# Domains (used by Caddy + OIDC) NEXTCLOUD_DOMAIN=cloud.example.test BROKER_DOMAIN=qortalbroker.example.test COLLABORA_DOMAIN=office.cloud.example.test SIGNALING_DOMAIN=talk.cloud.example.test # Nextcloud NEXTCLOUD_IMAGE=nextcloud:33-apache # Tested image majors in this repo are 32 and 33. # Host path mounted to /var/www/html/custom_apps inside the Nextcloud container. # Use a separate path (for example ./nextcloud/custom_apps_appstore) to mimic app-store installs. NEXTCLOUD_CUSTOM_APPS_PATH=./nextcloud/custom_apps # Legacy/non-devprod port key. Not used by docker-compose.devprod.yml or docker-compose.devprod.nossl.yml. # For the no-SSL devprod stack, use DEVPROD_HTTP_PORT below. NEXTCLOUD_PORT=8080 NEXTCLOUD_ADMIN_USER=admin NEXTCLOUD_ADMIN_PASSWORD=admin123 NEXTCLOUD_TRUSTED_DOMAINS=cloud.example.test # MariaDB MYSQL_ROOT_PASSWORD=rootpass MYSQL_DATABASE=nextcloud MYSQL_USER=nextcloud MYSQL_PASSWORD=nextcloudpass # Redis REDIS_PORT=6379 # Broker PostgreSQL BROKER_DB_NAME=qortal_broker BROKER_DB_USER=qortal_broker BROKER_DB_PASSWORD=qortal_brokerpass # Broker service # Legacy/non-devprod port key. Not used by docker-compose.devprod.yml or docker-compose.devprod.nossl.yml. # For the no-SSL devprod stack, use DEVPROD_BROKER_PORT below. BROKER_PORT=3000 NEXTCLOUD_BASE_URL=http://app NEXTCLOUD_PUBLIC_URL=https://cloud.example.test # Optional explicit trusted proxy list (comma-separated IP/CIDR/host). Installer auto-adds bundled caddy proxy when present. NEXTCLOUD_TRUSTED_PROXIES= # Optional forwarded-for header list (comma-separated). Defaults to HTTP_X_FORWARDED_FOR. NEXTCLOUD_FORWARDED_FOR_HEADERS=HTTP_X_FORWARDED_FOR # Dedicated broker service account for OIDC/OCS API calls (keep separate from human admin login). # Existing installs can keep sovereign_oidc_service; new installs default to nuqloud_oidc_service. NEXTCLOUD_SERVICE_USER=nuqloud_oidc_service NEXTCLOUD_SERVICE_PASSWORD=service-oidc-change-me # Derived from BROKER_DB_* by install scripts; keep host as broker_db unless customizing compose service names. BROKER_DATABASE_URL=postgresql://qortal_broker:qortal_brokerpass@broker_db:5432/qortal_broker BROKER_INTERNAL_API_TOKEN= # Optional comma-separated browser origins allowed for broker CORS (internal server-to-server calls do not use CORS). BROKER_CORS_ALLOWED_ORIGINS= # Max broker request body size for qapps/qortal JSON payloads (large QDN publishes may exceed 5mb). BROKER_REQUEST_BODY_LIMIT=64mb # Optional default Files Bridge publish ceiling. Leave empty to derive from broker-oriented publish limits. QORTAL_FILES_PUBLISH_MAX_SIZE= # Optional immediate Files Bridge publish cap by eligible file count. Leave empty to use the app safety default. QORTAL_FILES_PUBLISH_MAX_COUNT= # Nextcloud PHP upload limits applied on container recreate. Keep separate from QDN publish limits. NEXTCLOUD_PHP_UPLOAD_MAX_FILESIZE=5G NEXTCLOUD_PHP_POST_MAX_SIZE=5G NEXTCLOUD_PHP_MEMORY_LIMIT= # If using bundled External Auth (profile external-auth), set to http://external_auth:3191 QORTAL_EXTERNAL_AUTH_BASE_URL=http://gateway.docker.internal:3191 QORTAL_EXTERNAL_AUTH_APP_ID= QORTAL_EXTERNAL_AUTH_APP_SECRET= OIDC_ISSUER=https://qortalbroker.example.test OIDC_CLIENT_ID=nextcloud-local OIDC_CLIENT_SECRET=dev-secret OIDC_REDIRECT_URI_ALLOWLIST=https://cloud.example.test/apps/user_oidc/code OIDC_POLICY_MODE=auto_provision OIDC_AUTO_PROVISION_GUARD=invite_or_allowlist OIDC_INVITE_TTL_SECONDS=604800 OIDC_REQUIRE_EMAIL_FOR_NEW_ACCOUNT=false OIDC_BRANDING_MODE=powered OIDC_AUTH_REQUEST_TTL_SECONDS=600 OIDC_AUTH_CODE_TTL_SECONDS=120 OIDC_ACCESS_TOKEN_TTL_SECONDS=600 OIDC_ID_TOKEN_TTL_SECONDS=600 # Optional: override the logo shown on the OIDC login page. OIDC_LOGIN_LOGO_URL= # Optional: provide a persistent PEM key to avoid rotating signing keys on broker restarts. OIDC_PRIVATE_KEY_PEM= # Preferred script-managed form of the same PEM, safe for single-line env files. OIDC_PRIVATE_KEY_PEM_B64= # Optional: set a stable key ID if you provide your own key. OIDC_KEY_ID= # NuQloud / CHD managed billing (optional but recommended for powered-mode purchases) # These values are synced into qortal_integration app settings by finish-initial-setup.sh. # If unset, the app may still show fallback/default package info and first-time CHD connect can fail. NUQLOUD_CHD_BASE_URL= NUQLOUD_CHD_SYNC_PATH=/api/sovereign/v1/entitlements/sync NUQLOUD_CHD_REGISTER_PATH=/api/sovereign/v1/install/register NUQLOUD_CHD_CHECKOUT_PATH=/api/sovereign/v1/billing/checkout-link NUQLOUD_CHD_CATALOG_PATH=/api/sovereign/v1/billing/catalog NUQLOUD_CHD_CATALOG_CATEGORY_ID= NUQLOUD_CHD_REGISTRATION_TOKEN= # Optional billing defaults used for checkout prefill. NUQLOUD_BILLING_CONTACT_NAME= NUQLOUD_BILLING_CONTACT_EMAIL= NUQLOUD_BILLING_COMPANY_NAME= # Optional overrides (defaults are powered + enabled + CHD-managed + paymenter). NUQLOUD_MODE=powered NUQLOUD_BILLING_ENABLED=1 NUQLOUD_BILLING_MANAGED_BY_CHD=1 NUQLOUD_BILLING_PROVIDER=paymenter # read_only or managed (connector-specific behavior) NUQLOUD_BILLING_SYNC_MODE=read_only # Optional app profiles (comma separated): external-auth,office,talk,turn,janus COMPOSE_PROFILES= # Stable Docker Compose project name for this cloud instance. # Set it once and keep it unchanged even if the folder name or public domain changes. COMPOSE_PROJECT_NAME= # Optional recommended Nextcloud app bundle (install/enable during install/recreate/finish flows). INSTALL_DEFAULT_APP_BUNDLE=0 # App IDs only. Bundle is best-effort: unavailable app-store apps will be warned and skipped. NEXTCLOUD_DEFAULT_APP_BUNDLE=notify_push,user_oidc,activity,announcementcenter,calendar,collectives,systemtags,comments,contacts,deck,external,files_accesscontrol,libresign,mail,notes,passwords,circles,groupfolders # Comma-separated Nextcloud navigation order applied to config.php defaultapp. NEXTCLOUD_DEFAULT_APP_ORDER=dashboard,files,calendar,mail,deck,contacts,notes,collectives LIBRESIGN_AUTO_SETUP=1 LIBRESIGN_AUTO_INSTALL_BINARIES=1 LIBRESIGN_CERT_ENGINE=openssl # Defaults to "NuQloud Root CA" when empty. LIBRESIGN_CERT_CN= # Defaults to NUQLOUD_BILLING_COMPANY_NAME or "NuQloud" when empty. LIBRESIGN_CERT_O= LIBRESIGN_CERT_OU=Document Signing LIBRESIGN_CERT_C= LIBRESIGN_CERT_ST= LIBRESIGN_CERT_L= # Collabora / Nextcloud Office (profile: office) COLLABORA_PUBLIC_URL=https://office.cloud.example.test COLLABORA_BIND_HOST=127.0.0.1 COLLABORA_PORT=9980 COLLABORA_ADMIN_USER=admin COLLABORA_ADMIN_PASSWORD= # Caddy (TLS) # For public ACME/Let's Encrypt, this must be a real email on a public domain. CADDY_EMAIL=admin@example.test # Set to "tls internal" for local/self-signed testing. Leave empty for Let's Encrypt. CADDY_TLS= # Override Caddy listen ports if you need to avoid 80/443. CADDY_HTTP_PORT=80 CADDY_HTTPS_PORT=443 # No-SSL stack (when using external proxy) # These are the host loopback ports your external/global Caddy should proxy to. # EXTERNAL_PROXY_MODE values: # none bundled SSL stack or no external proxy assumptions # manual no-SSL stack behind some manually managed external proxy # global-caddy no-SSL stack behind the repo-managed shared/global Caddy workflow EXTERNAL_PROXY_MODE=manual # For a host-installed proxy, keep these bind hosts on 127.0.0.1. # For a containerized shared/global Caddy, set the relevant bind hosts to 0.0.0.0 # so the proxy container can reach them via host.docker.internal / host-gateway. DEVPROD_HTTP_BIND_HOST=127.0.0.1 DEVPROD_HTTP_PORT=8081 DEVPROD_BROKER_BIND_HOST=127.0.0.1 DEVPROD_BROKER_PORT=3001 # External proxy HTTPS port (used to build URLs when no-SSL stack is used). PUBLIC_HTTPS_PORT=443 # Nextcloud Talk HPB (profile: talk; with-turn/with-janus also use talk HPB service) TALK_SIGNALING_PUBLIC_URL=https://talk.cloud.example.test # talk_hpb runs on bridge networking with explicit host port publishing. TALK_SIGNALING_BIND_HOST=0.0.0.0 # Public/host port exposed for the signaling service. Multi-instance no-SSL # installs can use a unique host port here, for example 8083. TALK_SIGNALING_PORT=8081 # Internal container listen port for aio-talk signaling. Keep this at 8081 # unless the upstream image changes its internal listener. TALK_SIGNALING_CONTAINER_PORT=8081 TALK_SIGNALING_UPSTREAM_HOST=host.docker.internal # Port the external/global proxy uses to reach the host-published signaling # service. This normally matches TALK_SIGNALING_PORT, not the container port. TALK_SIGNALING_UPSTREAM_PORT=8081 # Internal eturnal Erlang port used by aio-talk. # In bridge mode this is container-local; keep it unique only if you switch back to host mode. TALK_ETURNAL_EPMD_PORT=3470 TALK_SIGNALING_SECRET= TALK_INTERNAL_SECRET= TALK_HPB_IMAGE=nuqloud-talk-hpb:local TALK_HPB_BASE_IMAGE=ghcr.io/nextcloud-releases/aio-talk:latest # Defaults to NEXTCLOUD_DOMAIN when empty. TALK_TURN_HOST= # Defaults to TALK_TURN_HOST when empty; used to patch Janus NAT/STUN config. TALK_JANUS_STUN_SERVER= # Defaults to TALK_TURN_PORT when empty; used to patch Janus NAT/STUN config. TALK_JANUS_STUN_PORT= # Defaults to TALK_TURN_HOST:TALK_TURN_PORT via installer auto-derive when empty. TALK_STUN_SERVER= # Defaults to TALK_TURN_HOST:TALK_TURN_PORT via installer auto-derive when empty. TALK_TURN_SERVER= TALK_TURN_BIND_HOST=0.0.0.0 TALK_TURN_PORT=3478 TALK_TURN_SECRET= TALK_RECORDING_IMAGE=nextcloud/aio-talk-recording:latest TALK_RECORDING_BIND_HOST=127.0.0.1 TALK_RECORDING_PORT=1234 TALK_RECORDING_URL=http://talk_recording:1234 TALK_RECORDING_SHARED_SECRET= # Legacy alias kept for backward compatibility; prefer SIGNALING_DOMAIN. TALK_DOMAIN=talk.cloud.example.test # External Auth container (optional) EXTERNAL_AUTH_CONTEXT=../Qortal-External-Auth EXTERNAL_AUTH_DOCKERFILE=Dockerfile # Host publish port only. Internal Docker port remains 3191. EXTERNAL_AUTH_PORT=3191 # Bundled Qortal node container (default) # Optional public gateway URL if exposing the Qortal gateway through shared/global proxy. QORTAL_PUBLIC_GATEWAY_URL= QORTAL_NODE_CONTEXT=../qortal QORTAL_NODE_DOCKERFILE=Dockerfile QORTAL_NODE_GATEWAY_BIND_HOST=127.0.0.1 # Keep gateway as API-1 (e.g. 22391 -> 22390). QORTAL_NODE_GATEWAY_HOST_PORT=12390 QORTAL_NODE_API_BIND_HOST=127.0.0.1 # Auto-selection script chooses API host port first. QORTAL_NODE_API_HOST_PORT=12391 QORTAL_NODE_P2P_BIND_HOST=0.0.0.0 # Keep P2P as API+1 (e.g. 22391 -> 22392). QORTAL_NODE_P2P_HOST_PORT=12392 QORTAL_NODE_QDN_BIND_HOST=0.0.0.0 # Keep QDN data as API+3 (e.g. 22391 -> 22394). QORTAL_NODE_QDN_HOST_PORT=12394 # Optional seed value for qortal/data/start-arguments.txt (used if file is missing/empty). # Default when unset: -XX:MaxRAMPercentage=25 -XX:+UseG1GC -Xss1024k QORTAL_JVM_MEMORY_ARGS=-XX:MaxRAMPercentage=25 -XX:+UseG1GC -Xss1024k # External Auth -> Qortal node URL (internal Docker network by default) QORTAL_AUTH_NODE_URL=http://qortal_node:12391 # Optional Qortal node API key for external-auth when node restricts endpoints. QORTAL_AUTH_NODE_API_KEY= # paths: enforce key header for configured paths. Use "/" to send key for all node routes. QORTAL_AUTH_NODE_API_KEY_MODE=paths # "/" means send X-API-KEY for every node API request when a key is configured. QORTAL_AUTH_NODE_API_KEY_PATHS=/