# External DNS server
EXTERNAL_DNS_IP=x.x.x.x
EXTERNAL_DNS_NAME="<full dns name of external dns server>"

# Netbox Infrastructure
NETBOX_API_TOKEN_PEPPERS="<REPLACE_WITH_AT_LEAST_50_RANDOM_CHARACTERS>"
NETBOX_SECRET_KEY="<REPLACE_WITH_AT_LEAST_50_RANDOM_CHARACTERS>"
NETBOX_DB_NAME="netbox"
NETBOX_DB_USER="netbox"
NETBOX_DB_PASSWORD="<REPLACE_WITH_SECURE_POSTGRES_PASSWORD>"
NETBOX_ALLOWED_HOSTS="localhost,127.0.0.1,netbox.${DOMAIN}"s
NETBOX_CLUSTER_MAPPING="aaa.bbb.ccc.ddd:Cluster-1,aaa.bbb.ccc.ddd:Cluster-2,aaa.bbb.ccc.ddd:Cluster-3"

COTUR_SECRET="<REPLACE_WITH_A_SECURE_PASSWORD>"

# Garage is API compatible interface with Amazon's S3.
# The next DIRs are appended to the docker root.
GARAGE_ROOT="garage"
GARAGE_METADATA_DIR="garage/meta"
GARAGE_DATA_DIR="garage/data"

# --- Garage S3 Storage Secrets ---
# Generate a 32-byte hex secret using: openssl rand -hex 32
# NOTE: Do NOT use quotes around the hex string here.
GARAGE_RPC_SECRET=<REPLACE_WITH_HEX_SECRET_WITHOUT_QUOTES>