# Nextcloud
NEXTCLOUD_IMAGE=nextcloud:34-apache
# Tested image majors in this repo are 32 and 33.
# Host path mounted to /var/www/html/custom_apps inside the Nextcloud container.
# Use a separate path (for example ./nextcloud/custom_apps_appstore) to mimic app-store installs.
NEXTCLOUD_CUSTOM_APPS_PATH=./nextcloud/custom_apps
NEXTCLOUD_PORT=8080
NEXTCLOUD_ADMIN_USER=admin
NEXTCLOUD_ADMIN_PASSWORD=admin123
NEXTCLOUD_TRUSTED_DOMAINS=localhost 127.0.0.1 app

# MariaDB
MYSQL_ROOT_PASSWORD=rootpass
MYSQL_DATABASE=nextcloud
MYSQL_USER=nextcloud
MYSQL_PASSWORD=nextcloudpass

# Redis
REDIS_PORT=6379

# Broker PostgreSQL
BROKER_DB_NAME=qortal_broker
BROKER_DB_USER=qortal_broker
BROKER_DB_PASSWORD=qortal_brokerpass

# Broker service
BROKER_PORT=3000
NEXTCLOUD_BASE_URL=http://app
# Optional: public URL reachable by the browser (used for logo assets on the broker login page).
NEXTCLOUD_PUBLIC_URL=http://localhost:8080
# Dedicated broker service account for OIDC/OCS API calls (keep separate from human admin login).
# Existing installs can keep sovereign_oidc_service; new installs default to nuqloud_oidc_service.
NEXTCLOUD_SERVICE_USER=nuqloud_oidc_service
NEXTCLOUD_SERVICE_PASSWORD=service-oidc-change-me
# Derived from BROKER_DB_* by install scripts; keep host as broker_db unless customizing compose service names.
BROKER_DATABASE_URL=postgresql://qortal_broker:qortal_brokerpass@broker_db:5432/qortal_broker
BROKER_INTERNAL_API_TOKEN=
# Optional comma-separated browser origins allowed for broker CORS (internal server-to-server calls do not use CORS).
BROKER_CORS_ALLOWED_ORIGINS=
# Max broker request body size for qapps/qortal JSON payloads (large QDN publishes may exceed 5mb).
BROKER_REQUEST_BODY_LIMIT=64mb
# Optional default Files Bridge publish ceiling. Leave empty to derive from broker-oriented publish limits.
QORTAL_FILES_PUBLISH_MAX_SIZE=
# Nextcloud PHP upload limits applied on container recreate. Keep separate from QDN publish limits.
NEXTCLOUD_PHP_UPLOAD_MAX_FILESIZE=5G
NEXTCLOUD_PHP_POST_MAX_SIZE=5G
NEXTCLOUD_PHP_MEMORY_LIMIT=
# If using bundled External Auth (profile external-auth), set to http://external_auth:3191
QORTAL_EXTERNAL_AUTH_BASE_URL=http://gateway.docker.internal:3191
QORTAL_EXTERNAL_AUTH_APP_ID=
QORTAL_EXTERNAL_AUTH_APP_SECRET=
OIDC_ISSUER=http://broker:3000
OIDC_CLIENT_ID=nextcloud-local
OIDC_CLIENT_SECRET=dev-secret
OIDC_REDIRECT_URI_ALLOWLIST=http://localhost:8080/apps/user_oidc/code
OIDC_POLICY_MODE=auto_provision
OIDC_AUTO_PROVISION_GUARD=invite_or_allowlist
OIDC_INVITE_TTL_SECONDS=604800
OIDC_REQUIRE_EMAIL_FOR_NEW_ACCOUNT=false
OIDC_BRANDING_MODE=powered
OIDC_AUTH_REQUEST_TTL_SECONDS=600
OIDC_AUTH_CODE_TTL_SECONDS=120
OIDC_ACCESS_TOKEN_TTL_SECONDS=600
OIDC_ID_TOKEN_TTL_SECONDS=600
# Optional: override the logo shown on the OIDC login page.
# Defaults to ${NEXTCLOUD_BASE_URL}/apps/qortal_integration/img/QORT-logo-512.png
# OIDC_LOGIN_LOGO_URL=
# Optional: provide a persistent PEM key to avoid rotating signing keys on broker restarts.
# OIDC_PRIVATE_KEY_PEM=
# Preferred script-managed form of the same PEM, safe for single-line env files.
OIDC_PRIVATE_KEY_PEM_B64=
# Optional: set a stable key ID if you provide your own key.
# OIDC_KEY_ID=

# External Auth container (optional)
EXTERNAL_AUTH_CONTEXT=../Qortal-External-Auth
EXTERNAL_AUTH_DOCKERFILE=Dockerfile
# Host publish port only. Internal Docker port remains 3191.
EXTERNAL_AUTH_PORT=3191

# Bundled Qortal node container (default)
QORTAL_NODE_CONTEXT=../qortal
QORTAL_NODE_DOCKERFILE=Dockerfile
QORTAL_NODE_GATEWAY_BIND_HOST=127.0.0.1
# Keep gateway as API-1 (e.g. 22391 -> 22390).
QORTAL_NODE_GATEWAY_HOST_PORT=12390
QORTAL_NODE_API_BIND_HOST=127.0.0.1
# Auto-selection script chooses API host port first.
QORTAL_NODE_API_HOST_PORT=12391
QORTAL_NODE_P2P_BIND_HOST=0.0.0.0
# Keep P2P as API+1 (e.g. 22391 -> 22392).
QORTAL_NODE_P2P_HOST_PORT=12392
QORTAL_NODE_QDN_BIND_HOST=0.0.0.0
# Keep QDN data as API+3 (e.g. 22391 -> 22394).
QORTAL_NODE_QDN_HOST_PORT=12394
# Optional seed value for qortal/data/start-arguments.txt (used if file is missing/empty).
# Default when unset: -XX:MaxRAMPercentage=25 -XX:+UseG1GC -Xss1024k
QORTAL_JVM_MEMORY_ARGS=-XX:MaxRAMPercentage=25 -XX:+UseG1GC -Xss1024k

# External Auth -> Qortal node URL (internal Docker network by default)
QORTAL_AUTH_NODE_URL=http://qortal_node:12391
# Optional Qortal node API key for external-auth when node restricts endpoints.
QORTAL_AUTH_NODE_API_KEY=
# paths: enforce key header for configured paths. Use "/" to send key for all node routes.
QORTAL_AUTH_NODE_API_KEY_MODE=paths
# "/" means send X-API-KEY for every node API request when a key is configured.
QORTAL_AUTH_NODE_API_KEY_PATHS=/

# Talk HPB signaling ports
# Host/public port. Multi-instance no-SSL installs can use a unique host port.
TALK_SIGNALING_PORT=8081
# Internal aio-talk signaling listener. Keep at 8081 unless the upstream image changes.
TALK_SIGNALING_CONTAINER_PORT=8081
# External/global proxy upstream port. This should match TALK_SIGNALING_PORT.
TALK_SIGNALING_UPSTREAM_PORT=8081