# zrok2 Docker Compose — environment variables
#
# Copy this file to .env and edit the values below. All variables with
# "changeme" MUST be changed before starting the stack.
#
# Variable names match the Linux self-hosting guide so the same values
# work in both environments.

# ── Required ──────────────────────────────────────────────────────────────────

# DNS zone with a wildcard * A record resolving to this host.
# Example: share.example.com → then *.share.example.com resolves here.
ZROK2_DNS_ZONE=share.example.com

# Administrative token for the zrok2 controller (min 32 chars recommended).
ZROK2_ADMIN_TOKEN=changeme-zrok2-admin-token-at-least-32-chars

# Password for the Ziti controller admin user.
ZITI_PWD=changeme-ziti-password

# ── Optional — Ziti Overlay ──────────────────────────────────────────────────

# Ziti controller image and version.
# ZITI_CONTROLLER_IMAGE=docker.io/openziti/ziti-controller
# ZITI_CONTROLLER_TAG=latest

# Ziti router image and version.
# ZITI_ROUTER_IMAGE=docker.io/openziti/ziti-router
# ZITI_ROUTER_TAG=latest

# Ziti control plane port (clients connect here for enrollment).
# ZITI_CTRL_PORT=1280

# Ziti router data-plane port (SDK clients connect here).
# ZITI_ROUTER_PORT=3022

# Ziti admin username.
# ZITI_USER=admin

# ── Optional — zrok2 Services ───────────────────────────────────────────────

# zrok2 container image.
# ZROK2_IMAGE=docker.io/openziti/zrok2
# ZROK2_TAG=latest

# zrok2 controller API port (internal).
# ZROK2_CTRL_PORT=18080

# zrok2 frontend port (internal).
# ZROK2_FRONTEND_PORT=8080

# Database type: "postgres" (default) or "sqlite3".
# ZROK2_STORE_TYPE=postgres

# PostgreSQL password.
ZROK2_DB_PASSWORD=changeme-db-password

# ── Optional — Metrics Pipeline ──────────────────────────────────────────────

# Set to "true" to enable the metrics pipeline (RabbitMQ + InfluxDB).
# ZROK2_METRICS_ENABLED=false

# InfluxDB admin password (must be 8+ characters).
# ZROK2_INFLUX_PASSWORD=changeme-influx-password

# InfluxDB API token.
ZROK2_INFLUX_TOKEN=changeme-influx-token

# ── Optional — TLS with Caddy ───────────────────────────────────────────────
# To enable TLS, run:
#   COMPOSE_FILE=compose.yml:compose.caddy.yml docker compose up -d
#
# Caddy DNS challenge plugin name (e.g., cloudflare, route53, digitalocean).
# CADDY_DNS_PLUGIN=cloudflare

# API token for the DNS provider.
# CADDY_DNS_PLUGIN_TOKEN=changeme

# ACME server URL (default: Let's Encrypt production).
# CADDY_ACME_API=https://acme-v02.api.letsencrypt.org/directory

# Interface to bind Caddy's HTTPS listener.
# CADDY_INTERFACE=0.0.0.0

# ── Build from Source ────────────────────────────────────────────────────────
# To build zrok2 from source instead of pulling a published image:
# COMPOSE_FILE=compose.yml:compose.build.yml

# ── Advanced ─────────────────────────────────────────────────────────────────

# Interface for insecure (non-TLS) service ports. Default: localhost only.
# Set to 0.0.0.0 if NOT using TLS and your host firewall handles access.
# ZROK2_INSECURE_INTERFACE=127.0.0.1

# UID for the "ziggy" user inside containers.
# ZIGGY_UID=2171