.env.example

# ─────────────────────────────────────────────────────────────────────────────
# openwrt-controller — runtime configuration
# ─────────────────────────────────────────────────────────────────────────────
# Copy this file to .env and fill in the values. NEVER commit .env.
# Variables marked with `required` will make the controller refuse to start
# if they are empty (or fail-fast in docker-compose via ${VAR:?...}).
# ─────────────────────────────────────────────────────────────────────────────


# ── PostgreSQL ────────────────────────────────────────────────────────────────
# Strong password for the postgres superuser. Used by DATABASE_URL below and
# by the docker-compose service definition.
POSTGRES_PASSWORD=                    # required
DATABASE_URL=postgres://postgres:CHANGE_ME@localhost:5432/openwrthub

# Optional pool tuning. Defaults: 25 open / 10 idle / 5 min lifetime.
# PG_MAX_OPEN_CONNS=25
# PG_MAX_IDLE_CONNS=10

# Bind PostgreSQL to loopback only (no remote access). Production deploys
# that need remote access should set this to a private interface and
# update firewall rules. Used by docker-compose.yml.
# PG_BIND_ADDR=127.0.0.1


# ── JWT ──────────────────────────────────────────────────────────────────────
# HMAC secret for signing access tokens. Generate with:
#   openssl rand -base64 48
# Must be at least 32 characters.
JWT_SECRET=                           # required, min 32 chars


# ── InfluxDB (telemetry time-series store) ────────────────────────────────────
INFLUX_URL=http://localhost:8086
INFLUX_ORG=openwrthub
INFLUX_BUCKET=telemetry
INFLUX_TOKEN=                         # required, generate in InfluxDB UI
INFLUXDB_PASSWORD=                    # required for docker-compose init

# Bind InfluxDB to loopback only. See PG_BIND_ADDR for details.
# INFLUX_BIND_ADDR=127.0.0.1


# ── TLS / HTTPS ───────────────────────────────────────────────────────────────
# Set REQUIRE_TLS=true in production to refuse to start on plain HTTP.
# When true, BOTH TLS_CERT and TLS_KEY must point to readable PEM files.
REQUIRE_TLS=false
TLS_CERT=/etc/ssl/openwrt-controller.crt
TLS_KEY=/etc/ssl/openwrt-controller.key


# ── WebSocket origin allow-list ───────────────────────────────────────────────
# Comma-separated list of origins allowed to open a WebSocket against the
# controller. Default: none (reject all). Set this to your domain in
# production, e.g. WS_ALLOWED_ORIGINS=https://controller.example.com
# WS_ALLOWED_ORIGINS=


# ── OpenWrt agent compatibility ──────────────────────────────────────────────
# Set to false once every OpenWrt device has been updated to send the
# X-Device-Token header on telemetry posts. Disabling legacy mode prevents
# device config leaks via the unauthenticated provisioning path.
# Only the first enrollment of a device without a token is allowed without
# X-Device-Token. Existing devices must use their per-device token.
ALLOW_LEGACY_PROVISION=false


# ── Telegram bot ──────────────────────────────────────────────────────────────
# Used to derive an AES-256-GCM key for at-rest encryption of the bot
# token in the platform_settings table. Any passphrase works; pick
# something stable. Rotating this key invalidates the stored token.
# TELEGRAM_ENCRYPTION_KEY=

# ── AI engine ─────────────────────────────────────────────────────────────────
# Passphrase used to encrypt the provider API key in platform_settings.
# Keep it stable; changing it makes existing AI keys unreadable.
# AI_ENGINE_ENCRYPTION_KEY=


# ── SuperAdmin bootstrap ──────────────────────────────────────────────────────
# If unset, a random password is generated and logged on first boot.
# SUPERADMIN_DEFAULT_PASSWORD=


# ── Controller SSH key permissions ───────────────────────────────────────────
# The KeyStore refuses to load the controller SSH private key if its
# permissions are wider than 0600, unless this is set to 1. Set to 1
# only if you have a specific reason (e.g. shared volume with a
# read-only group).
# CONTROLLER_SSH_ALLOW_GROUP_READ=0