162 lines
6.1 KiB
Text
162 lines
6.1 KiB
Text
# Core self-hosting profile
|
|
# Copy to .env.production and adjust values for your host.
|
|
|
|
# -----------------------------------------------------------------------------
|
|
# Core domains / hostnames
|
|
# -----------------------------------------------------------------------------
|
|
|
|
PRIMARY_DOMAIN=example.com
|
|
PHX_HOST=example.com
|
|
EMAIL_DOMAIN=example.com
|
|
SUPPORTED_DOMAINS=example.com
|
|
PROFILE_BASE_DOMAINS=example.com
|
|
|
|
# Optional overrides for split-domain setups:
|
|
# EMAIL_DOMAIN=mail.example.com
|
|
# SUPPORTED_DOMAINS=mail.example.com
|
|
# INSTANCE_DOMAIN=example.com
|
|
|
|
# -----------------------------------------------------------------------------
|
|
# Phoenix runtime
|
|
# -----------------------------------------------------------------------------
|
|
|
|
PHX_SERVER=true
|
|
PORT=8080
|
|
|
|
# When TLS is terminated by a reverse proxy (for example Caddy, Nginx, or
|
|
# Traefik) and the app only receives plain HTTP from that proxy, leave this as
|
|
# false to avoid redirect loops.
|
|
# FORCE_SSL=false
|
|
# TRUSTED_PROXY_CIDRS=172.30.0.0/24
|
|
# CADDY_ASK_TRUSTED_CIDRS=172.30.0.0/24
|
|
# ELEKTRINE_AUTO_CONFIGURE_DOCKER_SOURCE_IPS=true
|
|
# CADDY_TRUSTED_PROXY_CIDRS=203.0.113.10/32
|
|
# EXTRA_CHECK_ORIGINS=http://203.0.113.10
|
|
# ATOMINE_DM_CREDIT_GATE_ENABLED=false
|
|
# ATOMINE_EMAIL_CREDIT_GATE_ENABLED=false
|
|
|
|
# -----------------------------------------------------------------------------
|
|
# Database / secrets
|
|
# -----------------------------------------------------------------------------
|
|
|
|
# DB_PASSWORD=<generate-a-long-random-secret>
|
|
|
|
# For the default Docker stack, `DB_PASSWORD` is enough. Set `DATABASE_URL`
|
|
# only when you use an external Postgres instance or non-Docker deploy.
|
|
# DATABASE_URL=ecto://elektrine:<generate-a-long-random-secret>@postgres/elektrine_prod
|
|
# TLS is enabled by default for external DATABASE_URL connections. Only set this
|
|
# false for an internal Docker/private-network database that does not support TLS.
|
|
# DATABASE_SSL_ENABLED=false
|
|
|
|
# Minimal root secret for self-hosting. Elektrine derives internal API keys,
|
|
# session salts, and other internal-only secrets from this automatically.
|
|
# ELEKTRINE_MASTER_SECRET=<generate-a-long-random-secret>
|
|
|
|
# Optional explicit override.
|
|
# SECRET_KEY_BASE=
|
|
|
|
# -----------------------------------------------------------------------------
|
|
# Modules / deploy profiles
|
|
# -----------------------------------------------------------------------------
|
|
|
|
ELEKTRINE_ENABLED_MODULES=chat,social,nerve,atomine
|
|
# Advanced build override only. Usually leave this unset.
|
|
# ELEKTRINE_RELEASE_MODULES=chat,social,nerve,atomine
|
|
|
|
# Docker deploy profiles / edge services. The self-host wrapper starts with caddy.
|
|
# Smaller edge-only example:
|
|
# DOCKER_PROFILES=caddy
|
|
|
|
# -----------------------------------------------------------------------------
|
|
# Database pool tuning
|
|
# -----------------------------------------------------------------------------
|
|
|
|
POOL_SIZE=10
|
|
APP_POOL_SIZE=10
|
|
WORKER_POOL_SIZE=5
|
|
MAIL_POOL_SIZE=5
|
|
DNS_POOL_SIZE=3
|
|
VPN_POOL_SIZE=2
|
|
DB_QUEUE_TARGET_MS=2000
|
|
DB_QUEUE_INTERVAL_MS=5000
|
|
DB_TIMEOUT_MS=30000
|
|
DB_POOL_TIMEOUT_MS=15000
|
|
DB_CONNECT_TIMEOUT_MS=15000
|
|
|
|
# -----------------------------------------------------------------------------
|
|
# Federation / remote enrichment
|
|
# -----------------------------------------------------------------------------
|
|
|
|
MESSAGING_FEDERATION_ENABLED=true
|
|
MESSAGING_FEDERATION_IDENTITY_KEY_ID=default
|
|
MESSAGING_FEDERATION_OFFICIAL_RELAY_OPERATOR=Community-operated
|
|
MESSAGING_FEDERATION_OFFICIAL_RELAYS_JSON='[]'
|
|
MESSAGING_FEDERATION_PEERS_JSON='[]'
|
|
|
|
|
|
# -----------------------------------------------------------------------------
|
|
# Optional but recommended crypto secrets
|
|
# -----------------------------------------------------------------------------
|
|
|
|
# Optional explicit overrides.
|
|
# ENCRYPTION_MASTER_SECRET=
|
|
# ENCRYPTION_KEY_SALT=
|
|
# ENCRYPTION_SEARCH_SALT=
|
|
|
|
# -----------------------------------------------------------------------------
|
|
# Edge / certificates / anti-abuse
|
|
# -----------------------------------------------------------------------------
|
|
|
|
# ACME_EMAIL=admin@example.com
|
|
# CADDY_CONFIG_PATH=../caddy/Caddyfile.external-certs
|
|
# CADDY_TLS_MOUNT_DIR=/opt/elektrine/certs
|
|
# CADDY_MANAGED_SITE_1_CERT_PATH=/opt/elektrine/certs/example.com.fullchain.pem
|
|
# CADDY_MANAGED_SITE_1_KEY_PATH=/opt/elektrine/certs/example.com.key.pem
|
|
# CADDY_MANAGED_SITE_2_CERT_PATH=/opt/elektrine/certs/alt.example.net.fullchain.pem
|
|
# CADDY_MANAGED_SITE_2_KEY_PATH=/opt/elektrine/certs/alt.example.net.key.pem
|
|
# ATOMINE_POW_DIFFICULTY=20
|
|
# ATOMINE_POW_SKIP_VERIFICATION=false
|
|
|
|
# -----------------------------------------------------------------------------
|
|
# Internal service auth / add-ons
|
|
# -----------------------------------------------------------------------------
|
|
|
|
# INTERNAL_API_KEY=
|
|
# DNS_RECURSIVE_ENABLED=true
|
|
# VPN_SELFHOST_PUBLIC_IP=203.0.113.10
|
|
# VPN_SELFHOST_ENDPOINT_HOST=vpn.example.com
|
|
# VPN_SELFHOST_PRIVATE_KEY=
|
|
# VPN_SELFHOST_ADDRESS=10.8.0.1/24
|
|
# VPN_SELFHOST_LISTEN_PORT=51820
|
|
# VPN_SELFHOST_PUBLIC_KEY=
|
|
# VPN_SELFHOST_INTERNAL_IP_RANGE=10.8.0.0/24
|
|
# VPN_SELFHOST_DNS_SERVERS=1.1.1.1, 1.0.0.1
|
|
# VPN_SELFHOST_WG_INTERFACE=wg0
|
|
# VPN_FLEET_REGISTRATION_KEY=
|
|
|
|
# -----------------------------------------------------------------------------
|
|
# Built-in secure mailbox TLS
|
|
# -----------------------------------------------------------------------------
|
|
|
|
# MAIL_TLS_CERT_PATH=/opt/elektrine/certs/mail.crt
|
|
# MAIL_TLS_KEY_PATH=/opt/elektrine/certs/mail.key
|
|
# MAIL_TLS_MOUNT_DIR=/opt/elektrine/certs
|
|
# IMAP_TLS_CERT_PATH=/opt/elektrine/certs/imap.crt
|
|
# IMAP_TLS_KEY_PATH=/opt/elektrine/certs/imap.key
|
|
# POP3_TLS_CERT_PATH=/opt/elektrine/certs/pop.crt
|
|
# POP3_TLS_KEY_PATH=/opt/elektrine/certs/pop.key
|
|
|
|
# -----------------------------------------------------------------------------
|
|
# Optional object storage (Magpie / S3-compatible)
|
|
# -----------------------------------------------------------------------------
|
|
|
|
# S3_ACCESS_KEY_ID=<provider-access-key-id>
|
|
# S3_SECRET_ACCESS_KEY=<provider-secret-access-key>
|
|
# S3_ENDPOINT=127.0.0.1:8090
|
|
# S3_BUCKET_NAME=elektrine-uploads
|
|
# S3_PUBLIC_URL=http://127.0.0.1:8090/elektrine-uploads
|
|
# S3_SCHEME=http://
|
|
# S3_PORT=8090
|
|
|
|
# Leave the S3 values unset to keep uploads on local disk.
|
|
# In Docker deploys those files are persisted in the `uploads` volume.
|