OpenFrame/.env.docker.example at master · RoleModel/OpenFrame · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
# Copy to .env.docker before starting the Docker stack.

# Application URLs
NEXTAUTH_URL="http://localhost:3000"
NEXT_PUBLIC_APP_URL="http://localhost:3000"
AUTH_TRUST_HOST="true"

# Generate a strong random secret before first boot.
NEXTAUTH_SECRET="replace-with-openssl-rand-base64-32"

# Docker Compose defaults
POSTGRES_DB="openframe"
POSTGRES_USER="replace-with-postgres-user"
POSTGRES_PASSWORD="replace-with-strong-postgres-password"
DATABASE_URL="postgresql://replace-with-postgres-user:replace-with-strong-postgres-password@postgres:5432/openframe?schema=public"
NODE_ENV="production"

# Self-host defaults
OPENFRAME_ENABLE_STRIPE="false"
OPENFRAME_ENABLE_BUNNY_UPLOADS="false"
OPENFRAME_ENABLE_S3_VIDEO_UPLOADS="true"
# OPENFRAME_MAX_VIDEO_UPLOAD_BYTES="5368709120"
OPENFRAME_REQUIRE_INVITE_CODE="false"
SELF_HOSTED_AUTO_CREATE_BUCKET="true"

# Project bulk-download manifest limits (GET /api/projects/[projectId]/download).
OPENFRAME_PROJECT_DOWNLOAD_MAX_FILES="250"
# 20 GiB in bytes (20 * 1024 * 1024 * 1024)
OPENFRAME_PROJECT_DOWNLOAD_MAX_BYTES="21474836480"
# Comma-separated hostnames for direct version download URLs (optional).
NEXT_PUBLIC_DIRECT_DOWNLOAD_ALLOWED_HOSTS=""

# Trusted reverse proxy mode — controls which headers getClientIp() trusts for rate limiting.
# Set this only when you have confirmed that your proxy strips/overwrites client-supplied headers.
#   cloudflare  — trust cf-connecting-ip (Cloudflare edge in front of the origin)
#   nginx       — trust x-real-ip / last x-forwarded-for (Nginx real_ip_header with set_real_ip_from)
# Leave unset for local dev or when no trusted proxy is in place.
TRUSTED_PROXY_MODE="nginx"

# MinIO-backed S3 storage
MINIO_ROOT_USER="replace-with-minio-root-user"
MINIO_ROOT_PASSWORD="replace-with-strong-minio-password"
R2_ENDPOINT="http://minio:9000"
# Browser-facing MinIO origin for presigned upload URLs (scheme + host, no path).
# Use your public MinIO domain when behind a reverse proxy, e.g. https://minio.example.com
R2_PRESIGN_ENDPOINT="http://localhost:9000"
R2_PUBLIC_BASE_URL="http://localhost:9000/openframe"
R2_ACCESS_KEY_ID="replace-with-minio-root-user"
R2_SECRET_ACCESS_KEY="replace-with-strong-minio-password"
R2_BUCKET_NAME="openframe"

# Optional auth/admin configuration
ADMIN_EMAILS=""
INVITE_CODE=""

# Optional integrations. Leave blank to disable.
GOOGLE_CLIENT_ID=""
GOOGLE_CLIENT_SECRET=""
GITHUB_CLIENT_ID=""
GITHUB_CLIENT_SECRET=""
SMTP_HOST=""
SMTP_PORT="587"
SMTP_USER=""
SMTP_PASSWORD=""
SMTP_FROM=""
TELEGRAM_BOT_TOKEN=""
STRIPE_SECRET_KEY=""
STRIPE_PRICE_ID=""
STRIPE_WEBHOOK_SECRET=""
BUNNY_STREAM_API_KEY=""
BUNNY_STREAM_LIBRARY_ID=""
BUNNY_API_KEY=""
# Playback host for Bunny versions. Set BUNNY_CDN_URL: the app reads it at request
# time, while NEXT_PUBLIC_BUNNY_CDN_URL only reaches the browser in a source build.
BUNNY_CDN_URL=""
NEXT_PUBLIC_BUNNY_CDN_URL=""