.env.example

# MeshCore Analyzer — Environment Configuration
# Copy to .env and customize. All values have sensible defaults.
#
# This file is read by BOTH docker compose AND manage.sh — one source of truth.
# manage.sh setup negotiates and updates only these production managed keys:
#   PROD_DATA_DIR, PROD_HTTP_PORT, PROD_HTTPS_PORT, PROD_MQTT_PORT, DISABLE_MOSQUITTO
# Each environment keeps config + data together in one directory:
#   ~/meshcore-data/config.json, meshcore.db, Caddyfile, theme.json
#   ~/meshcore-staging-data/config.json, meshcore.db, Caddyfile

# --- Production ---
# Data directory (database, theme, etc.)
# Default: ~/meshcore-data
# Used by: docker compose, manage.sh
PROD_DATA_DIR=~/meshcore-data

# HTTP port for web UI
# Default: 80
# Used by: docker compose
PROD_HTTP_PORT=80

# HTTPS port for web UI (TLS via Caddy)
# Default: 443
# Used by: docker compose
PROD_HTTPS_PORT=443

# MQTT port for observer connections
# Default: 1883
# Used by: docker compose
PROD_MQTT_PORT=1883

# Host interface the bundled MQTT broker's port is published on.
# EMPTY (the default) publishes it with no host interface at all, which is
# what this stack has always done: docker then listens on both 0.0.0.0 and
# [::], i.e. IPv4 and IPv6. Do NOT write 0.0.0.0 here to mean "everywhere" —
# an explicit IPv4 host publishes IPv4 ONLY and would drop IPv6 clients.
# The bundled broker speaks plaintext MQTT, so the default exposes it to
# every network the host is on. Set 127.0.0.1 to keep it reachable from the
# host only (observers must then reach it through a tunnel or a reverse
# proxy).
# Default: (empty - every interface, IPv4 and IPv6)
# Used by: docker compose
PROD_MQTT_BIND=

# Disable the bundled Mosquitto broker. The bundled broker is OPT-IN (#441):
# leave this true and point mqttSources in config.json (or MQTT_BROKER below)
# at your own broker, or set it to false to run the bundled broker.
# true/1/yes/on and false/0/no/off are accepted, trimmed and in any case, by
# manage.sh, docker compose + the container entrypoint and the ingestor
# alike; an unset, empty or unrecognised value means true.
# Default: true
# Used by: manage.sh + docker compose overrides + the container entrypoint
DISABLE_MOSQUITTO=true

# --- Staging (HTTP only, no HTTPS) ---
# Data directory
# Default: ~/meshcore-staging-data
# Used by: docker compose
STAGING_DATA_DIR=~/meshcore-staging-data

# HTTP port
# Default: 82
# Used by: docker compose
STAGING_GO_HTTP_PORT=82

# MQTT port
# Default: 1885
# Used by: docker compose
STAGING_GO_MQTT_PORT=1885

# --- MQTT broker selection ---
# External MQTT broker URL. When set it REPLACES the mqttSources in
# config.json (see LoadConfig), which is the documented one-line way to point
# an external-broker install at its broker. Empty means "use config.json" —
# leave it empty unless you mean to override config.json, and run
# ./manage.sh broker-check to see which source the ingestor will use.
# Default: (empty - config.json decides)
# Used by: the ingestor
MQTT_BROKER=

# Topic pattern for the MQTT_BROKER source above. Ignored unless MQTT_BROKER
# is set.
# Default: meshcore/#
# Used by: the ingestor
MQTT_TOPIC=

# Refuse to start the ingestor when the broker setup cannot ingest anything,
# instead of only logging it. With the bundled broker off and no mqttSources
# (or only loopback ones) the ingestor connects to a broker that is not
# running; this turns that into a hard failure at startup.
# Accepted truthy values: 1 true TRUE yes YES y Y on ON
# Default: false
# Used by: the ingestor
MQTT_SOURCE_STRICT=false

# --- Profiling (pprof) ---
# pprof is off unless ENABLE_PPROF is EXACTLY "true" — "1", "yes" and "TRUE"
# leave it off (and the process says so in its log).
# Default: false
# Used by: the server + the ingestor
ENABLE_PPROF=false

# Host interface the pprof HOST PORTS are published on, for a container whose
# compose file maps them (docker-compose.staging*.yml). Empty means the
# default, 127.0.0.1 (#441): /debug/pprof/ is unauthenticated, so reach it
# through an SSH tunnel —
#   ssh -L 6060:127.0.0.1:6060 -L 6061:127.0.0.1:6061 you@host
# Set 0.0.0.0 to publish it on every IPv4 interface again (remote access).
# Default: 127.0.0.1
# Used by: docker compose
PPROF_BIND=

# Host the pprof listener INSIDE the process binds to. Empty means the
# default, 127.0.0.1 (#441). Set 0.0.0.0 (or *) to listen on every interface
# — needed for a process whose pprof port is reached from outside it without
# a compose file that handles this: a bare binary profiled remotely, or a
# `docker run -p ...:6060:6060`, since a loopback listener is NOT reachable
# through a docker port mapping. The staging compose files pin it to 0.0.0.0
# themselves and narrow the published port with PPROF_BIND instead.
# Per-role overrides: PPROF_HOST_SERVER, PPROF_HOST_INGESTOR below.
# Default: 127.0.0.1
# Used by: the server + the ingestor
PPROF_HOST=

# Per-role override of PPROF_HOST. Empty means "use PPROF_HOST".
# Default:
# Used by: the server
PPROF_HOST_SERVER=

# Default:
# Used by: the ingestor
PPROF_HOST_INGESTOR=

# pprof ports. The server and the ingestor must not share one: the second
# listener would fail to bind. PPROF_PORT applies to both (it predates the
# per-role settings); the per-role settings below take precedence.
# Default: (empty - each role uses its own default port below)
# Used by: the server + the ingestor
PPROF_PORT=

# Default: 6060
# Used by: the server
PPROF_PORT_SERVER=6060

# Default: 6061
# Used by: the ingestor
PPROF_PORT_INGESTOR=6061