245 lines
11 KiB
Bash
245 lines
11 KiB
Bash
# Domains (used by Caddy + OIDC)
|
|
NEXTCLOUD_DOMAIN=cloud.example.test
|
|
BROKER_DOMAIN=qortalbroker.example.test
|
|
COLLABORA_DOMAIN=office.cloud.example.test
|
|
SIGNALING_DOMAIN=talk.cloud.example.test
|
|
|
|
# Nextcloud
|
|
NEXTCLOUD_IMAGE=nextcloud:33-apache
|
|
# Tested image majors in this repo are 32 and 33.
|
|
# Host path mounted to /var/www/html/custom_apps inside the Nextcloud container.
|
|
# Use a separate path (for example ./nextcloud/custom_apps_appstore) to mimic app-store installs.
|
|
NEXTCLOUD_CUSTOM_APPS_PATH=./nextcloud/custom_apps
|
|
# Legacy/non-devprod port key. Not used by docker-compose.devprod.yml or docker-compose.devprod.nossl.yml.
|
|
# For the no-SSL devprod stack, use DEVPROD_HTTP_PORT below.
|
|
NEXTCLOUD_PORT=8080
|
|
NEXTCLOUD_ADMIN_USER=admin
|
|
NEXTCLOUD_ADMIN_PASSWORD=admin123
|
|
NEXTCLOUD_TRUSTED_DOMAINS=cloud.example.test
|
|
|
|
# MariaDB
|
|
MYSQL_ROOT_PASSWORD=rootpass
|
|
MYSQL_DATABASE=nextcloud
|
|
MYSQL_USER=nextcloud
|
|
MYSQL_PASSWORD=nextcloudpass
|
|
|
|
# Redis
|
|
REDIS_PORT=6379
|
|
|
|
# Broker PostgreSQL
|
|
BROKER_DB_NAME=qortal_broker
|
|
BROKER_DB_USER=qortal_broker
|
|
BROKER_DB_PASSWORD=qortal_brokerpass
|
|
|
|
# Broker service
|
|
# Legacy/non-devprod port key. Not used by docker-compose.devprod.yml or docker-compose.devprod.nossl.yml.
|
|
# For the no-SSL devprod stack, use DEVPROD_BROKER_PORT below.
|
|
BROKER_PORT=3000
|
|
NEXTCLOUD_BASE_URL=http://app
|
|
NEXTCLOUD_PUBLIC_URL=https://cloud.example.test
|
|
# Optional explicit trusted proxy list (comma-separated IP/CIDR/host). Installer auto-adds bundled caddy proxy when present.
|
|
NEXTCLOUD_TRUSTED_PROXIES=
|
|
# Optional forwarded-for header list (comma-separated). Defaults to HTTP_X_FORWARDED_FOR.
|
|
NEXTCLOUD_FORWARDED_FOR_HEADERS=HTTP_X_FORWARDED_FOR
|
|
# Dedicated broker service account for OIDC/OCS API calls (keep separate from human admin login).
|
|
# Existing installs can keep sovereign_oidc_service; new installs default to nuqloud_oidc_service.
|
|
NEXTCLOUD_SERVICE_USER=nuqloud_oidc_service
|
|
NEXTCLOUD_SERVICE_PASSWORD=service-oidc-change-me
|
|
# Derived from BROKER_DB_* by install scripts; keep host as broker_db unless customizing compose service names.
|
|
BROKER_DATABASE_URL=postgresql://qortal_broker:qortal_brokerpass@broker_db:5432/qortal_broker
|
|
BROKER_INTERNAL_API_TOKEN=
|
|
# Optional comma-separated browser origins allowed for broker CORS (internal server-to-server calls do not use CORS).
|
|
BROKER_CORS_ALLOWED_ORIGINS=
|
|
# Max broker request body size for qapps/qortal JSON payloads (large QDN publishes may exceed 5mb).
|
|
BROKER_REQUEST_BODY_LIMIT=64mb
|
|
# Optional default Files Bridge publish ceiling. Leave empty to derive from broker-oriented publish limits.
|
|
QORTAL_FILES_PUBLISH_MAX_SIZE=
|
|
# Optional immediate Files Bridge publish cap by eligible file count. Leave empty to use the app safety default.
|
|
QORTAL_FILES_PUBLISH_MAX_COUNT=
|
|
# Nextcloud PHP upload limits applied on container recreate. Keep separate from QDN publish limits.
|
|
NEXTCLOUD_PHP_UPLOAD_MAX_FILESIZE=5G
|
|
NEXTCLOUD_PHP_POST_MAX_SIZE=5G
|
|
NEXTCLOUD_PHP_MEMORY_LIMIT=
|
|
# If using bundled External Auth (profile external-auth), set to http://external_auth:3191
|
|
QORTAL_EXTERNAL_AUTH_BASE_URL=http://gateway.docker.internal:3191
|
|
QORTAL_EXTERNAL_AUTH_APP_ID=
|
|
QORTAL_EXTERNAL_AUTH_APP_SECRET=
|
|
OIDC_ISSUER=https://qortalbroker.example.test
|
|
OIDC_CLIENT_ID=nextcloud-local
|
|
OIDC_CLIENT_SECRET=dev-secret
|
|
OIDC_REDIRECT_URI_ALLOWLIST=https://cloud.example.test/apps/user_oidc/code
|
|
OIDC_POLICY_MODE=auto_provision
|
|
OIDC_AUTO_PROVISION_GUARD=invite_or_allowlist
|
|
OIDC_INVITE_TTL_SECONDS=604800
|
|
OIDC_REQUIRE_EMAIL_FOR_NEW_ACCOUNT=false
|
|
OIDC_BRANDING_MODE=powered
|
|
OIDC_AUTH_REQUEST_TTL_SECONDS=600
|
|
OIDC_AUTH_CODE_TTL_SECONDS=120
|
|
OIDC_ACCESS_TOKEN_TTL_SECONDS=600
|
|
OIDC_ID_TOKEN_TTL_SECONDS=600
|
|
# Optional: override the logo shown on the OIDC login page.
|
|
OIDC_LOGIN_LOGO_URL=
|
|
# Optional: provide a persistent PEM key to avoid rotating signing keys on broker restarts.
|
|
OIDC_PRIVATE_KEY_PEM=
|
|
# Preferred script-managed form of the same PEM, safe for single-line env files.
|
|
OIDC_PRIVATE_KEY_PEM_B64=
|
|
# Optional: set a stable key ID if you provide your own key.
|
|
OIDC_KEY_ID=
|
|
|
|
# NuQloud / CHD managed billing (optional but recommended for powered-mode purchases)
|
|
# These values are synced into qortal_integration app settings by finish-initial-setup.sh.
|
|
# If unset, the app may still show fallback/default package info and first-time CHD connect can fail.
|
|
NUQLOUD_CHD_BASE_URL=
|
|
NUQLOUD_CHD_SYNC_PATH=/api/sovereign/v1/entitlements/sync
|
|
NUQLOUD_CHD_REGISTER_PATH=/api/sovereign/v1/install/register
|
|
NUQLOUD_CHD_CHECKOUT_PATH=/api/sovereign/v1/billing/checkout-link
|
|
NUQLOUD_CHD_CATALOG_PATH=/api/sovereign/v1/billing/catalog
|
|
NUQLOUD_CHD_CATALOG_CATEGORY_ID=
|
|
NUQLOUD_CHD_REGISTRATION_TOKEN=
|
|
# Optional billing defaults used for checkout prefill.
|
|
NUQLOUD_BILLING_CONTACT_NAME=
|
|
NUQLOUD_BILLING_CONTACT_EMAIL=
|
|
NUQLOUD_BILLING_COMPANY_NAME=
|
|
# Optional overrides (defaults are powered + enabled + CHD-managed + paymenter).
|
|
NUQLOUD_MODE=powered
|
|
NUQLOUD_BILLING_ENABLED=1
|
|
NUQLOUD_BILLING_MANAGED_BY_CHD=1
|
|
NUQLOUD_BILLING_PROVIDER=paymenter
|
|
# read_only or managed (connector-specific behavior)
|
|
NUQLOUD_BILLING_SYNC_MODE=read_only
|
|
|
|
# Optional app profiles (comma separated): external-auth,office,talk,turn,janus
|
|
COMPOSE_PROFILES=
|
|
# Stable Docker Compose project name for this cloud instance.
|
|
# Set it once and keep it unchanged even if the folder name or public domain changes.
|
|
COMPOSE_PROJECT_NAME=
|
|
|
|
# Optional recommended Nextcloud app bundle (install/enable during install/recreate/finish flows).
|
|
INSTALL_DEFAULT_APP_BUNDLE=0
|
|
# App IDs only. Bundle is best-effort: unavailable app-store apps will be warned and skipped.
|
|
NEXTCLOUD_DEFAULT_APP_BUNDLE=notify_push,user_oidc,activity,announcementcenter,calendar,collectives,systemtags,comments,contacts,deck,external,files_accesscontrol,libresign,mail,notes,passwords,circles,groupfolders
|
|
# Comma-separated Nextcloud navigation order applied to config.php defaultapp.
|
|
NEXTCLOUD_DEFAULT_APP_ORDER=dashboard,files,calendar,mail,deck,contacts,notes,collectives
|
|
LIBRESIGN_AUTO_SETUP=1
|
|
LIBRESIGN_AUTO_INSTALL_BINARIES=1
|
|
LIBRESIGN_CERT_ENGINE=openssl
|
|
# Defaults to "NuQloud <NEXTCLOUD_DOMAIN> Root CA" when empty.
|
|
LIBRESIGN_CERT_CN=
|
|
# Defaults to NUQLOUD_BILLING_COMPANY_NAME or "NuQloud" when empty.
|
|
LIBRESIGN_CERT_O=
|
|
LIBRESIGN_CERT_OU=Document Signing
|
|
LIBRESIGN_CERT_C=
|
|
LIBRESIGN_CERT_ST=
|
|
LIBRESIGN_CERT_L=
|
|
|
|
# Collabora / Nextcloud Office (profile: office)
|
|
COLLABORA_PUBLIC_URL=https://office.cloud.example.test
|
|
COLLABORA_BIND_HOST=127.0.0.1
|
|
COLLABORA_PORT=9980
|
|
COLLABORA_ADMIN_USER=admin
|
|
COLLABORA_ADMIN_PASSWORD=
|
|
|
|
# Caddy (TLS)
|
|
# For public ACME/Let's Encrypt, this must be a real email on a public domain.
|
|
CADDY_EMAIL=admin@example.test
|
|
# Set to "tls internal" for local/self-signed testing. Leave empty for Let's Encrypt.
|
|
CADDY_TLS=
|
|
# Override Caddy listen ports if you need to avoid 80/443.
|
|
CADDY_HTTP_PORT=80
|
|
CADDY_HTTPS_PORT=443
|
|
|
|
# No-SSL stack (when using external proxy)
|
|
# These are the host loopback ports your external/global Caddy should proxy to.
|
|
# EXTERNAL_PROXY_MODE values:
|
|
# none bundled SSL stack or no external proxy assumptions
|
|
# manual no-SSL stack behind some manually managed external proxy
|
|
# global-caddy no-SSL stack behind the repo-managed shared/global Caddy workflow
|
|
EXTERNAL_PROXY_MODE=manual
|
|
# For a host-installed proxy, keep these bind hosts on 127.0.0.1.
|
|
# For a containerized shared/global Caddy, set the relevant bind hosts to 0.0.0.0
|
|
# so the proxy container can reach them via host.docker.internal / host-gateway.
|
|
DEVPROD_HTTP_BIND_HOST=127.0.0.1
|
|
DEVPROD_HTTP_PORT=8081
|
|
DEVPROD_BROKER_BIND_HOST=127.0.0.1
|
|
DEVPROD_BROKER_PORT=3001
|
|
# External proxy HTTPS port (used to build URLs when no-SSL stack is used).
|
|
PUBLIC_HTTPS_PORT=443
|
|
|
|
# Nextcloud Talk HPB (profile: talk; with-turn/with-janus also use talk HPB service)
|
|
TALK_SIGNALING_PUBLIC_URL=https://talk.cloud.example.test
|
|
# talk_hpb runs on bridge networking with explicit host port publishing.
|
|
TALK_SIGNALING_BIND_HOST=0.0.0.0
|
|
# Public/host port exposed for the signaling service. Multi-instance no-SSL
|
|
# installs can use a unique host port here, for example 8083.
|
|
TALK_SIGNALING_PORT=8081
|
|
# Internal container listen port for aio-talk signaling. Keep this at 8081
|
|
# unless the upstream image changes its internal listener.
|
|
TALK_SIGNALING_CONTAINER_PORT=8081
|
|
TALK_SIGNALING_UPSTREAM_HOST=host.docker.internal
|
|
# Port the external/global proxy uses to reach the host-published signaling
|
|
# service. This normally matches TALK_SIGNALING_PORT, not the container port.
|
|
TALK_SIGNALING_UPSTREAM_PORT=8081
|
|
# Internal eturnal Erlang port used by aio-talk.
|
|
# In bridge mode this is container-local; keep it unique only if you switch back to host mode.
|
|
TALK_ETURNAL_EPMD_PORT=3470
|
|
TALK_SIGNALING_SECRET=
|
|
TALK_INTERNAL_SECRET=
|
|
TALK_HPB_IMAGE=nuqloud-talk-hpb:local
|
|
TALK_HPB_BASE_IMAGE=ghcr.io/nextcloud-releases/aio-talk:latest
|
|
# Defaults to NEXTCLOUD_DOMAIN when empty.
|
|
TALK_TURN_HOST=
|
|
# Defaults to TALK_TURN_HOST when empty; used to patch Janus NAT/STUN config.
|
|
TALK_JANUS_STUN_SERVER=
|
|
# Defaults to TALK_TURN_PORT when empty; used to patch Janus NAT/STUN config.
|
|
TALK_JANUS_STUN_PORT=
|
|
# Defaults to TALK_TURN_HOST:TALK_TURN_PORT via installer auto-derive when empty.
|
|
TALK_STUN_SERVER=
|
|
# Defaults to TALK_TURN_HOST:TALK_TURN_PORT via installer auto-derive when empty.
|
|
TALK_TURN_SERVER=
|
|
TALK_TURN_BIND_HOST=0.0.0.0
|
|
TALK_TURN_PORT=3478
|
|
TALK_TURN_SECRET=
|
|
TALK_RECORDING_IMAGE=nextcloud/aio-talk-recording:latest
|
|
TALK_RECORDING_BIND_HOST=127.0.0.1
|
|
TALK_RECORDING_PORT=1234
|
|
TALK_RECORDING_URL=http://talk_recording:1234
|
|
TALK_RECORDING_SHARED_SECRET=
|
|
# Legacy alias kept for backward compatibility; prefer SIGNALING_DOMAIN.
|
|
TALK_DOMAIN=talk.cloud.example.test
|
|
|
|
# External Auth container (optional)
|
|
EXTERNAL_AUTH_CONTEXT=../Qortal-External-Auth
|
|
EXTERNAL_AUTH_DOCKERFILE=Dockerfile
|
|
# Host publish port only. Internal Docker port remains 3191.
|
|
EXTERNAL_AUTH_PORT=3191
|
|
|
|
# Bundled Qortal node container (default)
|
|
# Optional public gateway URL if exposing the Qortal gateway through shared/global proxy.
|
|
QORTAL_PUBLIC_GATEWAY_URL=
|
|
QORTAL_NODE_CONTEXT=../qortal
|
|
QORTAL_NODE_DOCKERFILE=Dockerfile
|
|
QORTAL_NODE_GATEWAY_BIND_HOST=127.0.0.1
|
|
# Keep gateway as API-1 (e.g. 22391 -> 22390).
|
|
QORTAL_NODE_GATEWAY_HOST_PORT=12390
|
|
QORTAL_NODE_API_BIND_HOST=127.0.0.1
|
|
# Auto-selection script chooses API host port first.
|
|
QORTAL_NODE_API_HOST_PORT=12391
|
|
QORTAL_NODE_P2P_BIND_HOST=0.0.0.0
|
|
# Keep P2P as API+1 (e.g. 22391 -> 22392).
|
|
QORTAL_NODE_P2P_HOST_PORT=12392
|
|
QORTAL_NODE_QDN_BIND_HOST=0.0.0.0
|
|
# Keep QDN data as API+3 (e.g. 22391 -> 22394).
|
|
QORTAL_NODE_QDN_HOST_PORT=12394
|
|
# Optional seed value for qortal/data/start-arguments.txt (used if file is missing/empty).
|
|
# Default when unset: -XX:MaxRAMPercentage=25 -XX:+UseG1GC -Xss1024k
|
|
QORTAL_JVM_MEMORY_ARGS=-XX:MaxRAMPercentage=25 -XX:+UseG1GC -Xss1024k
|
|
|
|
# External Auth -> Qortal node URL (internal Docker network by default)
|
|
QORTAL_AUTH_NODE_URL=http://qortal_node:12391
|
|
# Optional Qortal node API key for external-auth when node restricts endpoints.
|
|
QORTAL_AUTH_NODE_API_KEY=
|
|
# paths: enforce key header for configured paths. Use "/" to send key for all node routes.
|
|
QORTAL_AUTH_NODE_API_KEY_MODE=paths
|
|
# "/" means send X-API-KEY for every node API request when a key is configured.
|
|
QORTAL_AUTH_NODE_API_KEY_PATHS=/
|