.env.example

WALDUR_MASTERMIND_IMAGE_TAG=8.1.0-rc.16
WALDUR_HOMEPORT_IMAGE_TAG=8.1.0-rc.16

# WALDUR_DOMAIN will be used to generate both for Let's Encrypt and Self-signed (internal) certificates
WALDUR_DOMAIN=localhost
WALDUR_HTTP_PORT=80
WALDUR_HTTPS_PORT=443
WALDUR_TITLE=Waldur | Cloud Service Management

# (Required) Choose SSL certificate type (tls config value in Caddy)
# 1. email (Specify your email) - auto generate let's encrypt SSL certificates for your domain
# 2. "internal" - use self-signed certificates for dev environments (default)
# 3. path_to_cert.crt path_to_key.key - use custom certificate. Be sure to pass them in docker-compose.yml
TLS=internal

CONFIG_FOLDER=./config/
LOG_FOLDER=./waldur_logs

GLOBAL_SECRET_KEY=changeme
POSTGRESQL_PASSWORD=default
WALDUR_POSTGRES_IMAGE_TAG=16
KEYCLOAK_POSTGRES_IMAGE_TAG=16
RABBITMQ_USERNAME=waldur
RABBITMQ_PASSWORD=waldur
GLOBAL_DEFAULT_FROM_EMAIL=waldur@example.com
SENTRY_DSN=
GLOBAL_DEBUG=false
SENTRY_ENVIRONMENT=docker-compose-demo

# set gid of a docker group so that container user would be able to read and write to docker socket
# to get the gid, run: getent group docker
# for OS X, set the value to 0 if using Docker Desktop
DOCKER_GROUP_ID=0

DOCKER_REGISTRY_PREFIX=docker.io/

KEYCLOAK_POSTGRESQL_PASSWORD=changeme
KEYCLOAK_ADMIN_PASSWORD=changeme

KEYCLOAK_SECRET=76bc7e31-3c1b-4406-bd82-5c7f1fefd00a

EXTRA_HOST=host1.example.com:127.0.0.1

# --- Matrix chat add-on (optional) ---
# Activate with: docker compose --profile matrix up -d
# Add --profile matrix-rtc to also enable Element Call (LiveKit voice/video).
# Pinned tags — bump deliberately, do not track `latest`.
WALDUR_TUWUNEL_IMAGE_TAG=v1.7.1
WALDUR_LIVEKIT_IMAGE_TAG=v1.12.0
WALDUR_LK_JWT_IMAGE_TAG=0.5.0

# Localpart of the Waldur bot user inside the homeserver
# (becomes @<localpart>:${WALDUR_DOMAIN}).
WALDUR_MATRIX_BOT_LOCALPART=waldur-bot

# Fully OPEN, tokenless registration. Off by default — registration stays on but
# is gated by an auto-generated token only Waldur holds, so user provisioning
# (and password login) works without exposing the server. Set true only to let
# anyone self-register, which is abuse-prone.
WALDUR_MATRIX_OPEN_REGISTRATION=false

# Set to "true" when running with --profile matrix-rtc so the homeserver
# advertises the LiveKit RTC transport via .well-known.
WALDUR_MATRIX_RTC_ENABLED=false

# LiveKit API keys — CHANGE THESE for any deployment beyond localhost.
WALDUR_LIVEKIT_KEY=devkey
WALDUR_LIVEKIT_SECRET=devsecret

# LiveKit advertises this address to clients for RTC media. 127.0.0.1 is
# correct for a local demo; for any reachable deployment set this to the
# host's external IP (or DNS name) so remote clients can connect.
WALDUR_LIVEKIT_NODE_IP=127.0.0.1

# Host ports for the LiveKit RTC media path (TCP + UDP).
WALDUR_MATRIX_RTC_TCP_PORT=7881
WALDUR_MATRIX_RTC_UDP_PORT=7882

# TURN relay (optional, within --profile matrix-rtc). Relays media for clients
# behind symmetric NAT where direct media to WALDUR_LIVEKIT_NODE_IP fails.
# Uses TURN/UDP on port 443 and 443/udp is free on a single host (Caddy only binds 443/tcp).
# Open 443/udp on any upstream firewall. Does NOT help clients on networks that block
# all outbound UDP — that needs TURN/TLS on a dedicated IP.
WALDUR_MATRIX_TURN_ENABLED=false
WALDUR_MATRIX_TURN_UDP_PORT=443

# Optional: Readonly database configuration for /api/query/ endpoint
# Uncomment and configure these if you need to enable readonly database access
# POSTGRESQL_READONLY_USER=your_readonly_user
# POSTGRESQL_READONLY_PASSWORD=your_readonly_password

# Memory tuning for the mastermind API and worker containers.
# The image already enables gunicorn --preload and jemalloc by default, which
# share the import footprint across workers and curb allocator fragmentation.
# GUNICORN_PRELOAD: set to false to disable gunicorn preloading (e.g. for hot
# reload during debugging); defaults to true.
GUNICORN_PRELOAD=true
# CELERY_WORKER_MAX_MEMORY_PER_CHILD: hard per-child memory ceiling in KB; a
# child is recycled once it exceeds this. Empty/0 disables it (default). A value
# around 400000 (~400 MB) is a reasonable starting ceiling under load.
CELERY_WORKER_MAX_MEMORY_PER_CHILD=