diff --git a/Docker-AIO/.env.pocketbase.example b/Docker-AIO/.env.pocketbase.example
new file mode 100644
index 0000000..d72f79c
--- /dev/null
+++ b/Docker-AIO/.env.pocketbase.example
@@ -0,0 +1,171 @@
+# Settings for docker-compose.pocketbase.yml:
+# the homeserver on PocketBase, the admin panel and the web client, in
+# one container.
+#
+#   cp .env.pocketbase.example .env      # then edit it
+#   docker compose -f docker-compose.pocketbase.yml up -d --build
+#
+# Compose reads .env for the values it puts into the compose file, and hands
+# all of it to the containers, so a change takes effect on the next `up -d`.
+# An empty value means the built-in default, given in the comment above it;
+# every homeserver setting is described in docs/configuration.md.
+#
+# Set by the image or the compose file, not here: the database driver and
+# connection string, the listen addresses and the paths inside /data.
+
+# ---------------------------------------------------------------- compose
+
+# Host ports for the homeserver, the admin panel and the web client.
+WARP_PORT=8008
+WARP_ADMIN_PORT=8009
+WARP_WEB_PORT=8080
+
+# ------------------------------------------------------------------- aio
+
+# false runs the container without the admin panel or the web client.
+WARP_AIO_ADMIN=true
+WARP_AIO_WEB=true
+
+# ------------------------------------------------------------ homeserver
+
+# Part of every user and room ID: it cannot be changed later.
+WARP_SERVER_NAME=localhost
+
+# The URL clients are told to use, in /.well-known/matrix/client.
+# Default https://<server name>.
+WARP_WELL_KNOWN_CLIENT_BASE_URL=http://localhost:8008
+# Default empty.
+WARP_WELL_KNOWN_IDENTITY_SERVER_BASE_URL=
+# host:port other homeservers should use. Default empty: no delegation.
+WARP_WELL_KNOWN_SERVER_ADDRESS=
+
+# Registration. Default false; the admin API can switch it at runtime.
+WARP_REGISTRATION_ENABLED=false
+# Default true.
+WARP_REGISTRATION_ALLOW_RUNTIME_TOGGLE=
+# Comma-separated sign-up tokens. Default none.
+WARP_REGISTRATION_TOKENS=
+# Default false.
+WARP_REGISTRATION_REQUIRE_TOKEN=
+
+# Federation. Default false.
+WARP_FEDERATION_ENABLED=false
+# Default true.
+WARP_FEDERATION_ALLOW_RUNTIME_TOGGLE=
+# Comma-separated server names. Default none.
+WARP_FEDERATION_ALLOWLIST=
+WARP_FEDERATION_DENYLIST=
+WARP_FEDERATION_TRUSTED_KEY_SERVERS=
+# Default 24h.
+WARP_FEDERATION_KEY_VALIDITY_PERIOD=
+# A second, TLS listener for federation, e.g. :8448, with its certificate
+# and key (paths inside the container). Publish the port yourself.
+WARP_LISTEN_FEDERATION_ADDRESS=
+WARP_TLS_CERT_FILE=
+WARP_TLS_KEY_FILE=
+WARP_FEDERATION_TLS_CA_FILE=
+
+# HTTP server. Defaults 10s, 60s, 120s, 120s, 1048576, 30s.
+WARP_READ_HEADER_TIMEOUT=
+WARP_READ_TIMEOUT=
+WARP_WRITE_TIMEOUT=
+WARP_IDLE_TIMEOUT=
+WARP_MAX_HEADER_BYTES=
+WARP_SHUTDOWN_TIMEOUT=
+
+# Apply pending database migrations at startup. Default true.
+WARP_DB_AUTO_MIGRATE=
+
+# Media in an S3 bucket instead of pb_data/storage. Bucket, region,
+# endpoint and keys are all required when it is on, and the bucket must
+# exist. For a bucket set up for you, use the pocketbase.s3 or
+# pocketbase.seaweedfs files. Media stored before S3 was on is not moved.
+WARP_PB_S3_ENABLED=false
+WARP_PB_S3_BUCKET=
+WARP_PB_S3_REGION=
+WARP_PB_S3_ENDPOINT=
+WARP_PB_S3_ACCESS_KEY=
+WARP_PB_S3_SECRET=
+WARP_PB_S3_FORCE_PATH_STYLE=false
+
+# Client API. Defaults *, false, 0s (never expire), 0s, true.
+WARP_CORS_ALLOWED_ORIGINS=
+WARP_TRUST_X_FORWARDED_FOR=
+WARP_ACCESS_TOKEN_LIFETIME=
+WARP_REFRESH_TOKEN_LIFETIME=
+WARP_RATE_LIMIT_ENABLED=
+
+# Calls: the LiveKit JWT service's URL (see docs/calls.md). Default empty.
+WARP_RTC_LIVEKIT_SERVICE_URL=
+# Delayed events. Defaults 24h, 100.
+WARP_DELAYED_EVENTS_MAX_DELAY=
+WARP_DELAYED_EVENTS_MAX_PER_USER=
+# TURN for legacy 1:1 calls: comma-separated URIs, then a shared secret or
+# a static username and password. Lifetime default 1h.
+WARP_TURN_URIS=
+WARP_TURN_SHARED_SECRET=
+WARP_TURN_USER_LIFETIME=
+WARP_TURN_USERNAME=
+WARP_TURN_PASSWORD=
+
+# Sync. Defaults false, 30s, 30s.
+WARP_SYNC_PRESENCE=
+WARP_SYNC_TYPING_TIMEOUT=
+WARP_SYNC_LONG_POLL_TIMEOUT=
+
+# Media. Defaults 52428800 (50 MiB), 0 (no limit), 32000000, 24h, 10, false.
+WARP_MEDIA_MAX_UPLOAD_BYTES=
+WARP_MEDIA_MAX_USER_STORAGE_BYTES=
+WARP_MEDIA_MAX_THUMBNAIL_PIXELS=
+WARP_MEDIA_PENDING_UPLOAD_EXPIRY=
+WARP_MEDIA_MAX_PENDING_UPLOADS=
+WARP_MEDIA_LEGACY_UNAUTHENTICATED_DOWNLOADS=
+
+# Push. Defaults true, true, 10s, 720h.
+WARP_PUSH_ENABLED=
+WARP_PUSH_INCLUDE_CONTENT=
+WARP_PUSH_GATEWAY_TIMEOUT=
+WARP_PUSH_NOTIFICATION_RETENTION=
+
+# Application services: comma-separated registration files (paths inside
+# the container). Timeout default 30s.
+WARP_APPSERVICE_CONFIG_FILES=
+WARP_APPSERVICE_TIMEOUT=
+
+# Server notices. Defaults false, server-notices, Server Notices, Server
+# Notices.
+WARP_SERVER_NOTICES_ENABLED=
+WARP_SERVER_NOTICES_LOCALPART=
+WARP_SERVER_NOTICES_DISPLAY_NAME=
+WARP_SERVER_NOTICES_ROOM_NAME=
+
+# Logging: debug, info, warn or error; text or json; file and line.
+WARP_LOG_LEVEL=info
+WARP_LOG_FORMAT=json
+WARP_LOG_ADD_SOURCE=
+
+# Metrics. Defaults true, /metrics.
+WARP_METRICS_ENABLED=
+WARP_METRICS_PATH=
+
+# OpenTelemetry tracing. Defaults false, localhost:4318, 1, warp.
+WARP_TRACING_ENABLED=false
+WARP_TRACING_ENDPOINT=
+WARP_TRACING_SAMPLE_RATIO=
+WARP_TRACING_SERVICE_NAME=
+
+
+# ----------------------------------------------------------- admin panel
+
+# text or json.
+WARP_ADMIN_LOG_FORMAT=json
+
+# ------------------------------------------------------------ web client
+
+# The homeserver's public URL. Set, the browser talks to it directly and
+# the web client proxies nothing; empty, it proxies the client API.
+WARP_WEB_PUBLIC_HOMESERVER=
+# Space-separated origins of the LiveKit JWT service and SFU, for calls.
+WARP_WEB_CALL_ORIGINS=
+# text or json.
+WARP_WEB_LOG_FORMAT=json
diff --git a/Docker-AIO/.env.pocketbase.prod.example b/Docker-AIO/.env.pocketbase.prod.example
new file mode 100644
index 0000000..2f82c52
--- /dev/null
+++ b/Docker-AIO/.env.pocketbase.prod.example
@@ -0,0 +1,176 @@
+# Settings for docker-compose.pocketbase.prod.yml:
+# the homeserver on PocketBase, the admin panel and the web client, in
+# one container.
+#
+#   cp .env.pocketbase.prod.example .env      # then edit it
+#   docker compose -f docker-compose.pocketbase.prod.yml up -d
+#
+# Compose reads .env for the values it puts into the compose file, and hands
+# all of it to the containers, so a change takes effect on the next `up -d`.
+# An empty value means the built-in default, given in the comment above it;
+# every homeserver setting is described in docs/configuration.md.
+#
+# Set by the image or the compose file, not here: the database driver and
+# connection string, the listen addresses and the paths inside /data.
+
+# ---------------------------------------------------------------- compose
+
+# Host ports for the homeserver, the admin panel and the web client.
+WARP_PORT=8008
+WARP_ADMIN_PORT=8009
+WARP_WEB_PORT=8080
+
+# The image is pulled from $WARP_REGISTRY/warp-aio-pocketbase at this tag.
+# Pin a release in production.
+WARP_REGISTRY=ghcr.io/dariuszjaniak
+WARP_VERSION=latest
+
+# ------------------------------------------------------------------- aio
+
+# false runs the container without the admin panel or the web client.
+WARP_AIO_ADMIN=true
+WARP_AIO_WEB=true
+
+# ------------------------------------------------------------ homeserver
+
+# Part of every user and room ID: it cannot be changed later.
+WARP_SERVER_NAME=matrix.example.org
+
+# The URL clients are told to use, in /.well-known/matrix/client.
+# Default https://<server name>.
+WARP_WELL_KNOWN_CLIENT_BASE_URL=https://matrix.example.org
+# Default empty.
+WARP_WELL_KNOWN_IDENTITY_SERVER_BASE_URL=
+# host:port other homeservers should use. Default empty: no delegation.
+WARP_WELL_KNOWN_SERVER_ADDRESS=
+
+# Registration. Default false; the admin API can switch it at runtime.
+WARP_REGISTRATION_ENABLED=false
+# Default true.
+WARP_REGISTRATION_ALLOW_RUNTIME_TOGGLE=
+# Comma-separated sign-up tokens. Default none.
+WARP_REGISTRATION_TOKENS=
+# Default false.
+WARP_REGISTRATION_REQUIRE_TOKEN=
+
+# Federation. Default false.
+WARP_FEDERATION_ENABLED=false
+# Default true.
+WARP_FEDERATION_ALLOW_RUNTIME_TOGGLE=
+# Comma-separated server names. Default none.
+WARP_FEDERATION_ALLOWLIST=
+WARP_FEDERATION_DENYLIST=
+WARP_FEDERATION_TRUSTED_KEY_SERVERS=
+# Default 24h.
+WARP_FEDERATION_KEY_VALIDITY_PERIOD=
+# A second, TLS listener for federation, e.g. :8448, with its certificate
+# and key (paths inside the container). Publish the port yourself.
+WARP_LISTEN_FEDERATION_ADDRESS=
+WARP_TLS_CERT_FILE=
+WARP_TLS_KEY_FILE=
+WARP_FEDERATION_TLS_CA_FILE=
+
+# HTTP server. Defaults 10s, 60s, 120s, 120s, 1048576, 30s.
+WARP_READ_HEADER_TIMEOUT=
+WARP_READ_TIMEOUT=
+WARP_WRITE_TIMEOUT=
+WARP_IDLE_TIMEOUT=
+WARP_MAX_HEADER_BYTES=
+WARP_SHUTDOWN_TIMEOUT=
+
+# Apply pending database migrations at startup. Default true.
+WARP_DB_AUTO_MIGRATE=
+
+# Media in an S3 bucket instead of pb_data/storage. Bucket, region,
+# endpoint and keys are all required when it is on, and the bucket must
+# exist. For a bucket set up for you, use the pocketbase.s3 or
+# pocketbase.seaweedfs files. Media stored before S3 was on is not moved.
+WARP_PB_S3_ENABLED=false
+WARP_PB_S3_BUCKET=
+WARP_PB_S3_REGION=
+WARP_PB_S3_ENDPOINT=
+WARP_PB_S3_ACCESS_KEY=
+WARP_PB_S3_SECRET=
+WARP_PB_S3_FORCE_PATH_STYLE=false
+
+# Client API. Defaults *, false, 0s (never expire), 0s, true.
+WARP_CORS_ALLOWED_ORIGINS=
+WARP_TRUST_X_FORWARDED_FOR=
+WARP_ACCESS_TOKEN_LIFETIME=
+WARP_REFRESH_TOKEN_LIFETIME=
+WARP_RATE_LIMIT_ENABLED=
+
+# Calls: the LiveKit JWT service's URL (see docs/calls.md). Default empty.
+WARP_RTC_LIVEKIT_SERVICE_URL=
+# Delayed events. Defaults 24h, 100.
+WARP_DELAYED_EVENTS_MAX_DELAY=
+WARP_DELAYED_EVENTS_MAX_PER_USER=
+# TURN for legacy 1:1 calls: comma-separated URIs, then a shared secret or
+# a static username and password. Lifetime default 1h.
+WARP_TURN_URIS=
+WARP_TURN_SHARED_SECRET=
+WARP_TURN_USER_LIFETIME=
+WARP_TURN_USERNAME=
+WARP_TURN_PASSWORD=
+
+# Sync. Defaults false, 30s, 30s.
+WARP_SYNC_PRESENCE=
+WARP_SYNC_TYPING_TIMEOUT=
+WARP_SYNC_LONG_POLL_TIMEOUT=
+
+# Media. Defaults 52428800 (50 MiB), 0 (no limit), 32000000, 24h, 10, false.
+WARP_MEDIA_MAX_UPLOAD_BYTES=
+WARP_MEDIA_MAX_USER_STORAGE_BYTES=
+WARP_MEDIA_MAX_THUMBNAIL_PIXELS=
+WARP_MEDIA_PENDING_UPLOAD_EXPIRY=
+WARP_MEDIA_MAX_PENDING_UPLOADS=
+WARP_MEDIA_LEGACY_UNAUTHENTICATED_DOWNLOADS=
+
+# Push. Defaults true, true, 10s, 720h.
+WARP_PUSH_ENABLED=
+WARP_PUSH_INCLUDE_CONTENT=
+WARP_PUSH_GATEWAY_TIMEOUT=
+WARP_PUSH_NOTIFICATION_RETENTION=
+
+# Application services: comma-separated registration files (paths inside
+# the container). Timeout default 30s.
+WARP_APPSERVICE_CONFIG_FILES=
+WARP_APPSERVICE_TIMEOUT=
+
+# Server notices. Defaults false, server-notices, Server Notices, Server
+# Notices.
+WARP_SERVER_NOTICES_ENABLED=
+WARP_SERVER_NOTICES_LOCALPART=
+WARP_SERVER_NOTICES_DISPLAY_NAME=
+WARP_SERVER_NOTICES_ROOM_NAME=
+
+# Logging: debug, info, warn or error; text or json; file and line.
+WARP_LOG_LEVEL=info
+WARP_LOG_FORMAT=json
+WARP_LOG_ADD_SOURCE=
+
+# Metrics. Defaults true, /metrics.
+WARP_METRICS_ENABLED=
+WARP_METRICS_PATH=
+
+# OpenTelemetry tracing. Defaults false, localhost:4318, 1, warp.
+WARP_TRACING_ENABLED=false
+WARP_TRACING_ENDPOINT=
+WARP_TRACING_SAMPLE_RATIO=
+WARP_TRACING_SERVICE_NAME=
+
+
+# ----------------------------------------------------------- admin panel
+
+# text or json.
+WARP_ADMIN_LOG_FORMAT=json
+
+# ------------------------------------------------------------ web client
+
+# The homeserver's public URL. Set, the browser talks to it directly and
+# the web client proxies nothing; empty, it proxies the client API.
+WARP_WEB_PUBLIC_HOMESERVER=
+# Space-separated origins of the LiveKit JWT service and SFU, for calls.
+WARP_WEB_CALL_ORIGINS=
+# text or json.
+WARP_WEB_LOG_FORMAT=json
diff --git a/Docker-AIO/.env.pocketbase.s3.example b/Docker-AIO/.env.pocketbase.s3.example
new file mode 100644
index 0000000..21cb014
--- /dev/null
+++ b/Docker-AIO/.env.pocketbase.s3.example
@@ -0,0 +1,177 @@
+# Settings for docker-compose.pocketbase.s3.yml:
+# the homeserver on PocketBase with media in an S3 bucket elsewhere, the
+# admin panel and the web client, in one container.
+#
+#   cp .env.pocketbase.s3.example .env      # then edit it
+#   docker compose -f docker-compose.pocketbase.s3.yml up -d --build
+#
+# Required, with no default: WARP_PB_S3_ENDPOINT, WARP_PB_S3_ACCESS_KEY
+# and WARP_PB_S3_SECRET.
+#
+# Compose reads .env for the values it puts into the compose file, and hands
+# all of it to the containers, so a change takes effect on the next `up -d`.
+# An empty value means the built-in default, given in the comment above it;
+# every homeserver setting is described in docs/configuration.md.
+#
+# Set by the image or the compose file, not here: the database driver and
+# connection string, the listen addresses and the paths inside /data.
+
+# ---------------------------------------------------------------- compose
+
+# Host ports for the homeserver, the admin panel and the web client.
+WARP_PORT=8008
+WARP_ADMIN_PORT=8009
+WARP_WEB_PORT=8080
+
+# ------------------------------------------------------------------- aio
+
+# false runs the container without the admin panel or the web client.
+WARP_AIO_ADMIN=true
+WARP_AIO_WEB=true
+
+# ------------------------------------------------------------- media (S3)
+
+# Media goes to this bucket; the database stays in /data/pb_data. The bucket
+# must already exist: nothing here runs a gateway or creates it. For a
+# gateway on the Docker host, use http://host.docker.internal:8333. Media
+# stored before S3 was on is not moved into the bucket.
+WARP_PB_S3_ENDPOINT=
+WARP_PB_S3_BUCKET=warp
+WARP_PB_S3_ACCESS_KEY=
+WARP_PB_S3_SECRET=
+# SeaweedFS and MinIO ignore the region; the client insists on one.
+WARP_PB_S3_REGION=us-east-1
+# true for SeaweedFS and MinIO, false for AWS S3 proper.
+WARP_PB_S3_FORCE_PATH_STYLE=true
+
+# ------------------------------------------------------------ homeserver
+
+# Part of every user and room ID: it cannot be changed later.
+WARP_SERVER_NAME=localhost
+
+# The URL clients are told to use, in /.well-known/matrix/client.
+# Default https://<server name>.
+WARP_WELL_KNOWN_CLIENT_BASE_URL=http://localhost:8008
+# Default empty.
+WARP_WELL_KNOWN_IDENTITY_SERVER_BASE_URL=
+# host:port other homeservers should use. Default empty: no delegation.
+WARP_WELL_KNOWN_SERVER_ADDRESS=
+
+# Registration. Default false; the admin API can switch it at runtime.
+WARP_REGISTRATION_ENABLED=false
+# Default true.
+WARP_REGISTRATION_ALLOW_RUNTIME_TOGGLE=
+# Comma-separated sign-up tokens. Default none.
+WARP_REGISTRATION_TOKENS=
+# Default false.
+WARP_REGISTRATION_REQUIRE_TOKEN=
+
+# Federation. Default false.
+WARP_FEDERATION_ENABLED=false
+# Default true.
+WARP_FEDERATION_ALLOW_RUNTIME_TOGGLE=
+# Comma-separated server names. Default none.
+WARP_FEDERATION_ALLOWLIST=
+WARP_FEDERATION_DENYLIST=
+WARP_FEDERATION_TRUSTED_KEY_SERVERS=
+# Default 24h.
+WARP_FEDERATION_KEY_VALIDITY_PERIOD=
+# A second, TLS listener for federation, e.g. :8448, with its certificate
+# and key (paths inside the container). Publish the port yourself.
+WARP_LISTEN_FEDERATION_ADDRESS=
+WARP_TLS_CERT_FILE=
+WARP_TLS_KEY_FILE=
+WARP_FEDERATION_TLS_CA_FILE=
+
+# HTTP server. Defaults 10s, 60s, 120s, 120s, 1048576, 30s.
+WARP_READ_HEADER_TIMEOUT=
+WARP_READ_TIMEOUT=
+WARP_WRITE_TIMEOUT=
+WARP_IDLE_TIMEOUT=
+WARP_MAX_HEADER_BYTES=
+WARP_SHUTDOWN_TIMEOUT=
+
+# Apply pending database migrations at startup. Default true.
+WARP_DB_AUTO_MIGRATE=
+
+# Client API. Defaults *, false, 0s (never expire), 0s, true.
+WARP_CORS_ALLOWED_ORIGINS=
+WARP_TRUST_X_FORWARDED_FOR=
+WARP_ACCESS_TOKEN_LIFETIME=
+WARP_REFRESH_TOKEN_LIFETIME=
+WARP_RATE_LIMIT_ENABLED=
+
+# Calls: the LiveKit JWT service's URL (see docs/calls.md). Default empty.
+WARP_RTC_LIVEKIT_SERVICE_URL=
+# Delayed events. Defaults 24h, 100.
+WARP_DELAYED_EVENTS_MAX_DELAY=
+WARP_DELAYED_EVENTS_MAX_PER_USER=
+# TURN for legacy 1:1 calls: comma-separated URIs, then a shared secret or
+# a static username and password. Lifetime default 1h.
+WARP_TURN_URIS=
+WARP_TURN_SHARED_SECRET=
+WARP_TURN_USER_LIFETIME=
+WARP_TURN_USERNAME=
+WARP_TURN_PASSWORD=
+
+# Sync. Defaults false, 30s, 30s.
+WARP_SYNC_PRESENCE=
+WARP_SYNC_TYPING_TIMEOUT=
+WARP_SYNC_LONG_POLL_TIMEOUT=
+
+# Media. Defaults 52428800 (50 MiB), 0 (no limit), 32000000, 24h, 10, false.
+WARP_MEDIA_MAX_UPLOAD_BYTES=
+WARP_MEDIA_MAX_USER_STORAGE_BYTES=
+WARP_MEDIA_MAX_THUMBNAIL_PIXELS=
+WARP_MEDIA_PENDING_UPLOAD_EXPIRY=
+WARP_MEDIA_MAX_PENDING_UPLOADS=
+WARP_MEDIA_LEGACY_UNAUTHENTICATED_DOWNLOADS=
+
+# Push. Defaults true, true, 10s, 720h.
+WARP_PUSH_ENABLED=
+WARP_PUSH_INCLUDE_CONTENT=
+WARP_PUSH_GATEWAY_TIMEOUT=
+WARP_PUSH_NOTIFICATION_RETENTION=
+
+# Application services: comma-separated registration files (paths inside
+# the container). Timeout default 30s.
+WARP_APPSERVICE_CONFIG_FILES=
+WARP_APPSERVICE_TIMEOUT=
+
+# Server notices. Defaults false, server-notices, Server Notices, Server
+# Notices.
+WARP_SERVER_NOTICES_ENABLED=
+WARP_SERVER_NOTICES_LOCALPART=
+WARP_SERVER_NOTICES_DISPLAY_NAME=
+WARP_SERVER_NOTICES_ROOM_NAME=
+
+# Logging: debug, info, warn or error; text or json; file and line.
+WARP_LOG_LEVEL=info
+WARP_LOG_FORMAT=json
+WARP_LOG_ADD_SOURCE=
+
+# Metrics. Defaults true, /metrics.
+WARP_METRICS_ENABLED=
+WARP_METRICS_PATH=
+
+# OpenTelemetry tracing. Defaults false, localhost:4318, 1, warp.
+WARP_TRACING_ENABLED=false
+WARP_TRACING_ENDPOINT=
+WARP_TRACING_SAMPLE_RATIO=
+WARP_TRACING_SERVICE_NAME=
+
+
+# ----------------------------------------------------------- admin panel
+
+# text or json.
+WARP_ADMIN_LOG_FORMAT=json
+
+# ------------------------------------------------------------ web client
+
+# The homeserver's public URL. Set, the browser talks to it directly and
+# the web client proxies nothing; empty, it proxies the client API.
+WARP_WEB_PUBLIC_HOMESERVER=
+# Space-separated origins of the LiveKit JWT service and SFU, for calls.
+WARP_WEB_CALL_ORIGINS=
+# text or json.
+WARP_WEB_LOG_FORMAT=json
diff --git a/Docker-AIO/.env.pocketbase.s3.prod.example b/Docker-AIO/.env.pocketbase.s3.prod.example
new file mode 100644
index 0000000..f3e06f3
--- /dev/null
+++ b/Docker-AIO/.env.pocketbase.s3.prod.example
@@ -0,0 +1,182 @@
+# Settings for docker-compose.pocketbase.s3.prod.yml:
+# the homeserver on PocketBase with media in an S3 bucket elsewhere, the
+# admin panel and the web client, in one container.
+#
+#   cp .env.pocketbase.s3.prod.example .env      # then edit it
+#   docker compose -f docker-compose.pocketbase.s3.prod.yml up -d
+#
+# Required, with no default: WARP_PB_S3_ENDPOINT, WARP_PB_S3_ACCESS_KEY
+# and WARP_PB_S3_SECRET.
+#
+# Compose reads .env for the values it puts into the compose file, and hands
+# all of it to the containers, so a change takes effect on the next `up -d`.
+# An empty value means the built-in default, given in the comment above it;
+# every homeserver setting is described in docs/configuration.md.
+#
+# Set by the image or the compose file, not here: the database driver and
+# connection string, the listen addresses and the paths inside /data.
+
+# ---------------------------------------------------------------- compose
+
+# Host ports for the homeserver, the admin panel and the web client.
+WARP_PORT=8008
+WARP_ADMIN_PORT=8009
+WARP_WEB_PORT=8080
+
+# The image is pulled from $WARP_REGISTRY/warp-aio-pocketbase-s3 at this tag.
+# Pin a release in production.
+WARP_REGISTRY=ghcr.io/dariuszjaniak
+WARP_VERSION=latest
+
+# ------------------------------------------------------------------- aio
+
+# false runs the container without the admin panel or the web client.
+WARP_AIO_ADMIN=true
+WARP_AIO_WEB=true
+
+# ------------------------------------------------------------- media (S3)
+
+# Media goes to this bucket; the database stays in /data/pb_data. The bucket
+# must already exist: nothing here runs a gateway or creates it. For a
+# gateway on the Docker host, use http://host.docker.internal:8333. Media
+# stored before S3 was on is not moved into the bucket.
+WARP_PB_S3_ENDPOINT=
+WARP_PB_S3_BUCKET=warp
+WARP_PB_S3_ACCESS_KEY=
+WARP_PB_S3_SECRET=
+# SeaweedFS and MinIO ignore the region; the client insists on one.
+WARP_PB_S3_REGION=us-east-1
+# true for SeaweedFS and MinIO, false for AWS S3 proper.
+WARP_PB_S3_FORCE_PATH_STYLE=true
+
+# ------------------------------------------------------------ homeserver
+
+# Part of every user and room ID: it cannot be changed later.
+WARP_SERVER_NAME=matrix.example.org
+
+# The URL clients are told to use, in /.well-known/matrix/client.
+# Default https://<server name>.
+WARP_WELL_KNOWN_CLIENT_BASE_URL=https://matrix.example.org
+# Default empty.
+WARP_WELL_KNOWN_IDENTITY_SERVER_BASE_URL=
+# host:port other homeservers should use. Default empty: no delegation.
+WARP_WELL_KNOWN_SERVER_ADDRESS=
+
+# Registration. Default false; the admin API can switch it at runtime.
+WARP_REGISTRATION_ENABLED=false
+# Default true.
+WARP_REGISTRATION_ALLOW_RUNTIME_TOGGLE=
+# Comma-separated sign-up tokens. Default none.
+WARP_REGISTRATION_TOKENS=
+# Default false.
+WARP_REGISTRATION_REQUIRE_TOKEN=
+
+# Federation. Default false.
+WARP_FEDERATION_ENABLED=false
+# Default true.
+WARP_FEDERATION_ALLOW_RUNTIME_TOGGLE=
+# Comma-separated server names. Default none.
+WARP_FEDERATION_ALLOWLIST=
+WARP_FEDERATION_DENYLIST=
+WARP_FEDERATION_TRUSTED_KEY_SERVERS=
+# Default 24h.
+WARP_FEDERATION_KEY_VALIDITY_PERIOD=
+# A second, TLS listener for federation, e.g. :8448, with its certificate
+# and key (paths inside the container). Publish the port yourself.
+WARP_LISTEN_FEDERATION_ADDRESS=
+WARP_TLS_CERT_FILE=
+WARP_TLS_KEY_FILE=
+WARP_FEDERATION_TLS_CA_FILE=
+
+# HTTP server. Defaults 10s, 60s, 120s, 120s, 1048576, 30s.
+WARP_READ_HEADER_TIMEOUT=
+WARP_READ_TIMEOUT=
+WARP_WRITE_TIMEOUT=
+WARP_IDLE_TIMEOUT=
+WARP_MAX_HEADER_BYTES=
+WARP_SHUTDOWN_TIMEOUT=
+
+# Apply pending database migrations at startup. Default true.
+WARP_DB_AUTO_MIGRATE=
+
+# Client API. Defaults *, false, 0s (never expire), 0s, true.
+WARP_CORS_ALLOWED_ORIGINS=
+WARP_TRUST_X_FORWARDED_FOR=
+WARP_ACCESS_TOKEN_LIFETIME=
+WARP_REFRESH_TOKEN_LIFETIME=
+WARP_RATE_LIMIT_ENABLED=
+
+# Calls: the LiveKit JWT service's URL (see docs/calls.md). Default empty.
+WARP_RTC_LIVEKIT_SERVICE_URL=
+# Delayed events. Defaults 24h, 100.
+WARP_DELAYED_EVENTS_MAX_DELAY=
+WARP_DELAYED_EVENTS_MAX_PER_USER=
+# TURN for legacy 1:1 calls: comma-separated URIs, then a shared secret or
+# a static username and password. Lifetime default 1h.
+WARP_TURN_URIS=
+WARP_TURN_SHARED_SECRET=
+WARP_TURN_USER_LIFETIME=
+WARP_TURN_USERNAME=
+WARP_TURN_PASSWORD=
+
+# Sync. Defaults false, 30s, 30s.
+WARP_SYNC_PRESENCE=
+WARP_SYNC_TYPING_TIMEOUT=
+WARP_SYNC_LONG_POLL_TIMEOUT=
+
+# Media. Defaults 52428800 (50 MiB), 0 (no limit), 32000000, 24h, 10, false.
+WARP_MEDIA_MAX_UPLOAD_BYTES=
+WARP_MEDIA_MAX_USER_STORAGE_BYTES=
+WARP_MEDIA_MAX_THUMBNAIL_PIXELS=
+WARP_MEDIA_PENDING_UPLOAD_EXPIRY=
+WARP_MEDIA_MAX_PENDING_UPLOADS=
+WARP_MEDIA_LEGACY_UNAUTHENTICATED_DOWNLOADS=
+
+# Push. Defaults true, true, 10s, 720h.
+WARP_PUSH_ENABLED=
+WARP_PUSH_INCLUDE_CONTENT=
+WARP_PUSH_GATEWAY_TIMEOUT=
+WARP_PUSH_NOTIFICATION_RETENTION=
+
+# Application services: comma-separated registration files (paths inside
+# the container). Timeout default 30s.
+WARP_APPSERVICE_CONFIG_FILES=
+WARP_APPSERVICE_TIMEOUT=
+
+# Server notices. Defaults false, server-notices, Server Notices, Server
+# Notices.
+WARP_SERVER_NOTICES_ENABLED=
+WARP_SERVER_NOTICES_LOCALPART=
+WARP_SERVER_NOTICES_DISPLAY_NAME=
+WARP_SERVER_NOTICES_ROOM_NAME=
+
+# Logging: debug, info, warn or error; text or json; file and line.
+WARP_LOG_LEVEL=info
+WARP_LOG_FORMAT=json
+WARP_LOG_ADD_SOURCE=
+
+# Metrics. Defaults true, /metrics.
+WARP_METRICS_ENABLED=
+WARP_METRICS_PATH=
+
+# OpenTelemetry tracing. Defaults false, localhost:4318, 1, warp.
+WARP_TRACING_ENABLED=false
+WARP_TRACING_ENDPOINT=
+WARP_TRACING_SAMPLE_RATIO=
+WARP_TRACING_SERVICE_NAME=
+
+
+# ----------------------------------------------------------- admin panel
+
+# text or json.
+WARP_ADMIN_LOG_FORMAT=json
+
+# ------------------------------------------------------------ web client
+
+# The homeserver's public URL. Set, the browser talks to it directly and
+# the web client proxies nothing; empty, it proxies the client API.
+WARP_WEB_PUBLIC_HOMESERVER=
+# Space-separated origins of the LiveKit JWT service and SFU, for calls.
+WARP_WEB_CALL_ORIGINS=
+# text or json.
+WARP_WEB_LOG_FORMAT=json
diff --git a/Docker-AIO/.env.pocketbase.seaweedfs.example b/Docker-AIO/.env.pocketbase.seaweedfs.example
new file mode 100644
index 0000000..389789b
--- /dev/null
+++ b/Docker-AIO/.env.pocketbase.seaweedfs.example
@@ -0,0 +1,181 @@
+# Settings for docker-compose.pocketbase.seaweedfs.yml:
+# the homeserver on PocketBase, the admin panel, the web client and
+# SeaweedFS for media, in one container.
+#
+#   cp .env.pocketbase.seaweedfs.example .env      # then edit it
+#   docker compose -f docker-compose.pocketbase.seaweedfs.yml up -d --build
+#
+# Required, with no default: WARP_PB_S3_ACCESS_KEY and WARP_PB_S3_SECRET.
+#
+# Compose reads .env for the values it puts into the compose file, and hands
+# all of it to the containers, so a change takes effect on the next `up -d`.
+# An empty value means the built-in default, given in the comment above it;
+# every homeserver setting is described in docs/configuration.md.
+#
+# Set by the image or the compose file, not here: the database driver and
+# connection string, the listen addresses and the paths inside /data.
+
+# ---------------------------------------------------------------- compose
+
+# Host ports for the homeserver, the admin panel and the web client.
+WARP_PORT=8008
+WARP_ADMIN_PORT=8009
+WARP_WEB_PORT=8080
+
+# ------------------------------------------------------------------- aio
+
+# false runs the container without the admin panel or the web client.
+WARP_AIO_ADMIN=true
+WARP_AIO_WEB=true
+
+# -------------------------------------------------------------- seaweedfs
+
+# Media goes to this bucket in SeaweedFS, created on start; the database
+# stays in /data/pb_data. The key pair is the homeserver's S3 identity:
+# the gateway's only one, and what the homeserver signs with.
+# Media stored before S3 was on is not moved into the bucket.
+WARP_PB_S3_BUCKET=warp
+WARP_PB_S3_ACCESS_KEY=
+WARP_PB_S3_SECRET=
+
+# The S3 gateway's host port, on loopback unless the bind address says
+# otherwise. The homeserver does not need it; it is for aws-cli and the
+# like.
+SEAWEED_S3_BIND=127.0.0.1
+SEAWEED_S3_PORT=8333
+
+# Building only: the SeaweedFS release to bake in. Leave it commented out
+# to keep the Dockerfile's pin; an empty value breaks the build.
+# SEAWEED_VERSION=4.45
+
+# ------------------------------------------------------------ homeserver
+
+# Part of every user and room ID: it cannot be changed later.
+WARP_SERVER_NAME=localhost
+
+# The URL clients are told to use, in /.well-known/matrix/client.
+# Default https://<server name>.
+WARP_WELL_KNOWN_CLIENT_BASE_URL=http://localhost:8008
+# Default empty.
+WARP_WELL_KNOWN_IDENTITY_SERVER_BASE_URL=
+# host:port other homeservers should use. Default empty: no delegation.
+WARP_WELL_KNOWN_SERVER_ADDRESS=
+
+# Registration. Default false; the admin API can switch it at runtime.
+WARP_REGISTRATION_ENABLED=false
+# Default true.
+WARP_REGISTRATION_ALLOW_RUNTIME_TOGGLE=
+# Comma-separated sign-up tokens. Default none.
+WARP_REGISTRATION_TOKENS=
+# Default false.
+WARP_REGISTRATION_REQUIRE_TOKEN=
+
+# Federation. Default false.
+WARP_FEDERATION_ENABLED=false
+# Default true.
+WARP_FEDERATION_ALLOW_RUNTIME_TOGGLE=
+# Comma-separated server names. Default none.
+WARP_FEDERATION_ALLOWLIST=
+WARP_FEDERATION_DENYLIST=
+WARP_FEDERATION_TRUSTED_KEY_SERVERS=
+# Default 24h.
+WARP_FEDERATION_KEY_VALIDITY_PERIOD=
+# A second, TLS listener for federation, e.g. :8448, with its certificate
+# and key (paths inside the container). Publish the port yourself.
+WARP_LISTEN_FEDERATION_ADDRESS=
+WARP_TLS_CERT_FILE=
+WARP_TLS_KEY_FILE=
+WARP_FEDERATION_TLS_CA_FILE=
+
+# HTTP server. Defaults 10s, 60s, 120s, 120s, 1048576, 30s.
+WARP_READ_HEADER_TIMEOUT=
+WARP_READ_TIMEOUT=
+WARP_WRITE_TIMEOUT=
+WARP_IDLE_TIMEOUT=
+WARP_MAX_HEADER_BYTES=
+WARP_SHUTDOWN_TIMEOUT=
+
+# Apply pending database migrations at startup. Default true.
+WARP_DB_AUTO_MIGRATE=
+
+# Client API. Defaults *, false, 0s (never expire), 0s, true.
+WARP_CORS_ALLOWED_ORIGINS=
+WARP_TRUST_X_FORWARDED_FOR=
+WARP_ACCESS_TOKEN_LIFETIME=
+WARP_REFRESH_TOKEN_LIFETIME=
+WARP_RATE_LIMIT_ENABLED=
+
+# Calls: the LiveKit JWT service's URL (see docs/calls.md). Default empty.
+WARP_RTC_LIVEKIT_SERVICE_URL=
+# Delayed events. Defaults 24h, 100.
+WARP_DELAYED_EVENTS_MAX_DELAY=
+WARP_DELAYED_EVENTS_MAX_PER_USER=
+# TURN for legacy 1:1 calls: comma-separated URIs, then a shared secret or
+# a static username and password. Lifetime default 1h.
+WARP_TURN_URIS=
+WARP_TURN_SHARED_SECRET=
+WARP_TURN_USER_LIFETIME=
+WARP_TURN_USERNAME=
+WARP_TURN_PASSWORD=
+
+# Sync. Defaults false, 30s, 30s.
+WARP_SYNC_PRESENCE=
+WARP_SYNC_TYPING_TIMEOUT=
+WARP_SYNC_LONG_POLL_TIMEOUT=
+
+# Media. Defaults 52428800 (50 MiB), 0 (no limit), 32000000, 24h, 10, false.
+WARP_MEDIA_MAX_UPLOAD_BYTES=
+WARP_MEDIA_MAX_USER_STORAGE_BYTES=
+WARP_MEDIA_MAX_THUMBNAIL_PIXELS=
+WARP_MEDIA_PENDING_UPLOAD_EXPIRY=
+WARP_MEDIA_MAX_PENDING_UPLOADS=
+WARP_MEDIA_LEGACY_UNAUTHENTICATED_DOWNLOADS=
+
+# Push. Defaults true, true, 10s, 720h.
+WARP_PUSH_ENABLED=
+WARP_PUSH_INCLUDE_CONTENT=
+WARP_PUSH_GATEWAY_TIMEOUT=
+WARP_PUSH_NOTIFICATION_RETENTION=
+
+# Application services: comma-separated registration files (paths inside
+# the container). Timeout default 30s.
+WARP_APPSERVICE_CONFIG_FILES=
+WARP_APPSERVICE_TIMEOUT=
+
+# Server notices. Defaults false, server-notices, Server Notices, Server
+# Notices.
+WARP_SERVER_NOTICES_ENABLED=
+WARP_SERVER_NOTICES_LOCALPART=
+WARP_SERVER_NOTICES_DISPLAY_NAME=
+WARP_SERVER_NOTICES_ROOM_NAME=
+
+# Logging: debug, info, warn or error; text or json; file and line.
+WARP_LOG_LEVEL=info
+WARP_LOG_FORMAT=json
+WARP_LOG_ADD_SOURCE=
+
+# Metrics. Defaults true, /metrics.
+WARP_METRICS_ENABLED=
+WARP_METRICS_PATH=
+
+# OpenTelemetry tracing. Defaults false, localhost:4318, 1, warp.
+WARP_TRACING_ENABLED=false
+WARP_TRACING_ENDPOINT=
+WARP_TRACING_SAMPLE_RATIO=
+WARP_TRACING_SERVICE_NAME=
+
+
+# ----------------------------------------------------------- admin panel
+
+# text or json.
+WARP_ADMIN_LOG_FORMAT=json
+
+# ------------------------------------------------------------ web client
+
+# The homeserver's public URL. Set, the browser talks to it directly and
+# the web client proxies nothing; empty, it proxies the client API.
+WARP_WEB_PUBLIC_HOMESERVER=
+# Space-separated origins of the LiveKit JWT service and SFU, for calls.
+WARP_WEB_CALL_ORIGINS=
+# text or json.
+WARP_WEB_LOG_FORMAT=json
diff --git a/Docker-AIO/.env.pocketbase.seaweedfs.prod.example b/Docker-AIO/.env.pocketbase.seaweedfs.prod.example
new file mode 100644
index 0000000..1f2ddac
--- /dev/null
+++ b/Docker-AIO/.env.pocketbase.seaweedfs.prod.example
@@ -0,0 +1,182 @@
+# Settings for docker-compose.pocketbase.seaweedfs.prod.yml:
+# the homeserver on PocketBase, the admin panel, the web client and
+# SeaweedFS for media, in one container.
+#
+#   cp .env.pocketbase.seaweedfs.prod.example .env      # then edit it
+#   docker compose -f docker-compose.pocketbase.seaweedfs.prod.yml up -d
+#
+# Required, with no default: WARP_PB_S3_ACCESS_KEY and WARP_PB_S3_SECRET.
+#
+# Compose reads .env for the values it puts into the compose file, and hands
+# all of it to the containers, so a change takes effect on the next `up -d`.
+# An empty value means the built-in default, given in the comment above it;
+# every homeserver setting is described in docs/configuration.md.
+#
+# Set by the image or the compose file, not here: the database driver and
+# connection string, the listen addresses and the paths inside /data.
+
+# ---------------------------------------------------------------- compose
+
+# Host ports for the homeserver, the admin panel and the web client.
+WARP_PORT=8008
+WARP_ADMIN_PORT=8009
+WARP_WEB_PORT=8080
+
+# The image is pulled from $WARP_REGISTRY/warp-aio-pocketbase-seaweedfs at this tag.
+# Pin a release in production.
+WARP_REGISTRY=ghcr.io/dariuszjaniak
+WARP_VERSION=latest
+
+# ------------------------------------------------------------------- aio
+
+# false runs the container without the admin panel or the web client.
+WARP_AIO_ADMIN=true
+WARP_AIO_WEB=true
+
+# -------------------------------------------------------------- seaweedfs
+
+# Media goes to this bucket in SeaweedFS, created on start; the database
+# stays in /data/pb_data. The key pair is the homeserver's S3 identity:
+# the gateway's only one, and what the homeserver signs with.
+# Media stored before S3 was on is not moved into the bucket.
+WARP_PB_S3_BUCKET=warp
+WARP_PB_S3_ACCESS_KEY=
+WARP_PB_S3_SECRET=
+
+# The S3 gateway's host port, on loopback unless the bind address says
+# otherwise. The homeserver does not need it; it is for aws-cli and the
+# like.
+SEAWEED_S3_BIND=127.0.0.1
+SEAWEED_S3_PORT=8333
+
+# ------------------------------------------------------------ homeserver
+
+# Part of every user and room ID: it cannot be changed later.
+WARP_SERVER_NAME=matrix.example.org
+
+# The URL clients are told to use, in /.well-known/matrix/client.
+# Default https://<server name>.
+WARP_WELL_KNOWN_CLIENT_BASE_URL=https://matrix.example.org
+# Default empty.
+WARP_WELL_KNOWN_IDENTITY_SERVER_BASE_URL=
+# host:port other homeservers should use. Default empty: no delegation.
+WARP_WELL_KNOWN_SERVER_ADDRESS=
+
+# Registration. Default false; the admin API can switch it at runtime.
+WARP_REGISTRATION_ENABLED=false
+# Default true.
+WARP_REGISTRATION_ALLOW_RUNTIME_TOGGLE=
+# Comma-separated sign-up tokens. Default none.
+WARP_REGISTRATION_TOKENS=
+# Default false.
+WARP_REGISTRATION_REQUIRE_TOKEN=
+
+# Federation. Default false.
+WARP_FEDERATION_ENABLED=false
+# Default true.
+WARP_FEDERATION_ALLOW_RUNTIME_TOGGLE=
+# Comma-separated server names. Default none.
+WARP_FEDERATION_ALLOWLIST=
+WARP_FEDERATION_DENYLIST=
+WARP_FEDERATION_TRUSTED_KEY_SERVERS=
+# Default 24h.
+WARP_FEDERATION_KEY_VALIDITY_PERIOD=
+# A second, TLS listener for federation, e.g. :8448, with its certificate
+# and key (paths inside the container). Publish the port yourself.
+WARP_LISTEN_FEDERATION_ADDRESS=
+WARP_TLS_CERT_FILE=
+WARP_TLS_KEY_FILE=
+WARP_FEDERATION_TLS_CA_FILE=
+
+# HTTP server. Defaults 10s, 60s, 120s, 120s, 1048576, 30s.
+WARP_READ_HEADER_TIMEOUT=
+WARP_READ_TIMEOUT=
+WARP_WRITE_TIMEOUT=
+WARP_IDLE_TIMEOUT=
+WARP_MAX_HEADER_BYTES=
+WARP_SHUTDOWN_TIMEOUT=
+
+# Apply pending database migrations at startup. Default true.
+WARP_DB_AUTO_MIGRATE=
+
+# Client API. Defaults *, false, 0s (never expire), 0s, true.
+WARP_CORS_ALLOWED_ORIGINS=
+WARP_TRUST_X_FORWARDED_FOR=
+WARP_ACCESS_TOKEN_LIFETIME=
+WARP_REFRESH_TOKEN_LIFETIME=
+WARP_RATE_LIMIT_ENABLED=
+
+# Calls: the LiveKit JWT service's URL (see docs/calls.md). Default empty.
+WARP_RTC_LIVEKIT_SERVICE_URL=
+# Delayed events. Defaults 24h, 100.
+WARP_DELAYED_EVENTS_MAX_DELAY=
+WARP_DELAYED_EVENTS_MAX_PER_USER=
+# TURN for legacy 1:1 calls: comma-separated URIs, then a shared secret or
+# a static username and password. Lifetime default 1h.
+WARP_TURN_URIS=
+WARP_TURN_SHARED_SECRET=
+WARP_TURN_USER_LIFETIME=
+WARP_TURN_USERNAME=
+WARP_TURN_PASSWORD=
+
+# Sync. Defaults false, 30s, 30s.
+WARP_SYNC_PRESENCE=
+WARP_SYNC_TYPING_TIMEOUT=
+WARP_SYNC_LONG_POLL_TIMEOUT=
+
+# Media. Defaults 52428800 (50 MiB), 0 (no limit), 32000000, 24h, 10, false.
+WARP_MEDIA_MAX_UPLOAD_BYTES=
+WARP_MEDIA_MAX_USER_STORAGE_BYTES=
+WARP_MEDIA_MAX_THUMBNAIL_PIXELS=
+WARP_MEDIA_PENDING_UPLOAD_EXPIRY=
+WARP_MEDIA_MAX_PENDING_UPLOADS=
+WARP_MEDIA_LEGACY_UNAUTHENTICATED_DOWNLOADS=
+
+# Push. Defaults true, true, 10s, 720h.
+WARP_PUSH_ENABLED=
+WARP_PUSH_INCLUDE_CONTENT=
+WARP_PUSH_GATEWAY_TIMEOUT=
+WARP_PUSH_NOTIFICATION_RETENTION=
+
+# Application services: comma-separated registration files (paths inside
+# the container). Timeout default 30s.
+WARP_APPSERVICE_CONFIG_FILES=
+WARP_APPSERVICE_TIMEOUT=
+
+# Server notices. Defaults false, server-notices, Server Notices, Server
+# Notices.
+WARP_SERVER_NOTICES_ENABLED=
+WARP_SERVER_NOTICES_LOCALPART=
+WARP_SERVER_NOTICES_DISPLAY_NAME=
+WARP_SERVER_NOTICES_ROOM_NAME=
+
+# Logging: debug, info, warn or error; text or json; file and line.
+WARP_LOG_LEVEL=info
+WARP_LOG_FORMAT=json
+WARP_LOG_ADD_SOURCE=
+
+# Metrics. Defaults true, /metrics.
+WARP_METRICS_ENABLED=
+WARP_METRICS_PATH=
+
+# OpenTelemetry tracing. Defaults false, localhost:4318, 1, warp.
+WARP_TRACING_ENABLED=false
+WARP_TRACING_ENDPOINT=
+WARP_TRACING_SAMPLE_RATIO=
+WARP_TRACING_SERVICE_NAME=
+
+
+# ----------------------------------------------------------- admin panel
+
+# text or json.
+WARP_ADMIN_LOG_FORMAT=json
+
+# ------------------------------------------------------------ web client
+
+# The homeserver's public URL. Set, the browser talks to it directly and
+# the web client proxies nothing; empty, it proxies the client API.
+WARP_WEB_PUBLIC_HOMESERVER=
+# Space-separated origins of the LiveKit JWT service and SFU, for calls.
+WARP_WEB_CALL_ORIGINS=
+# text or json.
+WARP_WEB_LOG_FORMAT=json
diff --git a/Docker-AIO/.env.example b/Docker-AIO/.env.pocketbase.seaweedfs.split.example
similarity index 67%
rename from Docker-AIO/.env.example
rename to Docker-AIO/.env.pocketbase.seaweedfs.split.example
index ac21841..b5fef3b 100644
--- a/Docker-AIO/.env.example
+++ b/Docker-AIO/.env.pocketbase.seaweedfs.split.example
@@ -1,18 +1,20 @@
-# Settings for every compose file in this folder.
+# Settings for docker-compose.pocketbase.seaweedfs.split.yml:
+# the homeserver on PocketBase, the admin panel, the web client and
+# SeaweedFS split into its roles, for media, in one container.
 #
-#   cp .env.example .env
+#   cp .env.pocketbase.seaweedfs.split.example .env      # then edit it
+#   docker compose -f docker-compose.pocketbase.seaweedfs.split.yml up -d --build
 #
-# then edit .env. Compose reads it for the ports and the registry, and
-# hands all of it to the container, so anything below takes effect on the
-# next `docker compose ... up -d`.
+# Required, with no default: WARP_PB_S3_ACCESS_KEY, WARP_PB_S3_SECRET and
+# SEAWEED_ADMIN_PASSWORD.
 #
-# An empty value means the built-in default, given in the comment above it.
-# Every homeserver setting is described in docs/configuration.md.
+# Compose reads .env for the values it puts into the compose file, and hands
+# all of it to the containers, so a change takes effect on the next `up -d`.
+# An empty value means the built-in default, given in the comment above it;
+# every homeserver setting is described in docs/configuration.md.
 #
-# Set by the image, not here: the database driver and connection string
-# (each Dockerfile is one database), the listen addresses, the signing key
-# and media paths inside /data, the address the admin panel and web client
-# reach the homeserver on, and whether the bundled PostgreSQL runs.
+# Set by the image or the compose file, not here: the database driver and
+# connection string, the listen addresses and the paths inside /data.
 
 # ---------------------------------------------------------------- compose
 
@@ -21,32 +23,32 @@ WARP_PORT=8008
 WARP_ADMIN_PORT=8009
 WARP_WEB_PORT=8080
 
-# The *.prod.yml files pull $WARP_REGISTRY/warp-aio (SQLite),
-# warp-aio-pocketbase or warp-aio-postgresql at this tag. Pin a release in
-# production.
-WARP_REGISTRY=ghcr.io/dariuszjaniak
-WARP_VERSION=latest
-
 # ------------------------------------------------------------------- aio
 
 # false runs the container without the admin panel or the web client.
 WARP_AIO_ADMIN=true
 WARP_AIO_WEB=true
 
-# ------------------------------------------------------------- seaweedfs
+# -------------------------------------------------------------- seaweedfs
+
+# Media goes to this bucket in SeaweedFS, created on start; the database
+# stays in /data/pb_data. The key pair is the homeserver's S3 identity:
+# written into the filer's IAM store on every start, beside any identity
+# added in the admin UI, so a new secret here lands on the next start.
+# Media stored before S3 was on is not moved into the bucket.
+WARP_PB_S3_BUCKET=warp
+WARP_PB_S3_ACCESS_KEY=
+WARP_PB_S3_SECRET=
 
-# docker-compose.pocketbase.seaweedfs*.yml only; set WARP_PB_S3_ACCESS_KEY
-# and WARP_PB_S3_SECRET below as well.
-#
 # The S3 gateway's host port, on loopback unless the bind address says
-# otherwise. The homeserver reaches it inside the container; this is for
-# aws-cli and the like.
+# otherwise. The homeserver does not need it; it is for aws-cli and the
+# like.
 SEAWEED_S3_BIND=127.0.0.1
 SEAWEED_S3_PORT=8333
 
-# The split file only: SeaweedFS's admin UI. It can mint credentials for
-# the bucket, so the password is required. Put it behind a reverse proxy
-# before binding it to 0.0.0.0. The read-only login is optional.
+# SeaweedFS's admin UI. It can mint credentials for the bucket, so the
+# password is required. Put it behind a reverse proxy before binding it
+# to 0.0.0.0. The read-only login is optional.
 SEAWEED_ADMIN_BIND=127.0.0.1
 SEAWEED_ADMIN_PORT=23646
 SEAWEED_ADMIN_USER=admin
@@ -54,8 +56,8 @@ SEAWEED_ADMIN_PASSWORD=
 SEAWEED_ADMIN_READONLY_USER=
 SEAWEED_ADMIN_READONLY_PASSWORD=
 
-# Building only: the SeaweedFS release to bake in. Leave it commented out to
-# keep the Dockerfile's pin; an empty value breaks the build.
+# Building only: the SeaweedFS release to bake in. Leave it commented out
+# to keep the Dockerfile's pin; an empty value breaks the build.
 # SEAWEED_VERSION=4.45
 
 # ------------------------------------------------------------ homeserver
@@ -105,34 +107,9 @@ WARP_IDLE_TIMEOUT=
 WARP_MAX_HEADER_BYTES=
 WARP_SHUTDOWN_TIMEOUT=
 
-# Database pool (PostgreSQL). Defaults 10, 5, 1h, true.
-WARP_DB_MAX_OPEN_CONNS=
-WARP_DB_MAX_IDLE_CONNS=
-WARP_DB_CONN_MAX_LIFETIME=
+# Apply pending database migrations at startup. Default true.
 WARP_DB_AUTO_MIGRATE=
 
-# docker-compose.pocketbase*.yml only: keep media in an S3 bucket instead
-# of pb_data/storage. Bucket, region, endpoint and keys are all required
-# when it is on.
-#
-# The pocketbase.seaweedfs files turn it on themselves, against the
-# SeaweedFS in the container; there only the access key and secret are
-# needed (required: they are the gateway's credentials too), and the bucket
-# defaults to warp.
-#
-# The pocketbase.s3 files turn it on against a bucket elsewhere: the
-# endpoint, access key and secret are required, the bucket (default warp)
-# must exist, the region defaults to us-east-1 and path style to true
-# (SeaweedFS, MinIO; set false for AWS S3). For a gateway on the Docker
-# host, use http://host.docker.internal:8333.
-WARP_PB_S3_ENABLED=false
-WARP_PB_S3_BUCKET=
-WARP_PB_S3_REGION=
-WARP_PB_S3_ENDPOINT=
-WARP_PB_S3_ACCESS_KEY=
-WARP_PB_S3_SECRET=
-WARP_PB_S3_FORCE_PATH_STYLE=
-
 # Client API. Defaults *, false, 0s (never expire), 0s, true.
 WARP_CORS_ALLOWED_ORIGINS=
 WARP_TRUST_X_FORWARDED_FOR=
@@ -199,6 +176,7 @@ WARP_TRACING_ENDPOINT=
 WARP_TRACING_SAMPLE_RATIO=
 WARP_TRACING_SERVICE_NAME=
 
+
 # ----------------------------------------------------------- admin panel
 
 # text or json.
diff --git a/Docker-AIO/.env.pocketbase.seaweedfs.split.prod.example b/Docker-AIO/.env.pocketbase.seaweedfs.split.prod.example
new file mode 100644
index 0000000..97eff93
--- /dev/null
+++ b/Docker-AIO/.env.pocketbase.seaweedfs.split.prod.example
@@ -0,0 +1,194 @@
+# Settings for docker-compose.pocketbase.seaweedfs.split.prod.yml:
+# the homeserver on PocketBase, the admin panel, the web client and
+# SeaweedFS split into its roles, for media, in one container.
+#
+#   cp .env.pocketbase.seaweedfs.split.prod.example .env      # then edit it
+#   docker compose -f docker-compose.pocketbase.seaweedfs.split.prod.yml up -d
+#
+# Required, with no default: WARP_PB_S3_ACCESS_KEY, WARP_PB_S3_SECRET and
+# SEAWEED_ADMIN_PASSWORD.
+#
+# Compose reads .env for the values it puts into the compose file, and hands
+# all of it to the containers, so a change takes effect on the next `up -d`.
+# An empty value means the built-in default, given in the comment above it;
+# every homeserver setting is described in docs/configuration.md.
+#
+# Set by the image or the compose file, not here: the database driver and
+# connection string, the listen addresses and the paths inside /data.
+
+# ---------------------------------------------------------------- compose
+
+# Host ports for the homeserver, the admin panel and the web client.
+WARP_PORT=8008
+WARP_ADMIN_PORT=8009
+WARP_WEB_PORT=8080
+
+# The image is pulled from $WARP_REGISTRY/warp-aio-pocketbase-seaweedfs-split at this tag.
+# Pin a release in production.
+WARP_REGISTRY=ghcr.io/dariuszjaniak
+WARP_VERSION=latest
+
+# ------------------------------------------------------------------- aio
+
+# false runs the container without the admin panel or the web client.
+WARP_AIO_ADMIN=true
+WARP_AIO_WEB=true
+
+# -------------------------------------------------------------- seaweedfs
+
+# Media goes to this bucket in SeaweedFS, created on start; the database
+# stays in /data/pb_data. The key pair is the homeserver's S3 identity:
+# written into the filer's IAM store on every start, beside any identity
+# added in the admin UI, so a new secret here lands on the next start.
+# Media stored before S3 was on is not moved into the bucket.
+WARP_PB_S3_BUCKET=warp
+WARP_PB_S3_ACCESS_KEY=
+WARP_PB_S3_SECRET=
+
+# The S3 gateway's host port, on loopback unless the bind address says
+# otherwise. The homeserver does not need it; it is for aws-cli and the
+# like.
+SEAWEED_S3_BIND=127.0.0.1
+SEAWEED_S3_PORT=8333
+
+# SeaweedFS's admin UI. It can mint credentials for the bucket, so the
+# password is required. Put it behind a reverse proxy before binding it
+# to 0.0.0.0. The read-only login is optional.
+SEAWEED_ADMIN_BIND=127.0.0.1
+SEAWEED_ADMIN_PORT=23646
+SEAWEED_ADMIN_USER=admin
+SEAWEED_ADMIN_PASSWORD=
+SEAWEED_ADMIN_READONLY_USER=
+SEAWEED_ADMIN_READONLY_PASSWORD=
+
+# ------------------------------------------------------------ homeserver
+
+# Part of every user and room ID: it cannot be changed later.
+WARP_SERVER_NAME=matrix.example.org
+
+# The URL clients are told to use, in /.well-known/matrix/client.
+# Default https://<server name>.
+WARP_WELL_KNOWN_CLIENT_BASE_URL=https://matrix.example.org
+# Default empty.
+WARP_WELL_KNOWN_IDENTITY_SERVER_BASE_URL=
+# host:port other homeservers should use. Default empty: no delegation.
+WARP_WELL_KNOWN_SERVER_ADDRESS=
+
+# Registration. Default false; the admin API can switch it at runtime.
+WARP_REGISTRATION_ENABLED=false
+# Default true.
+WARP_REGISTRATION_ALLOW_RUNTIME_TOGGLE=
+# Comma-separated sign-up tokens. Default none.
+WARP_REGISTRATION_TOKENS=
+# Default false.
+WARP_REGISTRATION_REQUIRE_TOKEN=
+
+# Federation. Default false.
+WARP_FEDERATION_ENABLED=false
+# Default true.
+WARP_FEDERATION_ALLOW_RUNTIME_TOGGLE=
+# Comma-separated server names. Default none.
+WARP_FEDERATION_ALLOWLIST=
+WARP_FEDERATION_DENYLIST=
+WARP_FEDERATION_TRUSTED_KEY_SERVERS=
+# Default 24h.
+WARP_FEDERATION_KEY_VALIDITY_PERIOD=
+# A second, TLS listener for federation, e.g. :8448, with its certificate
+# and key (paths inside the container). Publish the port yourself.
+WARP_LISTEN_FEDERATION_ADDRESS=
+WARP_TLS_CERT_FILE=
+WARP_TLS_KEY_FILE=
+WARP_FEDERATION_TLS_CA_FILE=
+
+# HTTP server. Defaults 10s, 60s, 120s, 120s, 1048576, 30s.
+WARP_READ_HEADER_TIMEOUT=
+WARP_READ_TIMEOUT=
+WARP_WRITE_TIMEOUT=
+WARP_IDLE_TIMEOUT=
+WARP_MAX_HEADER_BYTES=
+WARP_SHUTDOWN_TIMEOUT=
+
+# Apply pending database migrations at startup. Default true.
+WARP_DB_AUTO_MIGRATE=
+
+# Client API. Defaults *, false, 0s (never expire), 0s, true.
+WARP_CORS_ALLOWED_ORIGINS=
+WARP_TRUST_X_FORWARDED_FOR=
+WARP_ACCESS_TOKEN_LIFETIME=
+WARP_REFRESH_TOKEN_LIFETIME=
+WARP_RATE_LIMIT_ENABLED=
+
+# Calls: the LiveKit JWT service's URL (see docs/calls.md). Default empty.
+WARP_RTC_LIVEKIT_SERVICE_URL=
+# Delayed events. Defaults 24h, 100.
+WARP_DELAYED_EVENTS_MAX_DELAY=
+WARP_DELAYED_EVENTS_MAX_PER_USER=
+# TURN for legacy 1:1 calls: comma-separated URIs, then a shared secret or
+# a static username and password. Lifetime default 1h.
+WARP_TURN_URIS=
+WARP_TURN_SHARED_SECRET=
+WARP_TURN_USER_LIFETIME=
+WARP_TURN_USERNAME=
+WARP_TURN_PASSWORD=
+
+# Sync. Defaults false, 30s, 30s.
+WARP_SYNC_PRESENCE=
+WARP_SYNC_TYPING_TIMEOUT=
+WARP_SYNC_LONG_POLL_TIMEOUT=
+
+# Media. Defaults 52428800 (50 MiB), 0 (no limit), 32000000, 24h, 10, false.
+WARP_MEDIA_MAX_UPLOAD_BYTES=
+WARP_MEDIA_MAX_USER_STORAGE_BYTES=
+WARP_MEDIA_MAX_THUMBNAIL_PIXELS=
+WARP_MEDIA_PENDING_UPLOAD_EXPIRY=
+WARP_MEDIA_MAX_PENDING_UPLOADS=
+WARP_MEDIA_LEGACY_UNAUTHENTICATED_DOWNLOADS=
+
+# Push. Defaults true, true, 10s, 720h.
+WARP_PUSH_ENABLED=
+WARP_PUSH_INCLUDE_CONTENT=
+WARP_PUSH_GATEWAY_TIMEOUT=
+WARP_PUSH_NOTIFICATION_RETENTION=
+
+# Application services: comma-separated registration files (paths inside
+# the container). Timeout default 30s.
+WARP_APPSERVICE_CONFIG_FILES=
+WARP_APPSERVICE_TIMEOUT=
+
+# Server notices. Defaults false, server-notices, Server Notices, Server
+# Notices.
+WARP_SERVER_NOTICES_ENABLED=
+WARP_SERVER_NOTICES_LOCALPART=
+WARP_SERVER_NOTICES_DISPLAY_NAME=
+WARP_SERVER_NOTICES_ROOM_NAME=
+
+# Logging: debug, info, warn or error; text or json; file and line.
+WARP_LOG_LEVEL=info
+WARP_LOG_FORMAT=json
+WARP_LOG_ADD_SOURCE=
+
+# Metrics. Defaults true, /metrics.
+WARP_METRICS_ENABLED=
+WARP_METRICS_PATH=
+
+# OpenTelemetry tracing. Defaults false, localhost:4318, 1, warp.
+WARP_TRACING_ENABLED=false
+WARP_TRACING_ENDPOINT=
+WARP_TRACING_SAMPLE_RATIO=
+WARP_TRACING_SERVICE_NAME=
+
+
+# ----------------------------------------------------------- admin panel
+
+# text or json.
+WARP_ADMIN_LOG_FORMAT=json
+
+# ------------------------------------------------------------ web client
+
+# The homeserver's public URL. Set, the browser talks to it directly and
+# the web client proxies nothing; empty, it proxies the client API.
+WARP_WEB_PUBLIC_HOMESERVER=
+# Space-separated origins of the LiveKit JWT service and SFU, for calls.
+WARP_WEB_CALL_ORIGINS=
+# text or json.
+WARP_WEB_LOG_FORMAT=json
diff --git a/Docker-AIO/.env.postgresql.example b/Docker-AIO/.env.postgresql.example
new file mode 100644
index 0000000..02a6de3
--- /dev/null
+++ b/Docker-AIO/.env.postgresql.example
@@ -0,0 +1,162 @@
+# Settings for docker-compose.postgresql.yml:
+# the homeserver, the admin panel, the web client and PostgreSQL in one
+# container.
+#
+#   cp .env.postgresql.example .env      # then edit it
+#   docker compose -f docker-compose.postgresql.yml up -d --build
+#
+# Compose reads .env for the values it puts into the compose file, and hands
+# all of it to the containers, so a change takes effect on the next `up -d`.
+# An empty value means the built-in default, given in the comment above it;
+# every homeserver setting is described in docs/configuration.md.
+#
+# Set by the image or the compose file, not here: the database driver and
+# connection string, the listen addresses and the paths inside /data.
+
+# ---------------------------------------------------------------- compose
+
+# Host ports for the homeserver, the admin panel and the web client.
+WARP_PORT=8008
+WARP_ADMIN_PORT=8009
+WARP_WEB_PORT=8080
+
+# ------------------------------------------------------------------- aio
+
+# false runs the container without the admin panel or the web client.
+WARP_AIO_ADMIN=true
+WARP_AIO_WEB=true
+
+# ------------------------------------------------------------ homeserver
+
+# Part of every user and room ID: it cannot be changed later.
+WARP_SERVER_NAME=localhost
+
+# The URL clients are told to use, in /.well-known/matrix/client.
+# Default https://<server name>.
+WARP_WELL_KNOWN_CLIENT_BASE_URL=http://localhost:8008
+# Default empty.
+WARP_WELL_KNOWN_IDENTITY_SERVER_BASE_URL=
+# host:port other homeservers should use. Default empty: no delegation.
+WARP_WELL_KNOWN_SERVER_ADDRESS=
+
+# Registration. Default false; the admin API can switch it at runtime.
+WARP_REGISTRATION_ENABLED=false
+# Default true.
+WARP_REGISTRATION_ALLOW_RUNTIME_TOGGLE=
+# Comma-separated sign-up tokens. Default none.
+WARP_REGISTRATION_TOKENS=
+# Default false.
+WARP_REGISTRATION_REQUIRE_TOKEN=
+
+# Federation. Default false.
+WARP_FEDERATION_ENABLED=false
+# Default true.
+WARP_FEDERATION_ALLOW_RUNTIME_TOGGLE=
+# Comma-separated server names. Default none.
+WARP_FEDERATION_ALLOWLIST=
+WARP_FEDERATION_DENYLIST=
+WARP_FEDERATION_TRUSTED_KEY_SERVERS=
+# Default 24h.
+WARP_FEDERATION_KEY_VALIDITY_PERIOD=
+# A second, TLS listener for federation, e.g. :8448, with its certificate
+# and key (paths inside the container). Publish the port yourself.
+WARP_LISTEN_FEDERATION_ADDRESS=
+WARP_TLS_CERT_FILE=
+WARP_TLS_KEY_FILE=
+WARP_FEDERATION_TLS_CA_FILE=
+
+# HTTP server. Defaults 10s, 60s, 120s, 120s, 1048576, 30s.
+WARP_READ_HEADER_TIMEOUT=
+WARP_READ_TIMEOUT=
+WARP_WRITE_TIMEOUT=
+WARP_IDLE_TIMEOUT=
+WARP_MAX_HEADER_BYTES=
+WARP_SHUTDOWN_TIMEOUT=
+
+# Database pool (PostgreSQL). Defaults 10, 5, 1h, true.
+WARP_DB_MAX_OPEN_CONNS=
+WARP_DB_MAX_IDLE_CONNS=
+WARP_DB_CONN_MAX_LIFETIME=
+WARP_DB_AUTO_MIGRATE=
+
+# Client API. Defaults *, false, 0s (never expire), 0s, true.
+WARP_CORS_ALLOWED_ORIGINS=
+WARP_TRUST_X_FORWARDED_FOR=
+WARP_ACCESS_TOKEN_LIFETIME=
+WARP_REFRESH_TOKEN_LIFETIME=
+WARP_RATE_LIMIT_ENABLED=
+
+# Calls: the LiveKit JWT service's URL (see docs/calls.md). Default empty.
+WARP_RTC_LIVEKIT_SERVICE_URL=
+# Delayed events. Defaults 24h, 100.
+WARP_DELAYED_EVENTS_MAX_DELAY=
+WARP_DELAYED_EVENTS_MAX_PER_USER=
+# TURN for legacy 1:1 calls: comma-separated URIs, then a shared secret or
+# a static username and password. Lifetime default 1h.
+WARP_TURN_URIS=
+WARP_TURN_SHARED_SECRET=
+WARP_TURN_USER_LIFETIME=
+WARP_TURN_USERNAME=
+WARP_TURN_PASSWORD=
+
+# Sync. Defaults false, 30s, 30s.
+WARP_SYNC_PRESENCE=
+WARP_SYNC_TYPING_TIMEOUT=
+WARP_SYNC_LONG_POLL_TIMEOUT=
+
+# Media. Defaults 52428800 (50 MiB), 0 (no limit), 32000000, 24h, 10, false.
+WARP_MEDIA_MAX_UPLOAD_BYTES=
+WARP_MEDIA_MAX_USER_STORAGE_BYTES=
+WARP_MEDIA_MAX_THUMBNAIL_PIXELS=
+WARP_MEDIA_PENDING_UPLOAD_EXPIRY=
+WARP_MEDIA_MAX_PENDING_UPLOADS=
+WARP_MEDIA_LEGACY_UNAUTHENTICATED_DOWNLOADS=
+
+# Push. Defaults true, true, 10s, 720h.
+WARP_PUSH_ENABLED=
+WARP_PUSH_INCLUDE_CONTENT=
+WARP_PUSH_GATEWAY_TIMEOUT=
+WARP_PUSH_NOTIFICATION_RETENTION=
+
+# Application services: comma-separated registration files (paths inside
+# the container). Timeout default 30s.
+WARP_APPSERVICE_CONFIG_FILES=
+WARP_APPSERVICE_TIMEOUT=
+
+# Server notices. Defaults false, server-notices, Server Notices, Server
+# Notices.
+WARP_SERVER_NOTICES_ENABLED=
+WARP_SERVER_NOTICES_LOCALPART=
+WARP_SERVER_NOTICES_DISPLAY_NAME=
+WARP_SERVER_NOTICES_ROOM_NAME=
+
+# Logging: debug, info, warn or error; text or json; file and line.
+WARP_LOG_LEVEL=info
+WARP_LOG_FORMAT=json
+WARP_LOG_ADD_SOURCE=
+
+# Metrics. Defaults true, /metrics.
+WARP_METRICS_ENABLED=
+WARP_METRICS_PATH=
+
+# OpenTelemetry tracing. Defaults false, localhost:4318, 1, warp.
+WARP_TRACING_ENABLED=false
+WARP_TRACING_ENDPOINT=
+WARP_TRACING_SAMPLE_RATIO=
+WARP_TRACING_SERVICE_NAME=
+
+
+# ----------------------------------------------------------- admin panel
+
+# text or json.
+WARP_ADMIN_LOG_FORMAT=json
+
+# ------------------------------------------------------------ web client
+
+# The homeserver's public URL. Set, the browser talks to it directly and
+# the web client proxies nothing; empty, it proxies the client API.
+WARP_WEB_PUBLIC_HOMESERVER=
+# Space-separated origins of the LiveKit JWT service and SFU, for calls.
+WARP_WEB_CALL_ORIGINS=
+# text or json.
+WARP_WEB_LOG_FORMAT=json
diff --git a/Docker-AIO/.env.postgresql.prod.example b/Docker-AIO/.env.postgresql.prod.example
new file mode 100644
index 0000000..b3447d8
--- /dev/null
+++ b/Docker-AIO/.env.postgresql.prod.example
@@ -0,0 +1,167 @@
+# Settings for docker-compose.postgresql.prod.yml:
+# the homeserver, the admin panel, the web client and PostgreSQL in one
+# container.
+#
+#   cp .env.postgresql.prod.example .env      # then edit it
+#   docker compose -f docker-compose.postgresql.prod.yml up -d
+#
+# Compose reads .env for the values it puts into the compose file, and hands
+# all of it to the containers, so a change takes effect on the next `up -d`.
+# An empty value means the built-in default, given in the comment above it;
+# every homeserver setting is described in docs/configuration.md.
+#
+# Set by the image or the compose file, not here: the database driver and
+# connection string, the listen addresses and the paths inside /data.
+
+# ---------------------------------------------------------------- compose
+
+# Host ports for the homeserver, the admin panel and the web client.
+WARP_PORT=8008
+WARP_ADMIN_PORT=8009
+WARP_WEB_PORT=8080
+
+# The image is pulled from $WARP_REGISTRY/warp-aio-postgresql at this tag.
+# Pin a release in production.
+WARP_REGISTRY=ghcr.io/dariuszjaniak
+WARP_VERSION=latest
+
+# ------------------------------------------------------------------- aio
+
+# false runs the container without the admin panel or the web client.
+WARP_AIO_ADMIN=true
+WARP_AIO_WEB=true
+
+# ------------------------------------------------------------ homeserver
+
+# Part of every user and room ID: it cannot be changed later.
+WARP_SERVER_NAME=matrix.example.org
+
+# The URL clients are told to use, in /.well-known/matrix/client.
+# Default https://<server name>.
+WARP_WELL_KNOWN_CLIENT_BASE_URL=https://matrix.example.org
+# Default empty.
+WARP_WELL_KNOWN_IDENTITY_SERVER_BASE_URL=
+# host:port other homeservers should use. Default empty: no delegation.
+WARP_WELL_KNOWN_SERVER_ADDRESS=
+
+# Registration. Default false; the admin API can switch it at runtime.
+WARP_REGISTRATION_ENABLED=false
+# Default true.
+WARP_REGISTRATION_ALLOW_RUNTIME_TOGGLE=
+# Comma-separated sign-up tokens. Default none.
+WARP_REGISTRATION_TOKENS=
+# Default false.
+WARP_REGISTRATION_REQUIRE_TOKEN=
+
+# Federation. Default false.
+WARP_FEDERATION_ENABLED=false
+# Default true.
+WARP_FEDERATION_ALLOW_RUNTIME_TOGGLE=
+# Comma-separated server names. Default none.
+WARP_FEDERATION_ALLOWLIST=
+WARP_FEDERATION_DENYLIST=
+WARP_FEDERATION_TRUSTED_KEY_SERVERS=
+# Default 24h.
+WARP_FEDERATION_KEY_VALIDITY_PERIOD=
+# A second, TLS listener for federation, e.g. :8448, with its certificate
+# and key (paths inside the container). Publish the port yourself.
+WARP_LISTEN_FEDERATION_ADDRESS=
+WARP_TLS_CERT_FILE=
+WARP_TLS_KEY_FILE=
+WARP_FEDERATION_TLS_CA_FILE=
+
+# HTTP server. Defaults 10s, 60s, 120s, 120s, 1048576, 30s.
+WARP_READ_HEADER_TIMEOUT=
+WARP_READ_TIMEOUT=
+WARP_WRITE_TIMEOUT=
+WARP_IDLE_TIMEOUT=
+WARP_MAX_HEADER_BYTES=
+WARP_SHUTDOWN_TIMEOUT=
+
+# Database pool (PostgreSQL). Defaults 10, 5, 1h, true.
+WARP_DB_MAX_OPEN_CONNS=
+WARP_DB_MAX_IDLE_CONNS=
+WARP_DB_CONN_MAX_LIFETIME=
+WARP_DB_AUTO_MIGRATE=
+
+# Client API. Defaults *, false, 0s (never expire), 0s, true.
+WARP_CORS_ALLOWED_ORIGINS=
+WARP_TRUST_X_FORWARDED_FOR=
+WARP_ACCESS_TOKEN_LIFETIME=
+WARP_REFRESH_TOKEN_LIFETIME=
+WARP_RATE_LIMIT_ENABLED=
+
+# Calls: the LiveKit JWT service's URL (see docs/calls.md). Default empty.
+WARP_RTC_LIVEKIT_SERVICE_URL=
+# Delayed events. Defaults 24h, 100.
+WARP_DELAYED_EVENTS_MAX_DELAY=
+WARP_DELAYED_EVENTS_MAX_PER_USER=
+# TURN for legacy 1:1 calls: comma-separated URIs, then a shared secret or
+# a static username and password. Lifetime default 1h.
+WARP_TURN_URIS=
+WARP_TURN_SHARED_SECRET=
+WARP_TURN_USER_LIFETIME=
+WARP_TURN_USERNAME=
+WARP_TURN_PASSWORD=
+
+# Sync. Defaults false, 30s, 30s.
+WARP_SYNC_PRESENCE=
+WARP_SYNC_TYPING_TIMEOUT=
+WARP_SYNC_LONG_POLL_TIMEOUT=
+
+# Media. Defaults 52428800 (50 MiB), 0 (no limit), 32000000, 24h, 10, false.
+WARP_MEDIA_MAX_UPLOAD_BYTES=
+WARP_MEDIA_MAX_USER_STORAGE_BYTES=
+WARP_MEDIA_MAX_THUMBNAIL_PIXELS=
+WARP_MEDIA_PENDING_UPLOAD_EXPIRY=
+WARP_MEDIA_MAX_PENDING_UPLOADS=
+WARP_MEDIA_LEGACY_UNAUTHENTICATED_DOWNLOADS=
+
+# Push. Defaults true, true, 10s, 720h.
+WARP_PUSH_ENABLED=
+WARP_PUSH_INCLUDE_CONTENT=
+WARP_PUSH_GATEWAY_TIMEOUT=
+WARP_PUSH_NOTIFICATION_RETENTION=
+
+# Application services: comma-separated registration files (paths inside
+# the container). Timeout default 30s.
+WARP_APPSERVICE_CONFIG_FILES=
+WARP_APPSERVICE_TIMEOUT=
+
+# Server notices. Defaults false, server-notices, Server Notices, Server
+# Notices.
+WARP_SERVER_NOTICES_ENABLED=
+WARP_SERVER_NOTICES_LOCALPART=
+WARP_SERVER_NOTICES_DISPLAY_NAME=
+WARP_SERVER_NOTICES_ROOM_NAME=
+
+# Logging: debug, info, warn or error; text or json; file and line.
+WARP_LOG_LEVEL=info
+WARP_LOG_FORMAT=json
+WARP_LOG_ADD_SOURCE=
+
+# Metrics. Defaults true, /metrics.
+WARP_METRICS_ENABLED=
+WARP_METRICS_PATH=
+
+# OpenTelemetry tracing. Defaults false, localhost:4318, 1, warp.
+WARP_TRACING_ENABLED=false
+WARP_TRACING_ENDPOINT=
+WARP_TRACING_SAMPLE_RATIO=
+WARP_TRACING_SERVICE_NAME=
+
+
+# ----------------------------------------------------------- admin panel
+
+# text or json.
+WARP_ADMIN_LOG_FORMAT=json
+
+# ------------------------------------------------------------ web client
+
+# The homeserver's public URL. Set, the browser talks to it directly and
+# the web client proxies nothing; empty, it proxies the client API.
+WARP_WEB_PUBLIC_HOMESERVER=
+# Space-separated origins of the LiveKit JWT service and SFU, for calls.
+WARP_WEB_CALL_ORIGINS=
+# text or json.
+WARP_WEB_LOG_FORMAT=json
diff --git a/Docker-AIO/.env.sqlite.example b/Docker-AIO/.env.sqlite.example
new file mode 100644
index 0000000..12ee21c
--- /dev/null
+++ b/Docker-AIO/.env.sqlite.example
@@ -0,0 +1,159 @@
+# Settings for docker-compose.sqlite.yml:
+# the homeserver on SQLite, the admin panel and the web client, in one
+# container.
+#
+#   cp .env.sqlite.example .env      # then edit it
+#   docker compose -f docker-compose.sqlite.yml up -d --build
+#
+# Compose reads .env for the values it puts into the compose file, and hands
+# all of it to the containers, so a change takes effect on the next `up -d`.
+# An empty value means the built-in default, given in the comment above it;
+# every homeserver setting is described in docs/configuration.md.
+#
+# Set by the image or the compose file, not here: the database driver and
+# connection string, the listen addresses and the paths inside /data.
+
+# ---------------------------------------------------------------- compose
+
+# Host ports for the homeserver, the admin panel and the web client.
+WARP_PORT=8008
+WARP_ADMIN_PORT=8009
+WARP_WEB_PORT=8080
+
+# ------------------------------------------------------------------- aio
+
+# false runs the container without the admin panel or the web client.
+WARP_AIO_ADMIN=true
+WARP_AIO_WEB=true
+
+# ------------------------------------------------------------ homeserver
+
+# Part of every user and room ID: it cannot be changed later.
+WARP_SERVER_NAME=localhost
+
+# The URL clients are told to use, in /.well-known/matrix/client.
+# Default https://<server name>.
+WARP_WELL_KNOWN_CLIENT_BASE_URL=http://localhost:8008
+# Default empty.
+WARP_WELL_KNOWN_IDENTITY_SERVER_BASE_URL=
+# host:port other homeservers should use. Default empty: no delegation.
+WARP_WELL_KNOWN_SERVER_ADDRESS=
+
+# Registration. Default false; the admin API can switch it at runtime.
+WARP_REGISTRATION_ENABLED=false
+# Default true.
+WARP_REGISTRATION_ALLOW_RUNTIME_TOGGLE=
+# Comma-separated sign-up tokens. Default none.
+WARP_REGISTRATION_TOKENS=
+# Default false.
+WARP_REGISTRATION_REQUIRE_TOKEN=
+
+# Federation. Default false.
+WARP_FEDERATION_ENABLED=false
+# Default true.
+WARP_FEDERATION_ALLOW_RUNTIME_TOGGLE=
+# Comma-separated server names. Default none.
+WARP_FEDERATION_ALLOWLIST=
+WARP_FEDERATION_DENYLIST=
+WARP_FEDERATION_TRUSTED_KEY_SERVERS=
+# Default 24h.
+WARP_FEDERATION_KEY_VALIDITY_PERIOD=
+# A second, TLS listener for federation, e.g. :8448, with its certificate
+# and key (paths inside the container). Publish the port yourself.
+WARP_LISTEN_FEDERATION_ADDRESS=
+WARP_TLS_CERT_FILE=
+WARP_TLS_KEY_FILE=
+WARP_FEDERATION_TLS_CA_FILE=
+
+# HTTP server. Defaults 10s, 60s, 120s, 120s, 1048576, 30s.
+WARP_READ_HEADER_TIMEOUT=
+WARP_READ_TIMEOUT=
+WARP_WRITE_TIMEOUT=
+WARP_IDLE_TIMEOUT=
+WARP_MAX_HEADER_BYTES=
+WARP_SHUTDOWN_TIMEOUT=
+
+# Apply pending database migrations at startup. Default true.
+WARP_DB_AUTO_MIGRATE=
+
+# Client API. Defaults *, false, 0s (never expire), 0s, true.
+WARP_CORS_ALLOWED_ORIGINS=
+WARP_TRUST_X_FORWARDED_FOR=
+WARP_ACCESS_TOKEN_LIFETIME=
+WARP_REFRESH_TOKEN_LIFETIME=
+WARP_RATE_LIMIT_ENABLED=
+
+# Calls: the LiveKit JWT service's URL (see docs/calls.md). Default empty.
+WARP_RTC_LIVEKIT_SERVICE_URL=
+# Delayed events. Defaults 24h, 100.
+WARP_DELAYED_EVENTS_MAX_DELAY=
+WARP_DELAYED_EVENTS_MAX_PER_USER=
+# TURN for legacy 1:1 calls: comma-separated URIs, then a shared secret or
+# a static username and password. Lifetime default 1h.
+WARP_TURN_URIS=
+WARP_TURN_SHARED_SECRET=
+WARP_TURN_USER_LIFETIME=
+WARP_TURN_USERNAME=
+WARP_TURN_PASSWORD=
+
+# Sync. Defaults false, 30s, 30s.
+WARP_SYNC_PRESENCE=
+WARP_SYNC_TYPING_TIMEOUT=
+WARP_SYNC_LONG_POLL_TIMEOUT=
+
+# Media. Defaults 52428800 (50 MiB), 0 (no limit), 32000000, 24h, 10, false.
+WARP_MEDIA_MAX_UPLOAD_BYTES=
+WARP_MEDIA_MAX_USER_STORAGE_BYTES=
+WARP_MEDIA_MAX_THUMBNAIL_PIXELS=
+WARP_MEDIA_PENDING_UPLOAD_EXPIRY=
+WARP_MEDIA_MAX_PENDING_UPLOADS=
+WARP_MEDIA_LEGACY_UNAUTHENTICATED_DOWNLOADS=
+
+# Push. Defaults true, true, 10s, 720h.
+WARP_PUSH_ENABLED=
+WARP_PUSH_INCLUDE_CONTENT=
+WARP_PUSH_GATEWAY_TIMEOUT=
+WARP_PUSH_NOTIFICATION_RETENTION=
+
+# Application services: comma-separated registration files (paths inside
+# the container). Timeout default 30s.
+WARP_APPSERVICE_CONFIG_FILES=
+WARP_APPSERVICE_TIMEOUT=
+
+# Server notices. Defaults false, server-notices, Server Notices, Server
+# Notices.
+WARP_SERVER_NOTICES_ENABLED=
+WARP_SERVER_NOTICES_LOCALPART=
+WARP_SERVER_NOTICES_DISPLAY_NAME=
+WARP_SERVER_NOTICES_ROOM_NAME=
+
+# Logging: debug, info, warn or error; text or json; file and line.
+WARP_LOG_LEVEL=info
+WARP_LOG_FORMAT=json
+WARP_LOG_ADD_SOURCE=
+
+# Metrics. Defaults true, /metrics.
+WARP_METRICS_ENABLED=
+WARP_METRICS_PATH=
+
+# OpenTelemetry tracing. Defaults false, localhost:4318, 1, warp.
+WARP_TRACING_ENABLED=false
+WARP_TRACING_ENDPOINT=
+WARP_TRACING_SAMPLE_RATIO=
+WARP_TRACING_SERVICE_NAME=
+
+
+# ----------------------------------------------------------- admin panel
+
+# text or json.
+WARP_ADMIN_LOG_FORMAT=json
+
+# ------------------------------------------------------------ web client
+
+# The homeserver's public URL. Set, the browser talks to it directly and
+# the web client proxies nothing; empty, it proxies the client API.
+WARP_WEB_PUBLIC_HOMESERVER=
+# Space-separated origins of the LiveKit JWT service and SFU, for calls.
+WARP_WEB_CALL_ORIGINS=
+# text or json.
+WARP_WEB_LOG_FORMAT=json
diff --git a/Docker-AIO/.env.sqlite.prod.example b/Docker-AIO/.env.sqlite.prod.example
new file mode 100644
index 0000000..87b7112
--- /dev/null
+++ b/Docker-AIO/.env.sqlite.prod.example
@@ -0,0 +1,164 @@
+# Settings for docker-compose.sqlite.prod.yml:
+# the homeserver on SQLite, the admin panel and the web client, in one
+# container.
+#
+#   cp .env.sqlite.prod.example .env      # then edit it
+#   docker compose -f docker-compose.sqlite.prod.yml up -d
+#
+# Compose reads .env for the values it puts into the compose file, and hands
+# all of it to the containers, so a change takes effect on the next `up -d`.
+# An empty value means the built-in default, given in the comment above it;
+# every homeserver setting is described in docs/configuration.md.
+#
+# Set by the image or the compose file, not here: the database driver and
+# connection string, the listen addresses and the paths inside /data.
+
+# ---------------------------------------------------------------- compose
+
+# Host ports for the homeserver, the admin panel and the web client.
+WARP_PORT=8008
+WARP_ADMIN_PORT=8009
+WARP_WEB_PORT=8080
+
+# The image is pulled from $WARP_REGISTRY/warp-aio at this tag.
+# Pin a release in production.
+WARP_REGISTRY=ghcr.io/dariuszjaniak
+WARP_VERSION=latest
+
+# ------------------------------------------------------------------- aio
+
+# false runs the container without the admin panel or the web client.
+WARP_AIO_ADMIN=true
+WARP_AIO_WEB=true
+
+# ------------------------------------------------------------ homeserver
+
+# Part of every user and room ID: it cannot be changed later.
+WARP_SERVER_NAME=matrix.example.org
+
+# The URL clients are told to use, in /.well-known/matrix/client.
+# Default https://<server name>.
+WARP_WELL_KNOWN_CLIENT_BASE_URL=https://matrix.example.org
+# Default empty.
+WARP_WELL_KNOWN_IDENTITY_SERVER_BASE_URL=
+# host:port other homeservers should use. Default empty: no delegation.
+WARP_WELL_KNOWN_SERVER_ADDRESS=
+
+# Registration. Default false; the admin API can switch it at runtime.
+WARP_REGISTRATION_ENABLED=false
+# Default true.
+WARP_REGISTRATION_ALLOW_RUNTIME_TOGGLE=
+# Comma-separated sign-up tokens. Default none.
+WARP_REGISTRATION_TOKENS=
+# Default false.
+WARP_REGISTRATION_REQUIRE_TOKEN=
+
+# Federation. Default false.
+WARP_FEDERATION_ENABLED=false
+# Default true.
+WARP_FEDERATION_ALLOW_RUNTIME_TOGGLE=
+# Comma-separated server names. Default none.
+WARP_FEDERATION_ALLOWLIST=
+WARP_FEDERATION_DENYLIST=
+WARP_FEDERATION_TRUSTED_KEY_SERVERS=
+# Default 24h.
+WARP_FEDERATION_KEY_VALIDITY_PERIOD=
+# A second, TLS listener for federation, e.g. :8448, with its certificate
+# and key (paths inside the container). Publish the port yourself.
+WARP_LISTEN_FEDERATION_ADDRESS=
+WARP_TLS_CERT_FILE=
+WARP_TLS_KEY_FILE=
+WARP_FEDERATION_TLS_CA_FILE=
+
+# HTTP server. Defaults 10s, 60s, 120s, 120s, 1048576, 30s.
+WARP_READ_HEADER_TIMEOUT=
+WARP_READ_TIMEOUT=
+WARP_WRITE_TIMEOUT=
+WARP_IDLE_TIMEOUT=
+WARP_MAX_HEADER_BYTES=
+WARP_SHUTDOWN_TIMEOUT=
+
+# Apply pending database migrations at startup. Default true.
+WARP_DB_AUTO_MIGRATE=
+
+# Client API. Defaults *, false, 0s (never expire), 0s, true.
+WARP_CORS_ALLOWED_ORIGINS=
+WARP_TRUST_X_FORWARDED_FOR=
+WARP_ACCESS_TOKEN_LIFETIME=
+WARP_REFRESH_TOKEN_LIFETIME=
+WARP_RATE_LIMIT_ENABLED=
+
+# Calls: the LiveKit JWT service's URL (see docs/calls.md). Default empty.
+WARP_RTC_LIVEKIT_SERVICE_URL=
+# Delayed events. Defaults 24h, 100.
+WARP_DELAYED_EVENTS_MAX_DELAY=
+WARP_DELAYED_EVENTS_MAX_PER_USER=
+# TURN for legacy 1:1 calls: comma-separated URIs, then a shared secret or
+# a static username and password. Lifetime default 1h.
+WARP_TURN_URIS=
+WARP_TURN_SHARED_SECRET=
+WARP_TURN_USER_LIFETIME=
+WARP_TURN_USERNAME=
+WARP_TURN_PASSWORD=
+
+# Sync. Defaults false, 30s, 30s.
+WARP_SYNC_PRESENCE=
+WARP_SYNC_TYPING_TIMEOUT=
+WARP_SYNC_LONG_POLL_TIMEOUT=
+
+# Media. Defaults 52428800 (50 MiB), 0 (no limit), 32000000, 24h, 10, false.
+WARP_MEDIA_MAX_UPLOAD_BYTES=
+WARP_MEDIA_MAX_USER_STORAGE_BYTES=
+WARP_MEDIA_MAX_THUMBNAIL_PIXELS=
+WARP_MEDIA_PENDING_UPLOAD_EXPIRY=
+WARP_MEDIA_MAX_PENDING_UPLOADS=
+WARP_MEDIA_LEGACY_UNAUTHENTICATED_DOWNLOADS=
+
+# Push. Defaults true, true, 10s, 720h.
+WARP_PUSH_ENABLED=
+WARP_PUSH_INCLUDE_CONTENT=
+WARP_PUSH_GATEWAY_TIMEOUT=
+WARP_PUSH_NOTIFICATION_RETENTION=
+
+# Application services: comma-separated registration files (paths inside
+# the container). Timeout default 30s.
+WARP_APPSERVICE_CONFIG_FILES=
+WARP_APPSERVICE_TIMEOUT=
+
+# Server notices. Defaults false, server-notices, Server Notices, Server
+# Notices.
+WARP_SERVER_NOTICES_ENABLED=
+WARP_SERVER_NOTICES_LOCALPART=
+WARP_SERVER_NOTICES_DISPLAY_NAME=
+WARP_SERVER_NOTICES_ROOM_NAME=
+
+# Logging: debug, info, warn or error; text or json; file and line.
+WARP_LOG_LEVEL=info
+WARP_LOG_FORMAT=json
+WARP_LOG_ADD_SOURCE=
+
+# Metrics. Defaults true, /metrics.
+WARP_METRICS_ENABLED=
+WARP_METRICS_PATH=
+
+# OpenTelemetry tracing. Defaults false, localhost:4318, 1, warp.
+WARP_TRACING_ENABLED=false
+WARP_TRACING_ENDPOINT=
+WARP_TRACING_SAMPLE_RATIO=
+WARP_TRACING_SERVICE_NAME=
+
+
+# ----------------------------------------------------------- admin panel
+
+# text or json.
+WARP_ADMIN_LOG_FORMAT=json
+
+# ------------------------------------------------------------ web client
+
+# The homeserver's public URL. Set, the browser talks to it directly and
+# the web client proxies nothing; empty, it proxies the client API.
+WARP_WEB_PUBLIC_HOMESERVER=
+# Space-separated origins of the LiveKit JWT service and SFU, for calls.
+WARP_WEB_CALL_ORIGINS=
+# text or json.
+WARP_WEB_LOG_FORMAT=json
diff --git a/Docker-AIO/README.md b/Docker-AIO/README.md
index 800475e..2584678 100644
--- a/Docker-AIO/README.md
+++ b/Docker-AIO/README.md
@@ -30,7 +30,7 @@ SeaweedFS images add `seaweed-data` on `/seaweed/data` (and the split one
 
 ```sh
 cd Docker-AIO
-cp .env.example .env      # then edit it
+cp .env.sqlite.example .env      # then edit it
 docker compose -f docker-compose.sqlite.yml up -d --build
 docker compose -f docker-compose.sqlite.yml exec warp warp create-account --username admin --admin
 ```
@@ -54,8 +54,8 @@ exists: AWS, MinIO, or a SeaweedFS on another host. Nothing in the
 container runs a gateway or creates the bucket.
 
 ```sh
-cp .env.example .env      # set WARP_PB_S3_ENDPOINT, WARP_PB_S3_ACCESS_KEY,
-                          # WARP_PB_S3_SECRET (and WARP_PB_S3_BUCKET)
+cp .env.pocketbase.s3.example .env      # set WARP_PB_S3_ENDPOINT, WARP_PB_S3_ACCESS_KEY,
+                                        # WARP_PB_S3_SECRET (and WARP_PB_S3_BUCKET)
 docker compose -f docker-compose.pocketbase.s3.yml up -d --build
 ```
 
@@ -74,8 +74,7 @@ SeaweedFS inside the same container. The compose files point the
 homeserver at it; `.env` only has to give it credentials:
 
 ```sh
-cp .env.example .env      # set WARP_PB_S3_ACCESS_KEY, WARP_PB_S3_SECRET
-                          # (and SEAWEED_ADMIN_PASSWORD for split)
+cp .env.pocketbase.seaweedfs.example .env      # set WARP_PB_S3_ACCESS_KEY, WARP_PB_S3_SECRET
 docker compose -f docker-compose.pocketbase.seaweedfs.yml up -d --build
 ```
 
@@ -107,10 +106,14 @@ across first. The SeaweedFS release is pinned in the Dockerfiles
 
 ## Settings
 
-Every setting is in `.env`, copied from [`.env.example`](.env.example),
-which lists them all with their defaults; an empty value means the
-default. `.env` is not committed. On top of the settings of
-[Docker/](../Docker/README.md), it has:
+Every compose file has its own settings file, named after it:
+`docker-compose.<name>.yml` takes `.env.<name>.example`, so
+`docker-compose.pocketbase.seaweedfs.split.yml` takes
+`.env.pocketbase.seaweedfs.split.example`. Each lists only the settings
+its compose file uses, with their defaults, and names the ones that are
+required; an empty value means the default. Copy the one you need to
+`.env`. `.env` is not committed. On top of the settings of
+[Docker/](../Docker/README.md), they have:
 
 | Variable | Default | |
 | --- | --- | --- |
diff --git a/Docker-AIO/docker-compose.pocketbase.prod.yml b/Docker-AIO/docker-compose.pocketbase.prod.yml
index d16a0d7..eb7ea37 100644
--- a/Docker-AIO/docker-compose.pocketbase.prod.yml
+++ b/Docker-AIO/docker-compose.pocketbase.prod.yml
@@ -2,7 +2,7 @@
 # web client in one container, pulled from a registry.
 #
 #   cd Docker-AIO
-#   cp .env.example .env      # then edit it
+#   cp .env.pocketbase.prod.example .env      # then edit it
 #   docker compose -f docker-compose.pocketbase.prod.yml up -d
 #
 # PocketBase is embedded in the homeserver (the pocketbase database driver):
diff --git a/Docker-AIO/docker-compose.pocketbase.s3.prod.yml b/Docker-AIO/docker-compose.pocketbase.s3.prod.yml
index aa2b054..36dfec9 100644
--- a/Docker-AIO/docker-compose.pocketbase.s3.prod.yml
+++ b/Docker-AIO/docker-compose.pocketbase.s3.prod.yml
@@ -3,8 +3,7 @@
 # from a registry (the image is built from Dockerfile.PocketBase.s3).
 #
 #   cd Docker-AIO
-#   cp .env.example .env      # then edit it; set WARP_PB_S3_ENDPOINT,
-#                             # WARP_PB_S3_ACCESS_KEY and WARP_PB_S3_SECRET
+#   cp .env.pocketbase.s3.prod.example .env      # then edit it
 #   docker compose -f docker-compose.pocketbase.s3.prod.yml up -d
 #
 # The database stays in /data/pb_data (warp-data); media goes to the bucket
diff --git a/Docker-AIO/docker-compose.pocketbase.s3.yml b/Docker-AIO/docker-compose.pocketbase.s3.yml
index 7557b52..f84da31 100644
--- a/Docker-AIO/docker-compose.pocketbase.s3.yml
+++ b/Docker-AIO/docker-compose.pocketbase.s3.yml
@@ -3,8 +3,7 @@
 # this checkout (Dockerfile.PocketBase.s3).
 #
 #   cd Docker-AIO
-#   cp .env.example .env      # then edit it; set WARP_PB_S3_ENDPOINT,
-#                             # WARP_PB_S3_ACCESS_KEY and WARP_PB_S3_SECRET
+#   cp .env.pocketbase.s3.example .env      # then edit it
 #   docker compose -f docker-compose.pocketbase.s3.yml up -d --build
 #
 # The database stays in /data/pb_data (warp-data); media goes to the bucket
diff --git a/Docker-AIO/docker-compose.pocketbase.seaweedfs.prod.yml b/Docker-AIO/docker-compose.pocketbase.seaweedfs.prod.yml
index f0a2c9a..5d279da 100644
--- a/Docker-AIO/docker-compose.pocketbase.seaweedfs.prod.yml
+++ b/Docker-AIO/docker-compose.pocketbase.seaweedfs.prod.yml
@@ -4,8 +4,7 @@
 # Dockerfile.PocketBase.SeaweedFS).
 #
 #   cd Docker-AIO
-#   cp .env.example .env      # then edit it; set WARP_PB_S3_ACCESS_KEY
-#                             # and WARP_PB_S3_SECRET
+#   cp .env.pocketbase.seaweedfs.prod.example .env      # then edit it
 #   docker compose -f docker-compose.pocketbase.seaweedfs.prod.yml up -d
 #
 # The database stays in /data/pb_data (warp-data); media goes to the bucket
@@ -45,7 +44,7 @@ services:
       WARP_PB_S3_ENABLED: "true"
       WARP_PB_S3_ENDPOINT: http://127.0.0.1:8333
       WARP_PB_S3_BUCKET: ${WARP_PB_S3_BUCKET:-warp}
-      WARP_PB_S3_REGION: ${WARP_PB_S3_REGION:-us-east-1}
+      WARP_PB_S3_REGION: us-east-1   # SeaweedFS ignores it; the client wants one
       WARP_PB_S3_FORCE_PATH_STYLE: "true"
       # The gateway's only identity, and what the homeserver signs with.
       WARP_PB_S3_ACCESS_KEY: ${WARP_PB_S3_ACCESS_KEY:?set WARP_PB_S3_ACCESS_KEY in .env}
diff --git a/Docker-AIO/docker-compose.pocketbase.seaweedfs.split.prod.yml b/Docker-AIO/docker-compose.pocketbase.seaweedfs.split.prod.yml
index 849726d..7f50052 100644
--- a/Docker-AIO/docker-compose.pocketbase.seaweedfs.split.prod.yml
+++ b/Docker-AIO/docker-compose.pocketbase.seaweedfs.split.prod.yml
@@ -4,8 +4,7 @@
 # a registry (the image is built from Dockerfile.PocketBase.SeaweedFS.split).
 #
 #   cd Docker-AIO
-#   cp .env.example .env      # then edit it; set WARP_PB_S3_ACCESS_KEY,
-#                             # WARP_PB_S3_SECRET and SEAWEED_ADMIN_PASSWORD
+#   cp .env.pocketbase.seaweedfs.split.prod.example .env      # then edit it
 #   docker compose -f docker-compose.pocketbase.seaweedfs.split.prod.yml up -d
 #
 # The database stays in /data/pb_data (warp-data); media goes to the bucket
@@ -47,7 +46,7 @@ services:
       WARP_PB_S3_ENABLED: "true"
       WARP_PB_S3_ENDPOINT: http://127.0.0.1:8333
       WARP_PB_S3_BUCKET: ${WARP_PB_S3_BUCKET:-warp}
-      WARP_PB_S3_REGION: ${WARP_PB_S3_REGION:-us-east-1}
+      WARP_PB_S3_REGION: us-east-1   # SeaweedFS ignores it; the client wants one
       WARP_PB_S3_FORCE_PATH_STYLE: "true"
       # The homeserver's identity in SeaweedFS, and what it signs with.
       WARP_PB_S3_ACCESS_KEY: ${WARP_PB_S3_ACCESS_KEY:?set WARP_PB_S3_ACCESS_KEY in .env}
diff --git a/Docker-AIO/docker-compose.pocketbase.seaweedfs.split.yml b/Docker-AIO/docker-compose.pocketbase.seaweedfs.split.yml
index 2dcb946..8cd996c 100644
--- a/Docker-AIO/docker-compose.pocketbase.seaweedfs.split.yml
+++ b/Docker-AIO/docker-compose.pocketbase.seaweedfs.split.yml
@@ -4,8 +4,7 @@
 # this checkout (Dockerfile.PocketBase.SeaweedFS.split).
 #
 #   cd Docker-AIO
-#   cp .env.example .env      # then edit it; set WARP_PB_S3_ACCESS_KEY,
-#                             # WARP_PB_S3_SECRET and SEAWEED_ADMIN_PASSWORD
+#   cp .env.pocketbase.seaweedfs.split.example .env      # then edit it
 #   docker compose -f docker-compose.pocketbase.seaweedfs.split.yml up -d --build
 #
 # The database stays in /data/pb_data (warp-data); media goes to the bucket
@@ -46,7 +45,7 @@ services:
       WARP_PB_S3_ENABLED: "true"
       WARP_PB_S3_ENDPOINT: http://127.0.0.1:8333
       WARP_PB_S3_BUCKET: ${WARP_PB_S3_BUCKET:-warp}
-      WARP_PB_S3_REGION: ${WARP_PB_S3_REGION:-us-east-1}
+      WARP_PB_S3_REGION: us-east-1   # SeaweedFS ignores it; the client wants one
       WARP_PB_S3_FORCE_PATH_STYLE: "true"
       # The homeserver's identity in SeaweedFS, and what it signs with.
       WARP_PB_S3_ACCESS_KEY: ${WARP_PB_S3_ACCESS_KEY:?set WARP_PB_S3_ACCESS_KEY in .env}
diff --git a/Docker-AIO/docker-compose.pocketbase.seaweedfs.yml b/Docker-AIO/docker-compose.pocketbase.seaweedfs.yml
index abe31e3..981a9f9 100644
--- a/Docker-AIO/docker-compose.pocketbase.seaweedfs.yml
+++ b/Docker-AIO/docker-compose.pocketbase.seaweedfs.yml
@@ -3,8 +3,7 @@
 # container built from this checkout (Dockerfile.PocketBase.SeaweedFS).
 #
 #   cd Docker-AIO
-#   cp .env.example .env      # then edit it; set WARP_PB_S3_ACCESS_KEY
-#                             # and WARP_PB_S3_SECRET
+#   cp .env.pocketbase.seaweedfs.example .env      # then edit it
 #   docker compose -f docker-compose.pocketbase.seaweedfs.yml up -d --build
 #
 # The database stays in /data/pb_data (warp-data); media goes to the bucket
@@ -43,7 +42,7 @@ services:
       WARP_PB_S3_ENABLED: "true"
       WARP_PB_S3_ENDPOINT: http://127.0.0.1:8333
       WARP_PB_S3_BUCKET: ${WARP_PB_S3_BUCKET:-warp}
-      WARP_PB_S3_REGION: ${WARP_PB_S3_REGION:-us-east-1}
+      WARP_PB_S3_REGION: us-east-1   # SeaweedFS ignores it; the client wants one
       WARP_PB_S3_FORCE_PATH_STYLE: "true"
       # The gateway's only identity, and what the homeserver signs with.
       WARP_PB_S3_ACCESS_KEY: ${WARP_PB_S3_ACCESS_KEY:?set WARP_PB_S3_ACCESS_KEY in .env}
diff --git a/Docker-AIO/docker-compose.pocketbase.yml b/Docker-AIO/docker-compose.pocketbase.yml
index dd4dd97..5627d4d 100644
--- a/Docker-AIO/docker-compose.pocketbase.yml
+++ b/Docker-AIO/docker-compose.pocketbase.yml
@@ -2,7 +2,7 @@
 # web client in one container, built from this checkout.
 #
 #   cd Docker-AIO
-#   cp .env.example .env      # then edit it
+#   cp .env.pocketbase.example .env      # then edit it
 #   docker compose -f docker-compose.pocketbase.yml up -d --build
 #
 # PocketBase is embedded in the homeserver (the pocketbase database driver):
diff --git a/Docker-AIO/docker-compose.postgresql.prod.yml b/Docker-AIO/docker-compose.postgresql.prod.yml
index 0073d96..0eef14c 100644
--- a/Docker-AIO/docker-compose.postgresql.prod.yml
+++ b/Docker-AIO/docker-compose.postgresql.prod.yml
@@ -2,7 +2,7 @@
 # client and PostgreSQL in one container, pulled from a registry.
 #
 #   cd Docker-AIO
-#   cp .env.example .env      # then edit it
+#   cp .env.postgresql.prod.example .env      # then edit it
 #   docker compose -f docker-compose.postgresql.prod.yml up -d
 #
 # PostgreSQL runs inside the container, listening only on a Unix socket
diff --git a/Docker-AIO/docker-compose.postgresql.yml b/Docker-AIO/docker-compose.postgresql.yml
index 7fa370b..956da85 100644
--- a/Docker-AIO/docker-compose.postgresql.yml
+++ b/Docker-AIO/docker-compose.postgresql.yml
@@ -2,7 +2,7 @@
 # client and PostgreSQL in one container, built from this checkout.
 #
 #   cd Docker-AIO
-#   cp .env.example .env      # then edit it
+#   cp .env.postgresql.example .env      # then edit it
 #   docker compose -f docker-compose.postgresql.yml up -d --build
 #
 # PostgreSQL runs inside the container, listening only on a Unix socket
diff --git a/Docker-AIO/docker-compose.sqlite.prod.yml b/Docker-AIO/docker-compose.sqlite.prod.yml
index 7d9ce29..cb80e5f 100644
--- a/Docker-AIO/docker-compose.sqlite.prod.yml
+++ b/Docker-AIO/docker-compose.sqlite.prod.yml
@@ -2,7 +2,7 @@
 # client in one container, pulled from a registry.
 #
 #   cd Docker-AIO
-#   cp .env.example .env      # then edit it
+#   cp .env.sqlite.prod.example .env      # then edit it
 #   docker compose -f docker-compose.sqlite.prod.yml up -d
 #
 # Homeserver http://localhost:8008, admin panel http://localhost:8009, web
diff --git a/Docker-AIO/docker-compose.sqlite.yml b/Docker-AIO/docker-compose.sqlite.yml
index a5f834e..6eab93d 100644
--- a/Docker-AIO/docker-compose.sqlite.yml
+++ b/Docker-AIO/docker-compose.sqlite.yml
@@ -2,7 +2,7 @@
 # client in one container, built from this checkout.
 #
 #   cd Docker-AIO
-#   cp .env.example .env      # then edit it
+#   cp .env.sqlite.example .env      # then edit it
 #   docker compose -f docker-compose.sqlite.yml up -d --build
 #
 # Homeserver http://localhost:8008, admin panel http://localhost:8009, web
diff --git a/Docker/.env.pocketbase.example b/Docker/.env.pocketbase.example
new file mode 100644
index 0000000..be1ea1c
--- /dev/null
+++ b/Docker/.env.pocketbase.example
@@ -0,0 +1,166 @@
+# Settings for docker-compose.pocketbase.yml:
+# the homeserver on PocketBase, the admin panel and the web client, each
+# in its own container.
+#
+#   cp .env.pocketbase.example .env      # then edit it
+#   docker compose -f docker-compose.pocketbase.yml up -d --build
+#
+# Compose reads .env for the values it puts into the compose file, and hands
+# all of it to the containers, so a change takes effect on the next `up -d`.
+# An empty value means the built-in default, given in the comment above it;
+# every homeserver setting is described in docs/configuration.md.
+#
+# Set by the compose file, not here: the database driver and connection
+# string, and the address the admin panel and web client reach the
+# homeserver on.
+
+# ---------------------------------------------------------------- compose
+
+# Host ports for the homeserver, the admin panel and the web client.
+WARP_PORT=8008
+WARP_ADMIN_PORT=8009
+WARP_WEB_PORT=8080
+
+# ------------------------------------------------------------ homeserver
+
+# Part of every user and room ID: it cannot be changed later.
+WARP_SERVER_NAME=localhost
+
+# The URL clients are told to use, in /.well-known/matrix/client.
+# Default https://<server name>.
+WARP_WELL_KNOWN_CLIENT_BASE_URL=http://localhost:8008
+# Default empty.
+WARP_WELL_KNOWN_IDENTITY_SERVER_BASE_URL=
+# host:port other homeservers should use. Default empty: no delegation.
+WARP_WELL_KNOWN_SERVER_ADDRESS=
+
+# Registration. Default false; the admin API can switch it at runtime.
+WARP_REGISTRATION_ENABLED=false
+# Default true.
+WARP_REGISTRATION_ALLOW_RUNTIME_TOGGLE=
+# Comma-separated sign-up tokens. Default none.
+WARP_REGISTRATION_TOKENS=
+# Default false.
+WARP_REGISTRATION_REQUIRE_TOKEN=
+
+# Federation. Default false.
+WARP_FEDERATION_ENABLED=false
+# Default true.
+WARP_FEDERATION_ALLOW_RUNTIME_TOGGLE=
+# Comma-separated server names. Default none.
+WARP_FEDERATION_ALLOWLIST=
+WARP_FEDERATION_DENYLIST=
+WARP_FEDERATION_TRUSTED_KEY_SERVERS=
+# Default 24h.
+WARP_FEDERATION_KEY_VALIDITY_PERIOD=
+# A second, TLS listener for federation, e.g. :8448, with its certificate
+# and key (paths inside the container). Publish the port yourself.
+WARP_LISTEN_FEDERATION_ADDRESS=
+WARP_TLS_CERT_FILE=
+WARP_TLS_KEY_FILE=
+WARP_FEDERATION_TLS_CA_FILE=
+
+# HTTP server. Defaults 10s, 60s, 120s, 120s, 1048576, 30s.
+WARP_READ_HEADER_TIMEOUT=
+WARP_READ_TIMEOUT=
+WARP_WRITE_TIMEOUT=
+WARP_IDLE_TIMEOUT=
+WARP_MAX_HEADER_BYTES=
+WARP_SHUTDOWN_TIMEOUT=
+
+# Apply pending database migrations at startup. Default true.
+WARP_DB_AUTO_MIGRATE=
+
+# Media in an S3 bucket instead of pb_data/storage. Bucket, region,
+# endpoint and keys are all required when it is on, and the bucket must
+# exist. For a bucket set up for you, use the pocketbase.s3 or
+# pocketbase.seaweedfs files. Media stored before S3 was on is not moved.
+WARP_PB_S3_ENABLED=false
+WARP_PB_S3_BUCKET=
+WARP_PB_S3_REGION=
+WARP_PB_S3_ENDPOINT=
+WARP_PB_S3_ACCESS_KEY=
+WARP_PB_S3_SECRET=
+WARP_PB_S3_FORCE_PATH_STYLE=false
+
+# Client API. Defaults *, false, 0s (never expire), 0s, true.
+WARP_CORS_ALLOWED_ORIGINS=
+WARP_TRUST_X_FORWARDED_FOR=
+WARP_ACCESS_TOKEN_LIFETIME=
+WARP_REFRESH_TOKEN_LIFETIME=
+WARP_RATE_LIMIT_ENABLED=
+
+# Calls: the LiveKit JWT service's URL (see docs/calls.md). Default empty.
+WARP_RTC_LIVEKIT_SERVICE_URL=
+# Delayed events. Defaults 24h, 100.
+WARP_DELAYED_EVENTS_MAX_DELAY=
+WARP_DELAYED_EVENTS_MAX_PER_USER=
+# TURN for legacy 1:1 calls: comma-separated URIs, then a shared secret or
+# a static username and password. Lifetime default 1h.
+WARP_TURN_URIS=
+WARP_TURN_SHARED_SECRET=
+WARP_TURN_USER_LIFETIME=
+WARP_TURN_USERNAME=
+WARP_TURN_PASSWORD=
+
+# Sync. Defaults false, 30s, 30s.
+WARP_SYNC_PRESENCE=
+WARP_SYNC_TYPING_TIMEOUT=
+WARP_SYNC_LONG_POLL_TIMEOUT=
+
+# Media. Defaults 52428800 (50 MiB), 0 (no limit), 32000000, 24h, 10, false.
+WARP_MEDIA_MAX_UPLOAD_BYTES=
+WARP_MEDIA_MAX_USER_STORAGE_BYTES=
+WARP_MEDIA_MAX_THUMBNAIL_PIXELS=
+WARP_MEDIA_PENDING_UPLOAD_EXPIRY=
+WARP_MEDIA_MAX_PENDING_UPLOADS=
+WARP_MEDIA_LEGACY_UNAUTHENTICATED_DOWNLOADS=
+
+# Push. Defaults true, true, 10s, 720h.
+WARP_PUSH_ENABLED=
+WARP_PUSH_INCLUDE_CONTENT=
+WARP_PUSH_GATEWAY_TIMEOUT=
+WARP_PUSH_NOTIFICATION_RETENTION=
+
+# Application services: comma-separated registration files (paths inside
+# the container). Timeout default 30s.
+WARP_APPSERVICE_CONFIG_FILES=
+WARP_APPSERVICE_TIMEOUT=
+
+# Server notices. Defaults false, server-notices, Server Notices, Server
+# Notices.
+WARP_SERVER_NOTICES_ENABLED=
+WARP_SERVER_NOTICES_LOCALPART=
+WARP_SERVER_NOTICES_DISPLAY_NAME=
+WARP_SERVER_NOTICES_ROOM_NAME=
+
+# Logging: debug, info, warn or error; text or json; file and line.
+WARP_LOG_LEVEL=info
+WARP_LOG_FORMAT=json
+WARP_LOG_ADD_SOURCE=
+
+# Metrics. Defaults true, /metrics.
+WARP_METRICS_ENABLED=
+WARP_METRICS_PATH=
+
+# OpenTelemetry tracing. Defaults false, localhost:4318, 1, warp.
+WARP_TRACING_ENABLED=false
+WARP_TRACING_ENDPOINT=
+WARP_TRACING_SAMPLE_RATIO=
+WARP_TRACING_SERVICE_NAME=
+
+
+# ----------------------------------------------------------- admin panel
+
+# text or json.
+WARP_ADMIN_LOG_FORMAT=json
+
+# ------------------------------------------------------------ web client
+
+# The homeserver's public URL. Set, the browser talks to it directly and
+# the web client proxies nothing; empty, it proxies the client API.
+WARP_WEB_PUBLIC_HOMESERVER=
+# Space-separated origins of the LiveKit JWT service and SFU, for calls.
+WARP_WEB_CALL_ORIGINS=
+# text or json.
+WARP_WEB_LOG_FORMAT=json
diff --git a/Docker/.env.pocketbase.prod.example b/Docker/.env.pocketbase.prod.example
new file mode 100644
index 0000000..2e48904
--- /dev/null
+++ b/Docker/.env.pocketbase.prod.example
@@ -0,0 +1,171 @@
+# Settings for docker-compose.pocketbase.prod.yml:
+# the homeserver on PocketBase, the admin panel and the web client, each
+# in its own container.
+#
+#   cp .env.pocketbase.prod.example .env      # then edit it
+#   docker compose -f docker-compose.pocketbase.prod.yml up -d
+#
+# Compose reads .env for the values it puts into the compose file, and hands
+# all of it to the containers, so a change takes effect on the next `up -d`.
+# An empty value means the built-in default, given in the comment above it;
+# every homeserver setting is described in docs/configuration.md.
+#
+# Set by the compose file, not here: the database driver and connection
+# string, and the address the admin panel and web client reach the
+# homeserver on.
+
+# ---------------------------------------------------------------- compose
+
+# Host ports for the homeserver, the admin panel and the web client.
+WARP_PORT=8008
+WARP_ADMIN_PORT=8009
+WARP_WEB_PORT=8080
+
+# The images are pulled from $WARP_REGISTRY/warp, warp-admin and warp-web
+# at this tag. Pin a release in production.
+WARP_REGISTRY=ghcr.io/dariuszjaniak
+WARP_VERSION=latest
+
+# ------------------------------------------------------------ homeserver
+
+# Part of every user and room ID: it cannot be changed later.
+WARP_SERVER_NAME=matrix.example.org
+
+# The URL clients are told to use, in /.well-known/matrix/client.
+# Default https://<server name>.
+WARP_WELL_KNOWN_CLIENT_BASE_URL=https://matrix.example.org
+# Default empty.
+WARP_WELL_KNOWN_IDENTITY_SERVER_BASE_URL=
+# host:port other homeservers should use. Default empty: no delegation.
+WARP_WELL_KNOWN_SERVER_ADDRESS=
+
+# Registration. Default false; the admin API can switch it at runtime.
+WARP_REGISTRATION_ENABLED=false
+# Default true.
+WARP_REGISTRATION_ALLOW_RUNTIME_TOGGLE=
+# Comma-separated sign-up tokens. Default none.
+WARP_REGISTRATION_TOKENS=
+# Default false.
+WARP_REGISTRATION_REQUIRE_TOKEN=
+
+# Federation. Default false.
+WARP_FEDERATION_ENABLED=false
+# Default true.
+WARP_FEDERATION_ALLOW_RUNTIME_TOGGLE=
+# Comma-separated server names. Default none.
+WARP_FEDERATION_ALLOWLIST=
+WARP_FEDERATION_DENYLIST=
+WARP_FEDERATION_TRUSTED_KEY_SERVERS=
+# Default 24h.
+WARP_FEDERATION_KEY_VALIDITY_PERIOD=
+# A second, TLS listener for federation, e.g. :8448, with its certificate
+# and key (paths inside the container). Publish the port yourself.
+WARP_LISTEN_FEDERATION_ADDRESS=
+WARP_TLS_CERT_FILE=
+WARP_TLS_KEY_FILE=
+WARP_FEDERATION_TLS_CA_FILE=
+
+# HTTP server. Defaults 10s, 60s, 120s, 120s, 1048576, 30s.
+WARP_READ_HEADER_TIMEOUT=
+WARP_READ_TIMEOUT=
+WARP_WRITE_TIMEOUT=
+WARP_IDLE_TIMEOUT=
+WARP_MAX_HEADER_BYTES=
+WARP_SHUTDOWN_TIMEOUT=
+
+# Apply pending database migrations at startup. Default true.
+WARP_DB_AUTO_MIGRATE=
+
+# Media in an S3 bucket instead of pb_data/storage. Bucket, region,
+# endpoint and keys are all required when it is on, and the bucket must
+# exist. For a bucket set up for you, use the pocketbase.s3 or
+# pocketbase.seaweedfs files. Media stored before S3 was on is not moved.
+WARP_PB_S3_ENABLED=false
+WARP_PB_S3_BUCKET=
+WARP_PB_S3_REGION=
+WARP_PB_S3_ENDPOINT=
+WARP_PB_S3_ACCESS_KEY=
+WARP_PB_S3_SECRET=
+WARP_PB_S3_FORCE_PATH_STYLE=false
+
+# Client API. Defaults *, false, 0s (never expire), 0s, true.
+WARP_CORS_ALLOWED_ORIGINS=
+WARP_TRUST_X_FORWARDED_FOR=
+WARP_ACCESS_TOKEN_LIFETIME=
+WARP_REFRESH_TOKEN_LIFETIME=
+WARP_RATE_LIMIT_ENABLED=
+
+# Calls: the LiveKit JWT service's URL (see docs/calls.md). Default empty.
+WARP_RTC_LIVEKIT_SERVICE_URL=
+# Delayed events. Defaults 24h, 100.
+WARP_DELAYED_EVENTS_MAX_DELAY=
+WARP_DELAYED_EVENTS_MAX_PER_USER=
+# TURN for legacy 1:1 calls: comma-separated URIs, then a shared secret or
+# a static username and password. Lifetime default 1h.
+WARP_TURN_URIS=
+WARP_TURN_SHARED_SECRET=
+WARP_TURN_USER_LIFETIME=
+WARP_TURN_USERNAME=
+WARP_TURN_PASSWORD=
+
+# Sync. Defaults false, 30s, 30s.
+WARP_SYNC_PRESENCE=
+WARP_SYNC_TYPING_TIMEOUT=
+WARP_SYNC_LONG_POLL_TIMEOUT=
+
+# Media. Defaults 52428800 (50 MiB), 0 (no limit), 32000000, 24h, 10, false.
+WARP_MEDIA_MAX_UPLOAD_BYTES=
+WARP_MEDIA_MAX_USER_STORAGE_BYTES=
+WARP_MEDIA_MAX_THUMBNAIL_PIXELS=
+WARP_MEDIA_PENDING_UPLOAD_EXPIRY=
+WARP_MEDIA_MAX_PENDING_UPLOADS=
+WARP_MEDIA_LEGACY_UNAUTHENTICATED_DOWNLOADS=
+
+# Push. Defaults true, true, 10s, 720h.
+WARP_PUSH_ENABLED=
+WARP_PUSH_INCLUDE_CONTENT=
+WARP_PUSH_GATEWAY_TIMEOUT=
+WARP_PUSH_NOTIFICATION_RETENTION=
+
+# Application services: comma-separated registration files (paths inside
+# the container). Timeout default 30s.
+WARP_APPSERVICE_CONFIG_FILES=
+WARP_APPSERVICE_TIMEOUT=
+
+# Server notices. Defaults false, server-notices, Server Notices, Server
+# Notices.
+WARP_SERVER_NOTICES_ENABLED=
+WARP_SERVER_NOTICES_LOCALPART=
+WARP_SERVER_NOTICES_DISPLAY_NAME=
+WARP_SERVER_NOTICES_ROOM_NAME=
+
+# Logging: debug, info, warn or error; text or json; file and line.
+WARP_LOG_LEVEL=info
+WARP_LOG_FORMAT=json
+WARP_LOG_ADD_SOURCE=
+
+# Metrics. Defaults true, /metrics.
+WARP_METRICS_ENABLED=
+WARP_METRICS_PATH=
+
+# OpenTelemetry tracing. Defaults false, localhost:4318, 1, warp.
+WARP_TRACING_ENABLED=false
+WARP_TRACING_ENDPOINT=
+WARP_TRACING_SAMPLE_RATIO=
+WARP_TRACING_SERVICE_NAME=
+
+
+# ----------------------------------------------------------- admin panel
+
+# text or json.
+WARP_ADMIN_LOG_FORMAT=json
+
+# ------------------------------------------------------------ web client
+
+# The homeserver's public URL. Set, the browser talks to it directly and
+# the web client proxies nothing; empty, it proxies the client API.
+WARP_WEB_PUBLIC_HOMESERVER=
+# Space-separated origins of the LiveKit JWT service and SFU, for calls.
+WARP_WEB_CALL_ORIGINS=
+# text or json.
+WARP_WEB_LOG_FORMAT=json
diff --git a/Docker/.env.pocketbase.s3.example b/Docker/.env.pocketbase.s3.example
new file mode 100644
index 0000000..889d239
--- /dev/null
+++ b/Docker/.env.pocketbase.s3.example
@@ -0,0 +1,172 @@
+# Settings for docker-compose.pocketbase.s3.yml:
+# the homeserver on PocketBase with media in an S3 bucket elsewhere, the
+# admin panel and the web client, each in its own container.
+#
+#   cp .env.pocketbase.s3.example .env      # then edit it
+#   docker compose -f docker-compose.pocketbase.s3.yml up -d --build
+#
+# Required, with no default: WARP_PB_S3_ENDPOINT, WARP_PB_S3_ACCESS_KEY
+# and WARP_PB_S3_SECRET.
+#
+# Compose reads .env for the values it puts into the compose file, and hands
+# all of it to the containers, so a change takes effect on the next `up -d`.
+# An empty value means the built-in default, given in the comment above it;
+# every homeserver setting is described in docs/configuration.md.
+#
+# Set by the compose file, not here: the database driver and connection
+# string, and the address the admin panel and web client reach the
+# homeserver on.
+
+# ---------------------------------------------------------------- compose
+
+# Host ports for the homeserver, the admin panel and the web client.
+WARP_PORT=8008
+WARP_ADMIN_PORT=8009
+WARP_WEB_PORT=8080
+
+# ------------------------------------------------------------- media (S3)
+
+# Media goes to this bucket; the database stays in /data/pb_data. The bucket
+# must already exist: nothing here runs a gateway or creates it. For a
+# gateway on the Docker host, use http://host.docker.internal:8333. Media
+# stored before S3 was on is not moved into the bucket.
+WARP_PB_S3_ENDPOINT=
+WARP_PB_S3_BUCKET=warp
+WARP_PB_S3_ACCESS_KEY=
+WARP_PB_S3_SECRET=
+# SeaweedFS and MinIO ignore the region; the client insists on one.
+WARP_PB_S3_REGION=us-east-1
+# true for SeaweedFS and MinIO, false for AWS S3 proper.
+WARP_PB_S3_FORCE_PATH_STYLE=true
+
+# ------------------------------------------------------------ homeserver
+
+# Part of every user and room ID: it cannot be changed later.
+WARP_SERVER_NAME=localhost
+
+# The URL clients are told to use, in /.well-known/matrix/client.
+# Default https://<server name>.
+WARP_WELL_KNOWN_CLIENT_BASE_URL=http://localhost:8008
+# Default empty.
+WARP_WELL_KNOWN_IDENTITY_SERVER_BASE_URL=
+# host:port other homeservers should use. Default empty: no delegation.
+WARP_WELL_KNOWN_SERVER_ADDRESS=
+
+# Registration. Default false; the admin API can switch it at runtime.
+WARP_REGISTRATION_ENABLED=false
+# Default true.
+WARP_REGISTRATION_ALLOW_RUNTIME_TOGGLE=
+# Comma-separated sign-up tokens. Default none.
+WARP_REGISTRATION_TOKENS=
+# Default false.
+WARP_REGISTRATION_REQUIRE_TOKEN=
+
+# Federation. Default false.
+WARP_FEDERATION_ENABLED=false
+# Default true.
+WARP_FEDERATION_ALLOW_RUNTIME_TOGGLE=
+# Comma-separated server names. Default none.
+WARP_FEDERATION_ALLOWLIST=
+WARP_FEDERATION_DENYLIST=
+WARP_FEDERATION_TRUSTED_KEY_SERVERS=
+# Default 24h.
+WARP_FEDERATION_KEY_VALIDITY_PERIOD=
+# A second, TLS listener for federation, e.g. :8448, with its certificate
+# and key (paths inside the container). Publish the port yourself.
+WARP_LISTEN_FEDERATION_ADDRESS=
+WARP_TLS_CERT_FILE=
+WARP_TLS_KEY_FILE=
+WARP_FEDERATION_TLS_CA_FILE=
+
+# HTTP server. Defaults 10s, 60s, 120s, 120s, 1048576, 30s.
+WARP_READ_HEADER_TIMEOUT=
+WARP_READ_TIMEOUT=
+WARP_WRITE_TIMEOUT=
+WARP_IDLE_TIMEOUT=
+WARP_MAX_HEADER_BYTES=
+WARP_SHUTDOWN_TIMEOUT=
+
+# Apply pending database migrations at startup. Default true.
+WARP_DB_AUTO_MIGRATE=
+
+# Client API. Defaults *, false, 0s (never expire), 0s, true.
+WARP_CORS_ALLOWED_ORIGINS=
+WARP_TRUST_X_FORWARDED_FOR=
+WARP_ACCESS_TOKEN_LIFETIME=
+WARP_REFRESH_TOKEN_LIFETIME=
+WARP_RATE_LIMIT_ENABLED=
+
+# Calls: the LiveKit JWT service's URL (see docs/calls.md). Default empty.
+WARP_RTC_LIVEKIT_SERVICE_URL=
+# Delayed events. Defaults 24h, 100.
+WARP_DELAYED_EVENTS_MAX_DELAY=
+WARP_DELAYED_EVENTS_MAX_PER_USER=
+# TURN for legacy 1:1 calls: comma-separated URIs, then a shared secret or
+# a static username and password. Lifetime default 1h.
+WARP_TURN_URIS=
+WARP_TURN_SHARED_SECRET=
+WARP_TURN_USER_LIFETIME=
+WARP_TURN_USERNAME=
+WARP_TURN_PASSWORD=
+
+# Sync. Defaults false, 30s, 30s.
+WARP_SYNC_PRESENCE=
+WARP_SYNC_TYPING_TIMEOUT=
+WARP_SYNC_LONG_POLL_TIMEOUT=
+
+# Media. Defaults 52428800 (50 MiB), 0 (no limit), 32000000, 24h, 10, false.
+WARP_MEDIA_MAX_UPLOAD_BYTES=
+WARP_MEDIA_MAX_USER_STORAGE_BYTES=
+WARP_MEDIA_MAX_THUMBNAIL_PIXELS=
+WARP_MEDIA_PENDING_UPLOAD_EXPIRY=
+WARP_MEDIA_MAX_PENDING_UPLOADS=
+WARP_MEDIA_LEGACY_UNAUTHENTICATED_DOWNLOADS=
+
+# Push. Defaults true, true, 10s, 720h.
+WARP_PUSH_ENABLED=
+WARP_PUSH_INCLUDE_CONTENT=
+WARP_PUSH_GATEWAY_TIMEOUT=
+WARP_PUSH_NOTIFICATION_RETENTION=
+
+# Application services: comma-separated registration files (paths inside
+# the container). Timeout default 30s.
+WARP_APPSERVICE_CONFIG_FILES=
+WARP_APPSERVICE_TIMEOUT=
+
+# Server notices. Defaults false, server-notices, Server Notices, Server
+# Notices.
+WARP_SERVER_NOTICES_ENABLED=
+WARP_SERVER_NOTICES_LOCALPART=
+WARP_SERVER_NOTICES_DISPLAY_NAME=
+WARP_SERVER_NOTICES_ROOM_NAME=
+
+# Logging: debug, info, warn or error; text or json; file and line.
+WARP_LOG_LEVEL=info
+WARP_LOG_FORMAT=json
+WARP_LOG_ADD_SOURCE=
+
+# Metrics. Defaults true, /metrics.
+WARP_METRICS_ENABLED=
+WARP_METRICS_PATH=
+
+# OpenTelemetry tracing. Defaults false, localhost:4318, 1, warp.
+WARP_TRACING_ENABLED=false
+WARP_TRACING_ENDPOINT=
+WARP_TRACING_SAMPLE_RATIO=
+WARP_TRACING_SERVICE_NAME=
+
+
+# ----------------------------------------------------------- admin panel
+
+# text or json.
+WARP_ADMIN_LOG_FORMAT=json
+
+# ------------------------------------------------------------ web client
+
+# The homeserver's public URL. Set, the browser talks to it directly and
+# the web client proxies nothing; empty, it proxies the client API.
+WARP_WEB_PUBLIC_HOMESERVER=
+# Space-separated origins of the LiveKit JWT service and SFU, for calls.
+WARP_WEB_CALL_ORIGINS=
+# text or json.
+WARP_WEB_LOG_FORMAT=json
diff --git a/Docker/.env.pocketbase.s3.prod.example b/Docker/.env.pocketbase.s3.prod.example
new file mode 100644
index 0000000..ea0b965
--- /dev/null
+++ b/Docker/.env.pocketbase.s3.prod.example
@@ -0,0 +1,177 @@
+# Settings for docker-compose.pocketbase.s3.prod.yml:
+# the homeserver on PocketBase with media in an S3 bucket elsewhere, the
+# admin panel and the web client, each in its own container.
+#
+#   cp .env.pocketbase.s3.prod.example .env      # then edit it
+#   docker compose -f docker-compose.pocketbase.s3.prod.yml up -d
+#
+# Required, with no default: WARP_PB_S3_ENDPOINT, WARP_PB_S3_ACCESS_KEY
+# and WARP_PB_S3_SECRET.
+#
+# Compose reads .env for the values it puts into the compose file, and hands
+# all of it to the containers, so a change takes effect on the next `up -d`.
+# An empty value means the built-in default, given in the comment above it;
+# every homeserver setting is described in docs/configuration.md.
+#
+# Set by the compose file, not here: the database driver and connection
+# string, and the address the admin panel and web client reach the
+# homeserver on.
+
+# ---------------------------------------------------------------- compose
+
+# Host ports for the homeserver, the admin panel and the web client.
+WARP_PORT=8008
+WARP_ADMIN_PORT=8009
+WARP_WEB_PORT=8080
+
+# The images are pulled from $WARP_REGISTRY/warp, warp-admin and warp-web
+# at this tag. Pin a release in production.
+WARP_REGISTRY=ghcr.io/dariuszjaniak
+WARP_VERSION=latest
+
+# ------------------------------------------------------------- media (S3)
+
+# Media goes to this bucket; the database stays in /data/pb_data. The bucket
+# must already exist: nothing here runs a gateway or creates it. For a
+# gateway on the Docker host, use http://host.docker.internal:8333. Media
+# stored before S3 was on is not moved into the bucket.
+WARP_PB_S3_ENDPOINT=
+WARP_PB_S3_BUCKET=warp
+WARP_PB_S3_ACCESS_KEY=
+WARP_PB_S3_SECRET=
+# SeaweedFS and MinIO ignore the region; the client insists on one.
+WARP_PB_S3_REGION=us-east-1
+# true for SeaweedFS and MinIO, false for AWS S3 proper.
+WARP_PB_S3_FORCE_PATH_STYLE=true
+
+# ------------------------------------------------------------ homeserver
+
+# Part of every user and room ID: it cannot be changed later.
+WARP_SERVER_NAME=matrix.example.org
+
+# The URL clients are told to use, in /.well-known/matrix/client.
+# Default https://<server name>.
+WARP_WELL_KNOWN_CLIENT_BASE_URL=https://matrix.example.org
+# Default empty.
+WARP_WELL_KNOWN_IDENTITY_SERVER_BASE_URL=
+# host:port other homeservers should use. Default empty: no delegation.
+WARP_WELL_KNOWN_SERVER_ADDRESS=
+
+# Registration. Default false; the admin API can switch it at runtime.
+WARP_REGISTRATION_ENABLED=false
+# Default true.
+WARP_REGISTRATION_ALLOW_RUNTIME_TOGGLE=
+# Comma-separated sign-up tokens. Default none.
+WARP_REGISTRATION_TOKENS=
+# Default false.
+WARP_REGISTRATION_REQUIRE_TOKEN=
+
+# Federation. Default false.
+WARP_FEDERATION_ENABLED=false
+# Default true.
+WARP_FEDERATION_ALLOW_RUNTIME_TOGGLE=
+# Comma-separated server names. Default none.
+WARP_FEDERATION_ALLOWLIST=
+WARP_FEDERATION_DENYLIST=
+WARP_FEDERATION_TRUSTED_KEY_SERVERS=
+# Default 24h.
+WARP_FEDERATION_KEY_VALIDITY_PERIOD=
+# A second, TLS listener for federation, e.g. :8448, with its certificate
+# and key (paths inside the container). Publish the port yourself.
+WARP_LISTEN_FEDERATION_ADDRESS=
+WARP_TLS_CERT_FILE=
+WARP_TLS_KEY_FILE=
+WARP_FEDERATION_TLS_CA_FILE=
+
+# HTTP server. Defaults 10s, 60s, 120s, 120s, 1048576, 30s.
+WARP_READ_HEADER_TIMEOUT=
+WARP_READ_TIMEOUT=
+WARP_WRITE_TIMEOUT=
+WARP_IDLE_TIMEOUT=
+WARP_MAX_HEADER_BYTES=
+WARP_SHUTDOWN_TIMEOUT=
+
+# Apply pending database migrations at startup. Default true.
+WARP_DB_AUTO_MIGRATE=
+
+# Client API. Defaults *, false, 0s (never expire), 0s, true.
+WARP_CORS_ALLOWED_ORIGINS=
+WARP_TRUST_X_FORWARDED_FOR=
+WARP_ACCESS_TOKEN_LIFETIME=
+WARP_REFRESH_TOKEN_LIFETIME=
+WARP_RATE_LIMIT_ENABLED=
+
+# Calls: the LiveKit JWT service's URL (see docs/calls.md). Default empty.
+WARP_RTC_LIVEKIT_SERVICE_URL=
+# Delayed events. Defaults 24h, 100.
+WARP_DELAYED_EVENTS_MAX_DELAY=
+WARP_DELAYED_EVENTS_MAX_PER_USER=
+# TURN for legacy 1:1 calls: comma-separated URIs, then a shared secret or
+# a static username and password. Lifetime default 1h.
+WARP_TURN_URIS=
+WARP_TURN_SHARED_SECRET=
+WARP_TURN_USER_LIFETIME=
+WARP_TURN_USERNAME=
+WARP_TURN_PASSWORD=
+
+# Sync. Defaults false, 30s, 30s.
+WARP_SYNC_PRESENCE=
+WARP_SYNC_TYPING_TIMEOUT=
+WARP_SYNC_LONG_POLL_TIMEOUT=
+
+# Media. Defaults 52428800 (50 MiB), 0 (no limit), 32000000, 24h, 10, false.
+WARP_MEDIA_MAX_UPLOAD_BYTES=
+WARP_MEDIA_MAX_USER_STORAGE_BYTES=
+WARP_MEDIA_MAX_THUMBNAIL_PIXELS=
+WARP_MEDIA_PENDING_UPLOAD_EXPIRY=
+WARP_MEDIA_MAX_PENDING_UPLOADS=
+WARP_MEDIA_LEGACY_UNAUTHENTICATED_DOWNLOADS=
+
+# Push. Defaults true, true, 10s, 720h.
+WARP_PUSH_ENABLED=
+WARP_PUSH_INCLUDE_CONTENT=
+WARP_PUSH_GATEWAY_TIMEOUT=
+WARP_PUSH_NOTIFICATION_RETENTION=
+
+# Application services: comma-separated registration files (paths inside
+# the container). Timeout default 30s.
+WARP_APPSERVICE_CONFIG_FILES=
+WARP_APPSERVICE_TIMEOUT=
+
+# Server notices. Defaults false, server-notices, Server Notices, Server
+# Notices.
+WARP_SERVER_NOTICES_ENABLED=
+WARP_SERVER_NOTICES_LOCALPART=
+WARP_SERVER_NOTICES_DISPLAY_NAME=
+WARP_SERVER_NOTICES_ROOM_NAME=
+
+# Logging: debug, info, warn or error; text or json; file and line.
+WARP_LOG_LEVEL=info
+WARP_LOG_FORMAT=json
+WARP_LOG_ADD_SOURCE=
+
+# Metrics. Defaults true, /metrics.
+WARP_METRICS_ENABLED=
+WARP_METRICS_PATH=
+
+# OpenTelemetry tracing. Defaults false, localhost:4318, 1, warp.
+WARP_TRACING_ENABLED=false
+WARP_TRACING_ENDPOINT=
+WARP_TRACING_SAMPLE_RATIO=
+WARP_TRACING_SERVICE_NAME=
+
+
+# ----------------------------------------------------------- admin panel
+
+# text or json.
+WARP_ADMIN_LOG_FORMAT=json
+
+# ------------------------------------------------------------ web client
+
+# The homeserver's public URL. Set, the browser talks to it directly and
+# the web client proxies nothing; empty, it proxies the client API.
+WARP_WEB_PUBLIC_HOMESERVER=
+# Space-separated origins of the LiveKit JWT service and SFU, for calls.
+WARP_WEB_CALL_ORIGINS=
+# text or json.
+WARP_WEB_LOG_FORMAT=json
diff --git a/Docker/.env.pocketbase.seaweedfs.example b/Docker/.env.pocketbase.seaweedfs.example
new file mode 100644
index 0000000..58dd22c
--- /dev/null
+++ b/Docker/.env.pocketbase.seaweedfs.example
@@ -0,0 +1,176 @@
+# Settings for docker-compose.pocketbase.seaweedfs.yml:
+# the homeserver on PocketBase, the admin panel and the web client, with
+# media in SeaweedFS in a container of its own.
+#
+#   cp .env.pocketbase.seaweedfs.example .env      # then edit it
+#   docker compose -f docker-compose.pocketbase.seaweedfs.yml up -d --build
+#
+# Required, with no default: WARP_PB_S3_ACCESS_KEY and WARP_PB_S3_SECRET.
+#
+# Compose reads .env for the values it puts into the compose file, and hands
+# all of it to the containers, so a change takes effect on the next `up -d`.
+# An empty value means the built-in default, given in the comment above it;
+# every homeserver setting is described in docs/configuration.md.
+#
+# Set by the compose file, not here: the database driver and connection
+# string, and the address the admin panel and web client reach the
+# homeserver on.
+
+# ---------------------------------------------------------------- compose
+
+# Host ports for the homeserver, the admin panel and the web client.
+WARP_PORT=8008
+WARP_ADMIN_PORT=8009
+WARP_WEB_PORT=8080
+
+# -------------------------------------------------------------- seaweedfs
+
+# Media goes to this bucket in SeaweedFS, created on start; the database
+# stays in /data/pb_data. The key pair is the homeserver's S3 identity:
+# the gateway's only one, and what the homeserver signs with.
+# Media stored before S3 was on is not moved into the bucket.
+WARP_PB_S3_BUCKET=warp
+WARP_PB_S3_ACCESS_KEY=
+WARP_PB_S3_SECRET=
+
+# The SeaweedFS image every SeaweedFS container runs. Pin it: the data
+# volume outlives the image.
+SEAWEED_IMAGE=chrislusf/seaweedfs:4.45
+
+# The S3 gateway's host port, on loopback unless the bind address says
+# otherwise. The homeserver does not need it; it is for aws-cli and the
+# like.
+SEAWEED_S3_BIND=127.0.0.1
+SEAWEED_S3_PORT=8333
+
+# ------------------------------------------------------------ homeserver
+
+# Part of every user and room ID: it cannot be changed later.
+WARP_SERVER_NAME=localhost
+
+# The URL clients are told to use, in /.well-known/matrix/client.
+# Default https://<server name>.
+WARP_WELL_KNOWN_CLIENT_BASE_URL=http://localhost:8008
+# Default empty.
+WARP_WELL_KNOWN_IDENTITY_SERVER_BASE_URL=
+# host:port other homeservers should use. Default empty: no delegation.
+WARP_WELL_KNOWN_SERVER_ADDRESS=
+
+# Registration. Default false; the admin API can switch it at runtime.
+WARP_REGISTRATION_ENABLED=false
+# Default true.
+WARP_REGISTRATION_ALLOW_RUNTIME_TOGGLE=
+# Comma-separated sign-up tokens. Default none.
+WARP_REGISTRATION_TOKENS=
+# Default false.
+WARP_REGISTRATION_REQUIRE_TOKEN=
+
+# Federation. Default false.
+WARP_FEDERATION_ENABLED=false
+# Default true.
+WARP_FEDERATION_ALLOW_RUNTIME_TOGGLE=
+# Comma-separated server names. Default none.
+WARP_FEDERATION_ALLOWLIST=
+WARP_FEDERATION_DENYLIST=
+WARP_FEDERATION_TRUSTED_KEY_SERVERS=
+# Default 24h.
+WARP_FEDERATION_KEY_VALIDITY_PERIOD=
+# A second, TLS listener for federation, e.g. :8448, with its certificate
+# and key (paths inside the container). Publish the port yourself.
+WARP_LISTEN_FEDERATION_ADDRESS=
+WARP_TLS_CERT_FILE=
+WARP_TLS_KEY_FILE=
+WARP_FEDERATION_TLS_CA_FILE=
+
+# HTTP server. Defaults 10s, 60s, 120s, 120s, 1048576, 30s.
+WARP_READ_HEADER_TIMEOUT=
+WARP_READ_TIMEOUT=
+WARP_WRITE_TIMEOUT=
+WARP_IDLE_TIMEOUT=
+WARP_MAX_HEADER_BYTES=
+WARP_SHUTDOWN_TIMEOUT=
+
+# Apply pending database migrations at startup. Default true.
+WARP_DB_AUTO_MIGRATE=
+
+# Client API. Defaults *, false, 0s (never expire), 0s, true.
+WARP_CORS_ALLOWED_ORIGINS=
+WARP_TRUST_X_FORWARDED_FOR=
+WARP_ACCESS_TOKEN_LIFETIME=
+WARP_REFRESH_TOKEN_LIFETIME=
+WARP_RATE_LIMIT_ENABLED=
+
+# Calls: the LiveKit JWT service's URL (see docs/calls.md). Default empty.
+WARP_RTC_LIVEKIT_SERVICE_URL=
+# Delayed events. Defaults 24h, 100.
+WARP_DELAYED_EVENTS_MAX_DELAY=
+WARP_DELAYED_EVENTS_MAX_PER_USER=
+# TURN for legacy 1:1 calls: comma-separated URIs, then a shared secret or
+# a static username and password. Lifetime default 1h.
+WARP_TURN_URIS=
+WARP_TURN_SHARED_SECRET=
+WARP_TURN_USER_LIFETIME=
+WARP_TURN_USERNAME=
+WARP_TURN_PASSWORD=
+
+# Sync. Defaults false, 30s, 30s.
+WARP_SYNC_PRESENCE=
+WARP_SYNC_TYPING_TIMEOUT=
+WARP_SYNC_LONG_POLL_TIMEOUT=
+
+# Media. Defaults 52428800 (50 MiB), 0 (no limit), 32000000, 24h, 10, false.
+WARP_MEDIA_MAX_UPLOAD_BYTES=
+WARP_MEDIA_MAX_USER_STORAGE_BYTES=
+WARP_MEDIA_MAX_THUMBNAIL_PIXELS=
+WARP_MEDIA_PENDING_UPLOAD_EXPIRY=
+WARP_MEDIA_MAX_PENDING_UPLOADS=
+WARP_MEDIA_LEGACY_UNAUTHENTICATED_DOWNLOADS=
+
+# Push. Defaults true, true, 10s, 720h.
+WARP_PUSH_ENABLED=
+WARP_PUSH_INCLUDE_CONTENT=
+WARP_PUSH_GATEWAY_TIMEOUT=
+WARP_PUSH_NOTIFICATION_RETENTION=
+
+# Application services: comma-separated registration files (paths inside
+# the container). Timeout default 30s.
+WARP_APPSERVICE_CONFIG_FILES=
+WARP_APPSERVICE_TIMEOUT=
+
+# Server notices. Defaults false, server-notices, Server Notices, Server
+# Notices.
+WARP_SERVER_NOTICES_ENABLED=
+WARP_SERVER_NOTICES_LOCALPART=
+WARP_SERVER_NOTICES_DISPLAY_NAME=
+WARP_SERVER_NOTICES_ROOM_NAME=
+
+# Logging: debug, info, warn or error; text or json; file and line.
+WARP_LOG_LEVEL=info
+WARP_LOG_FORMAT=json
+WARP_LOG_ADD_SOURCE=
+
+# Metrics. Defaults true, /metrics.
+WARP_METRICS_ENABLED=
+WARP_METRICS_PATH=
+
+# OpenTelemetry tracing. Defaults false, localhost:4318, 1, warp.
+WARP_TRACING_ENABLED=false
+WARP_TRACING_ENDPOINT=
+WARP_TRACING_SAMPLE_RATIO=
+WARP_TRACING_SERVICE_NAME=
+
+
+# ----------------------------------------------------------- admin panel
+
+# text or json.
+WARP_ADMIN_LOG_FORMAT=json
+
+# ------------------------------------------------------------ web client
+
+# The homeserver's public URL. Set, the browser talks to it directly and
+# the web client proxies nothing; empty, it proxies the client API.
+WARP_WEB_PUBLIC_HOMESERVER=
+# Space-separated origins of the LiveKit JWT service and SFU, for calls.
+WARP_WEB_CALL_ORIGINS=
+# text or json.
+WARP_WEB_LOG_FORMAT=json
diff --git a/Docker/.env.pocketbase.seaweedfs.prod.example b/Docker/.env.pocketbase.seaweedfs.prod.example
new file mode 100644
index 0000000..4eb2dd8
--- /dev/null
+++ b/Docker/.env.pocketbase.seaweedfs.prod.example
@@ -0,0 +1,181 @@
+# Settings for docker-compose.pocketbase.seaweedfs.prod.yml:
+# the homeserver on PocketBase, the admin panel and the web client, with
+# media in SeaweedFS in a container of its own.
+#
+#   cp .env.pocketbase.seaweedfs.prod.example .env      # then edit it
+#   docker compose -f docker-compose.pocketbase.seaweedfs.prod.yml up -d
+#
+# Required, with no default: WARP_PB_S3_ACCESS_KEY and WARP_PB_S3_SECRET.
+#
+# Compose reads .env for the values it puts into the compose file, and hands
+# all of it to the containers, so a change takes effect on the next `up -d`.
+# An empty value means the built-in default, given in the comment above it;
+# every homeserver setting is described in docs/configuration.md.
+#
+# Set by the compose file, not here: the database driver and connection
+# string, and the address the admin panel and web client reach the
+# homeserver on.
+
+# ---------------------------------------------------------------- compose
+
+# Host ports for the homeserver, the admin panel and the web client.
+WARP_PORT=8008
+WARP_ADMIN_PORT=8009
+WARP_WEB_PORT=8080
+
+# The images are pulled from $WARP_REGISTRY/warp, warp-admin and warp-web
+# at this tag. Pin a release in production.
+WARP_REGISTRY=ghcr.io/dariuszjaniak
+WARP_VERSION=latest
+
+# -------------------------------------------------------------- seaweedfs
+
+# Media goes to this bucket in SeaweedFS, created on start; the database
+# stays in /data/pb_data. The key pair is the homeserver's S3 identity:
+# the gateway's only one, and what the homeserver signs with.
+# Media stored before S3 was on is not moved into the bucket.
+WARP_PB_S3_BUCKET=warp
+WARP_PB_S3_ACCESS_KEY=
+WARP_PB_S3_SECRET=
+
+# The SeaweedFS image every SeaweedFS container runs. Pin it: the data
+# volume outlives the image.
+SEAWEED_IMAGE=chrislusf/seaweedfs:4.45
+
+# The S3 gateway's host port, on loopback unless the bind address says
+# otherwise. The homeserver does not need it; it is for aws-cli and the
+# like.
+SEAWEED_S3_BIND=127.0.0.1
+SEAWEED_S3_PORT=8333
+
+# ------------------------------------------------------------ homeserver
+
+# Part of every user and room ID: it cannot be changed later.
+WARP_SERVER_NAME=matrix.example.org
+
+# The URL clients are told to use, in /.well-known/matrix/client.
+# Default https://<server name>.
+WARP_WELL_KNOWN_CLIENT_BASE_URL=https://matrix.example.org
+# Default empty.
+WARP_WELL_KNOWN_IDENTITY_SERVER_BASE_URL=
+# host:port other homeservers should use. Default empty: no delegation.
+WARP_WELL_KNOWN_SERVER_ADDRESS=
+
+# Registration. Default false; the admin API can switch it at runtime.
+WARP_REGISTRATION_ENABLED=false
+# Default true.
+WARP_REGISTRATION_ALLOW_RUNTIME_TOGGLE=
+# Comma-separated sign-up tokens. Default none.
+WARP_REGISTRATION_TOKENS=
+# Default false.
+WARP_REGISTRATION_REQUIRE_TOKEN=
+
+# Federation. Default false.
+WARP_FEDERATION_ENABLED=false
+# Default true.
+WARP_FEDERATION_ALLOW_RUNTIME_TOGGLE=
+# Comma-separated server names. Default none.
+WARP_FEDERATION_ALLOWLIST=
+WARP_FEDERATION_DENYLIST=
+WARP_FEDERATION_TRUSTED_KEY_SERVERS=
+# Default 24h.
+WARP_FEDERATION_KEY_VALIDITY_PERIOD=
+# A second, TLS listener for federation, e.g. :8448, with its certificate
+# and key (paths inside the container). Publish the port yourself.
+WARP_LISTEN_FEDERATION_ADDRESS=
+WARP_TLS_CERT_FILE=
+WARP_TLS_KEY_FILE=
+WARP_FEDERATION_TLS_CA_FILE=
+
+# HTTP server. Defaults 10s, 60s, 120s, 120s, 1048576, 30s.
+WARP_READ_HEADER_TIMEOUT=
+WARP_READ_TIMEOUT=
+WARP_WRITE_TIMEOUT=
+WARP_IDLE_TIMEOUT=
+WARP_MAX_HEADER_BYTES=
+WARP_SHUTDOWN_TIMEOUT=
+
+# Apply pending database migrations at startup. Default true.
+WARP_DB_AUTO_MIGRATE=
+
+# Client API. Defaults *, false, 0s (never expire), 0s, true.
+WARP_CORS_ALLOWED_ORIGINS=
+WARP_TRUST_X_FORWARDED_FOR=
+WARP_ACCESS_TOKEN_LIFETIME=
+WARP_REFRESH_TOKEN_LIFETIME=
+WARP_RATE_LIMIT_ENABLED=
+
+# Calls: the LiveKit JWT service's URL (see docs/calls.md). Default empty.
+WARP_RTC_LIVEKIT_SERVICE_URL=
+# Delayed events. Defaults 24h, 100.
+WARP_DELAYED_EVENTS_MAX_DELAY=
+WARP_DELAYED_EVENTS_MAX_PER_USER=
+# TURN for legacy 1:1 calls: comma-separated URIs, then a shared secret or
+# a static username and password. Lifetime default 1h.
+WARP_TURN_URIS=
+WARP_TURN_SHARED_SECRET=
+WARP_TURN_USER_LIFETIME=
+WARP_TURN_USERNAME=
+WARP_TURN_PASSWORD=
+
+# Sync. Defaults false, 30s, 30s.
+WARP_SYNC_PRESENCE=
+WARP_SYNC_TYPING_TIMEOUT=
+WARP_SYNC_LONG_POLL_TIMEOUT=
+
+# Media. Defaults 52428800 (50 MiB), 0 (no limit), 32000000, 24h, 10, false.
+WARP_MEDIA_MAX_UPLOAD_BYTES=
+WARP_MEDIA_MAX_USER_STORAGE_BYTES=
+WARP_MEDIA_MAX_THUMBNAIL_PIXELS=
+WARP_MEDIA_PENDING_UPLOAD_EXPIRY=
+WARP_MEDIA_MAX_PENDING_UPLOADS=
+WARP_MEDIA_LEGACY_UNAUTHENTICATED_DOWNLOADS=
+
+# Push. Defaults true, true, 10s, 720h.
+WARP_PUSH_ENABLED=
+WARP_PUSH_INCLUDE_CONTENT=
+WARP_PUSH_GATEWAY_TIMEOUT=
+WARP_PUSH_NOTIFICATION_RETENTION=
+
+# Application services: comma-separated registration files (paths inside
+# the container). Timeout default 30s.
+WARP_APPSERVICE_CONFIG_FILES=
+WARP_APPSERVICE_TIMEOUT=
+
+# Server notices. Defaults false, server-notices, Server Notices, Server
+# Notices.
+WARP_SERVER_NOTICES_ENABLED=
+WARP_SERVER_NOTICES_LOCALPART=
+WARP_SERVER_NOTICES_DISPLAY_NAME=
+WARP_SERVER_NOTICES_ROOM_NAME=
+
+# Logging: debug, info, warn or error; text or json; file and line.
+WARP_LOG_LEVEL=info
+WARP_LOG_FORMAT=json
+WARP_LOG_ADD_SOURCE=
+
+# Metrics. Defaults true, /metrics.
+WARP_METRICS_ENABLED=
+WARP_METRICS_PATH=
+
+# OpenTelemetry tracing. Defaults false, localhost:4318, 1, warp.
+WARP_TRACING_ENABLED=false
+WARP_TRACING_ENDPOINT=
+WARP_TRACING_SAMPLE_RATIO=
+WARP_TRACING_SERVICE_NAME=
+
+
+# ----------------------------------------------------------- admin panel
+
+# text or json.
+WARP_ADMIN_LOG_FORMAT=json
+
+# ------------------------------------------------------------ web client
+
+# The homeserver's public URL. Set, the browser talks to it directly and
+# the web client proxies nothing; empty, it proxies the client API.
+WARP_WEB_PUBLIC_HOMESERVER=
+# Space-separated origins of the LiveKit JWT service and SFU, for calls.
+WARP_WEB_CALL_ORIGINS=
+# text or json.
+WARP_WEB_LOG_FORMAT=json
diff --git a/Docker/.env.example b/Docker/.env.pocketbase.seaweedfs.split.example
similarity index 65%
rename from Docker/.env.example
rename to Docker/.env.pocketbase.seaweedfs.split.example
index ef40f9e..8dc8373 100644
--- a/Docker/.env.example
+++ b/Docker/.env.pocketbase.seaweedfs.split.example
@@ -1,18 +1,21 @@
-# Settings for every compose file in this folder.
+# Settings for docker-compose.pocketbase.seaweedfs.split.yml:
+# the homeserver on PocketBase, the admin panel and the web client, with
+# media in SeaweedFS split into a container per role.
 #
-#   cp .env.example .env
+#   cp .env.pocketbase.seaweedfs.split.example .env      # then edit it
+#   docker compose -f docker-compose.pocketbase.seaweedfs.split.yml up -d --build
 #
-# then edit .env. Compose reads it for the ports, the registry and the
-# PostgreSQL password, and hands all of it to the containers, so anything
-# below takes effect on the next `docker compose ... up -d`.
+# Required, with no default: WARP_PB_S3_ACCESS_KEY, WARP_PB_S3_SECRET and
+# SEAWEED_ADMIN_PASSWORD.
 #
-# An empty value means the built-in default, given in the comment above it.
-# Every homeserver setting is described in docs/configuration.md.
+# Compose reads .env for the values it puts into the compose file, and hands
+# all of it to the containers, so a change takes effect on the next `up -d`.
+# An empty value means the built-in default, given in the comment above it;
+# every homeserver setting is described in docs/configuration.md.
 #
-# Set by the compose files, not here: the database driver and connection
-# string (each file is one database), the listen addresses, the signing key
-# and media paths inside /data, and the address the admin panel and web
-# client reach the homeserver on.
+# Set by the compose file, not here: the database driver and connection
+# string, and the address the admin panel and web client reach the
+# homeserver on.
 
 # ---------------------------------------------------------------- compose
 
@@ -21,34 +24,30 @@ WARP_PORT=8008
 WARP_ADMIN_PORT=8009
 WARP_WEB_PORT=8080
 
-# The *.prod.yml files pull $WARP_REGISTRY/warp, warp-admin and warp-web at
-# this tag. Pin a release in production.
-WARP_REGISTRY=ghcr.io/dariuszjaniak
-WARP_VERSION=latest
+# -------------------------------------------------------------- seaweedfs
 
-# docker-compose.postgresql*.yml only. Used when PostgreSQL is first set up;
-# changing it later does not change the database's password. The prod file
-# refuses to start without it.
-WARP_POSTGRES_PASSWORD=change-me
+# Media goes to this bucket in SeaweedFS, created on start; the database
+# stays in /data/pb_data. The key pair is the homeserver's S3 identity:
+# written into the filer's IAM store on every start, beside any identity
+# added in the admin UI, so a new secret here lands on the next start.
+# Media stored before S3 was on is not moved into the bucket.
+WARP_PB_S3_BUCKET=warp
+WARP_PB_S3_ACCESS_KEY=
+WARP_PB_S3_SECRET=
 
-# ------------------------------------------------------------- seaweedfs
-
-# docker-compose.pocketbase.seaweedfs*.yml only; set WARP_PB_S3_ACCESS_KEY
-# and WARP_PB_S3_SECRET below as well.
-#
 # The SeaweedFS image every SeaweedFS container runs. Pin it: the data
 # volume outlives the image.
 SEAWEED_IMAGE=chrislusf/seaweedfs:4.45
 
 # The S3 gateway's host port, on loopback unless the bind address says
-# otherwise. The homeserver reaches it over the compose network; this is
-# for aws-cli and the like.
+# otherwise. The homeserver does not need it; it is for aws-cli and the
+# like.
 SEAWEED_S3_BIND=127.0.0.1
 SEAWEED_S3_PORT=8333
 
-# The split file only: SeaweedFS's admin UI. It can mint credentials for
-# the bucket, so the password is required. Put it behind a reverse proxy
-# before binding it to 0.0.0.0. The read-only login is optional.
+# SeaweedFS's admin UI. It can mint credentials for the bucket, so the
+# password is required. Put it behind a reverse proxy before binding it
+# to 0.0.0.0. The read-only login is optional.
 SEAWEED_ADMIN_BIND=127.0.0.1
 SEAWEED_ADMIN_PORT=23646
 SEAWEED_ADMIN_USER=admin
@@ -103,33 +102,9 @@ WARP_IDLE_TIMEOUT=
 WARP_MAX_HEADER_BYTES=
 WARP_SHUTDOWN_TIMEOUT=
 
-# Database pool (PostgreSQL). Defaults 10, 5, 1h, true.
-WARP_DB_MAX_OPEN_CONNS=
-WARP_DB_MAX_IDLE_CONNS=
-WARP_DB_CONN_MAX_LIFETIME=
+# Apply pending database migrations at startup. Default true.
 WARP_DB_AUTO_MIGRATE=
 
-# docker-compose.pocketbase*.yml only: keep media in an S3 bucket instead
-# of pb_data/storage. Bucket, region, endpoint and keys are all required
-# when it is on.
-#
-# The pocketbase.seaweedfs files turn it on themselves, against their own
-# SeaweedFS; there only the access key and secret are needed (required:
-# they are the gateway's credentials too), and the bucket defaults to warp.
-#
-# The pocketbase.s3 files turn it on against a bucket elsewhere: the
-# endpoint, access key and secret are required, the bucket (default warp)
-# must exist, the region defaults to us-east-1 and path style to true
-# (SeaweedFS, MinIO; set false for AWS S3). For a gateway on the Docker
-# host, use http://host.docker.internal:8333.
-WARP_PB_S3_ENABLED=false
-WARP_PB_S3_BUCKET=
-WARP_PB_S3_REGION=
-WARP_PB_S3_ENDPOINT=
-WARP_PB_S3_ACCESS_KEY=
-WARP_PB_S3_SECRET=
-WARP_PB_S3_FORCE_PATH_STYLE=
-
 # Client API. Defaults *, false, 0s (never expire), 0s, true.
 WARP_CORS_ALLOWED_ORIGINS=
 WARP_TRUST_X_FORWARDED_FOR=
@@ -196,6 +171,7 @@ WARP_TRACING_ENDPOINT=
 WARP_TRACING_SAMPLE_RATIO=
 WARP_TRACING_SERVICE_NAME=
 
+
 # ----------------------------------------------------------- admin panel
 
 # text or json.
diff --git a/Docker/.env.pocketbase.seaweedfs.split.prod.example b/Docker/.env.pocketbase.seaweedfs.split.prod.example
new file mode 100644
index 0000000..1c4739b
--- /dev/null
+++ b/Docker/.env.pocketbase.seaweedfs.split.prod.example
@@ -0,0 +1,193 @@
+# Settings for docker-compose.pocketbase.seaweedfs.split.prod.yml:
+# the homeserver on PocketBase, the admin panel and the web client, with
+# media in SeaweedFS split into a container per role.
+#
+#   cp .env.pocketbase.seaweedfs.split.prod.example .env      # then edit it
+#   docker compose -f docker-compose.pocketbase.seaweedfs.split.prod.yml up -d
+#
+# Required, with no default: WARP_PB_S3_ACCESS_KEY, WARP_PB_S3_SECRET and
+# SEAWEED_ADMIN_PASSWORD.
+#
+# Compose reads .env for the values it puts into the compose file, and hands
+# all of it to the containers, so a change takes effect on the next `up -d`.
+# An empty value means the built-in default, given in the comment above it;
+# every homeserver setting is described in docs/configuration.md.
+#
+# Set by the compose file, not here: the database driver and connection
+# string, and the address the admin panel and web client reach the
+# homeserver on.
+
+# ---------------------------------------------------------------- compose
+
+# Host ports for the homeserver, the admin panel and the web client.
+WARP_PORT=8008
+WARP_ADMIN_PORT=8009
+WARP_WEB_PORT=8080
+
+# The images are pulled from $WARP_REGISTRY/warp, warp-admin and warp-web
+# at this tag. Pin a release in production.
+WARP_REGISTRY=ghcr.io/dariuszjaniak
+WARP_VERSION=latest
+
+# -------------------------------------------------------------- seaweedfs
+
+# Media goes to this bucket in SeaweedFS, created on start; the database
+# stays in /data/pb_data. The key pair is the homeserver's S3 identity:
+# written into the filer's IAM store on every start, beside any identity
+# added in the admin UI, so a new secret here lands on the next start.
+# Media stored before S3 was on is not moved into the bucket.
+WARP_PB_S3_BUCKET=warp
+WARP_PB_S3_ACCESS_KEY=
+WARP_PB_S3_SECRET=
+
+# The SeaweedFS image every SeaweedFS container runs. Pin it: the data
+# volume outlives the image.
+SEAWEED_IMAGE=chrislusf/seaweedfs:4.45
+
+# The S3 gateway's host port, on loopback unless the bind address says
+# otherwise. The homeserver does not need it; it is for aws-cli and the
+# like.
+SEAWEED_S3_BIND=127.0.0.1
+SEAWEED_S3_PORT=8333
+
+# SeaweedFS's admin UI. It can mint credentials for the bucket, so the
+# password is required. Put it behind a reverse proxy before binding it
+# to 0.0.0.0. The read-only login is optional.
+SEAWEED_ADMIN_BIND=127.0.0.1
+SEAWEED_ADMIN_PORT=23646
+SEAWEED_ADMIN_USER=admin
+SEAWEED_ADMIN_PASSWORD=
+SEAWEED_ADMIN_READONLY_USER=
+SEAWEED_ADMIN_READONLY_PASSWORD=
+
+# ------------------------------------------------------------ homeserver
+
+# Part of every user and room ID: it cannot be changed later.
+WARP_SERVER_NAME=matrix.example.org
+
+# The URL clients are told to use, in /.well-known/matrix/client.
+# Default https://<server name>.
+WARP_WELL_KNOWN_CLIENT_BASE_URL=https://matrix.example.org
+# Default empty.
+WARP_WELL_KNOWN_IDENTITY_SERVER_BASE_URL=
+# host:port other homeservers should use. Default empty: no delegation.
+WARP_WELL_KNOWN_SERVER_ADDRESS=
+
+# Registration. Default false; the admin API can switch it at runtime.
+WARP_REGISTRATION_ENABLED=false
+# Default true.
+WARP_REGISTRATION_ALLOW_RUNTIME_TOGGLE=
+# Comma-separated sign-up tokens. Default none.
+WARP_REGISTRATION_TOKENS=
+# Default false.
+WARP_REGISTRATION_REQUIRE_TOKEN=
+
+# Federation. Default false.
+WARP_FEDERATION_ENABLED=false
+# Default true.
+WARP_FEDERATION_ALLOW_RUNTIME_TOGGLE=
+# Comma-separated server names. Default none.
+WARP_FEDERATION_ALLOWLIST=
+WARP_FEDERATION_DENYLIST=
+WARP_FEDERATION_TRUSTED_KEY_SERVERS=
+# Default 24h.
+WARP_FEDERATION_KEY_VALIDITY_PERIOD=
+# A second, TLS listener for federation, e.g. :8448, with its certificate
+# and key (paths inside the container). Publish the port yourself.
+WARP_LISTEN_FEDERATION_ADDRESS=
+WARP_TLS_CERT_FILE=
+WARP_TLS_KEY_FILE=
+WARP_FEDERATION_TLS_CA_FILE=
+
+# HTTP server. Defaults 10s, 60s, 120s, 120s, 1048576, 30s.
+WARP_READ_HEADER_TIMEOUT=
+WARP_READ_TIMEOUT=
+WARP_WRITE_TIMEOUT=
+WARP_IDLE_TIMEOUT=
+WARP_MAX_HEADER_BYTES=
+WARP_SHUTDOWN_TIMEOUT=
+
+# Apply pending database migrations at startup. Default true.
+WARP_DB_AUTO_MIGRATE=
+
+# Client API. Defaults *, false, 0s (never expire), 0s, true.
+WARP_CORS_ALLOWED_ORIGINS=
+WARP_TRUST_X_FORWARDED_FOR=
+WARP_ACCESS_TOKEN_LIFETIME=
+WARP_REFRESH_TOKEN_LIFETIME=
+WARP_RATE_LIMIT_ENABLED=
+
+# Calls: the LiveKit JWT service's URL (see docs/calls.md). Default empty.
+WARP_RTC_LIVEKIT_SERVICE_URL=
+# Delayed events. Defaults 24h, 100.
+WARP_DELAYED_EVENTS_MAX_DELAY=
+WARP_DELAYED_EVENTS_MAX_PER_USER=
+# TURN for legacy 1:1 calls: comma-separated URIs, then a shared secret or
+# a static username and password. Lifetime default 1h.
+WARP_TURN_URIS=
+WARP_TURN_SHARED_SECRET=
+WARP_TURN_USER_LIFETIME=
+WARP_TURN_USERNAME=
+WARP_TURN_PASSWORD=
+
+# Sync. Defaults false, 30s, 30s.
+WARP_SYNC_PRESENCE=
+WARP_SYNC_TYPING_TIMEOUT=
+WARP_SYNC_LONG_POLL_TIMEOUT=
+
+# Media. Defaults 52428800 (50 MiB), 0 (no limit), 32000000, 24h, 10, false.
+WARP_MEDIA_MAX_UPLOAD_BYTES=
+WARP_MEDIA_MAX_USER_STORAGE_BYTES=
+WARP_MEDIA_MAX_THUMBNAIL_PIXELS=
+WARP_MEDIA_PENDING_UPLOAD_EXPIRY=
+WARP_MEDIA_MAX_PENDING_UPLOADS=
+WARP_MEDIA_LEGACY_UNAUTHENTICATED_DOWNLOADS=
+
+# Push. Defaults true, true, 10s, 720h.
+WARP_PUSH_ENABLED=
+WARP_PUSH_INCLUDE_CONTENT=
+WARP_PUSH_GATEWAY_TIMEOUT=
+WARP_PUSH_NOTIFICATION_RETENTION=
+
+# Application services: comma-separated registration files (paths inside
+# the container). Timeout default 30s.
+WARP_APPSERVICE_CONFIG_FILES=
+WARP_APPSERVICE_TIMEOUT=
+
+# Server notices. Defaults false, server-notices, Server Notices, Server
+# Notices.
+WARP_SERVER_NOTICES_ENABLED=
+WARP_SERVER_NOTICES_LOCALPART=
+WARP_SERVER_NOTICES_DISPLAY_NAME=
+WARP_SERVER_NOTICES_ROOM_NAME=
+
+# Logging: debug, info, warn or error; text or json; file and line.
+WARP_LOG_LEVEL=info
+WARP_LOG_FORMAT=json
+WARP_LOG_ADD_SOURCE=
+
+# Metrics. Defaults true, /metrics.
+WARP_METRICS_ENABLED=
+WARP_METRICS_PATH=
+
+# OpenTelemetry tracing. Defaults false, localhost:4318, 1, warp.
+WARP_TRACING_ENABLED=false
+WARP_TRACING_ENDPOINT=
+WARP_TRACING_SAMPLE_RATIO=
+WARP_TRACING_SERVICE_NAME=
+
+
+# ----------------------------------------------------------- admin panel
+
+# text or json.
+WARP_ADMIN_LOG_FORMAT=json
+
+# ------------------------------------------------------------ web client
+
+# The homeserver's public URL. Set, the browser talks to it directly and
+# the web client proxies nothing; empty, it proxies the client API.
+WARP_WEB_PUBLIC_HOMESERVER=
+# Space-separated origins of the LiveKit JWT service and SFU, for calls.
+WARP_WEB_CALL_ORIGINS=
+# text or json.
+WARP_WEB_LOG_FORMAT=json
diff --git a/Docker/.env.postgresql.example b/Docker/.env.postgresql.example
new file mode 100644
index 0000000..753f8ab
--- /dev/null
+++ b/Docker/.env.postgresql.example
@@ -0,0 +1,161 @@
+# Settings for docker-compose.postgresql.yml:
+# the homeserver on PostgreSQL, the admin panel, the web client and
+# PostgreSQL, each in its own container.
+#
+#   cp .env.postgresql.example .env      # then edit it
+#   docker compose -f docker-compose.postgresql.yml up -d --build
+#
+# Compose reads .env for the values it puts into the compose file, and hands
+# all of it to the containers, so a change takes effect on the next `up -d`.
+# An empty value means the built-in default, given in the comment above it;
+# every homeserver setting is described in docs/configuration.md.
+#
+# Set by the compose file, not here: the database driver and connection
+# string, and the address the admin panel and web client reach the
+# homeserver on.
+
+# ---------------------------------------------------------------- compose
+
+# Host ports for the homeserver, the admin panel and the web client.
+WARP_PORT=8008
+WARP_ADMIN_PORT=8009
+WARP_WEB_PORT=8080
+
+# PostgreSQL's password, used when its database is first set up; changing
+# it later does not change the database's password.
+WARP_POSTGRES_PASSWORD=change-me
+
+# ------------------------------------------------------------ homeserver
+
+# Part of every user and room ID: it cannot be changed later.
+WARP_SERVER_NAME=localhost
+
+# The URL clients are told to use, in /.well-known/matrix/client.
+# Default https://<server name>.
+WARP_WELL_KNOWN_CLIENT_BASE_URL=http://localhost:8008
+# Default empty.
+WARP_WELL_KNOWN_IDENTITY_SERVER_BASE_URL=
+# host:port other homeservers should use. Default empty: no delegation.
+WARP_WELL_KNOWN_SERVER_ADDRESS=
+
+# Registration. Default false; the admin API can switch it at runtime.
+WARP_REGISTRATION_ENABLED=false
+# Default true.
+WARP_REGISTRATION_ALLOW_RUNTIME_TOGGLE=
+# Comma-separated sign-up tokens. Default none.
+WARP_REGISTRATION_TOKENS=
+# Default false.
+WARP_REGISTRATION_REQUIRE_TOKEN=
+
+# Federation. Default false.
+WARP_FEDERATION_ENABLED=false
+# Default true.
+WARP_FEDERATION_ALLOW_RUNTIME_TOGGLE=
+# Comma-separated server names. Default none.
+WARP_FEDERATION_ALLOWLIST=
+WARP_FEDERATION_DENYLIST=
+WARP_FEDERATION_TRUSTED_KEY_SERVERS=
+# Default 24h.
+WARP_FEDERATION_KEY_VALIDITY_PERIOD=
+# A second, TLS listener for federation, e.g. :8448, with its certificate
+# and key (paths inside the container). Publish the port yourself.
+WARP_LISTEN_FEDERATION_ADDRESS=
+WARP_TLS_CERT_FILE=
+WARP_TLS_KEY_FILE=
+WARP_FEDERATION_TLS_CA_FILE=
+
+# HTTP server. Defaults 10s, 60s, 120s, 120s, 1048576, 30s.
+WARP_READ_HEADER_TIMEOUT=
+WARP_READ_TIMEOUT=
+WARP_WRITE_TIMEOUT=
+WARP_IDLE_TIMEOUT=
+WARP_MAX_HEADER_BYTES=
+WARP_SHUTDOWN_TIMEOUT=
+
+# Database pool (PostgreSQL). Defaults 10, 5, 1h, true.
+WARP_DB_MAX_OPEN_CONNS=
+WARP_DB_MAX_IDLE_CONNS=
+WARP_DB_CONN_MAX_LIFETIME=
+WARP_DB_AUTO_MIGRATE=
+
+# Client API. Defaults *, false, 0s (never expire), 0s, true.
+WARP_CORS_ALLOWED_ORIGINS=
+WARP_TRUST_X_FORWARDED_FOR=
+WARP_ACCESS_TOKEN_LIFETIME=
+WARP_REFRESH_TOKEN_LIFETIME=
+WARP_RATE_LIMIT_ENABLED=
+
+# Calls: the LiveKit JWT service's URL (see docs/calls.md). Default empty.
+WARP_RTC_LIVEKIT_SERVICE_URL=
+# Delayed events. Defaults 24h, 100.
+WARP_DELAYED_EVENTS_MAX_DELAY=
+WARP_DELAYED_EVENTS_MAX_PER_USER=
+# TURN for legacy 1:1 calls: comma-separated URIs, then a shared secret or
+# a static username and password. Lifetime default 1h.
+WARP_TURN_URIS=
+WARP_TURN_SHARED_SECRET=
+WARP_TURN_USER_LIFETIME=
+WARP_TURN_USERNAME=
+WARP_TURN_PASSWORD=
+
+# Sync. Defaults false, 30s, 30s.
+WARP_SYNC_PRESENCE=
+WARP_SYNC_TYPING_TIMEOUT=
+WARP_SYNC_LONG_POLL_TIMEOUT=
+
+# Media. Defaults 52428800 (50 MiB), 0 (no limit), 32000000, 24h, 10, false.
+WARP_MEDIA_MAX_UPLOAD_BYTES=
+WARP_MEDIA_MAX_USER_STORAGE_BYTES=
+WARP_MEDIA_MAX_THUMBNAIL_PIXELS=
+WARP_MEDIA_PENDING_UPLOAD_EXPIRY=
+WARP_MEDIA_MAX_PENDING_UPLOADS=
+WARP_MEDIA_LEGACY_UNAUTHENTICATED_DOWNLOADS=
+
+# Push. Defaults true, true, 10s, 720h.
+WARP_PUSH_ENABLED=
+WARP_PUSH_INCLUDE_CONTENT=
+WARP_PUSH_GATEWAY_TIMEOUT=
+WARP_PUSH_NOTIFICATION_RETENTION=
+
+# Application services: comma-separated registration files (paths inside
+# the container). Timeout default 30s.
+WARP_APPSERVICE_CONFIG_FILES=
+WARP_APPSERVICE_TIMEOUT=
+
+# Server notices. Defaults false, server-notices, Server Notices, Server
+# Notices.
+WARP_SERVER_NOTICES_ENABLED=
+WARP_SERVER_NOTICES_LOCALPART=
+WARP_SERVER_NOTICES_DISPLAY_NAME=
+WARP_SERVER_NOTICES_ROOM_NAME=
+
+# Logging: debug, info, warn or error; text or json; file and line.
+WARP_LOG_LEVEL=info
+WARP_LOG_FORMAT=json
+WARP_LOG_ADD_SOURCE=
+
+# Metrics. Defaults true, /metrics.
+WARP_METRICS_ENABLED=
+WARP_METRICS_PATH=
+
+# OpenTelemetry tracing. Defaults false, localhost:4318, 1, warp.
+WARP_TRACING_ENABLED=false
+WARP_TRACING_ENDPOINT=
+WARP_TRACING_SAMPLE_RATIO=
+WARP_TRACING_SERVICE_NAME=
+
+
+# ----------------------------------------------------------- admin panel
+
+# text or json.
+WARP_ADMIN_LOG_FORMAT=json
+
+# ------------------------------------------------------------ web client
+
+# The homeserver's public URL. Set, the browser talks to it directly and
+# the web client proxies nothing; empty, it proxies the client API.
+WARP_WEB_PUBLIC_HOMESERVER=
+# Space-separated origins of the LiveKit JWT service and SFU, for calls.
+WARP_WEB_CALL_ORIGINS=
+# text or json.
+WARP_WEB_LOG_FORMAT=json
diff --git a/Docker/.env.postgresql.prod.example b/Docker/.env.postgresql.prod.example
new file mode 100644
index 0000000..6bd8360
--- /dev/null
+++ b/Docker/.env.postgresql.prod.example
@@ -0,0 +1,169 @@
+# Settings for docker-compose.postgresql.prod.yml:
+# the homeserver on PostgreSQL, the admin panel, the web client and
+# PostgreSQL, each in its own container.
+#
+#   cp .env.postgresql.prod.example .env      # then edit it
+#   docker compose -f docker-compose.postgresql.prod.yml up -d
+#
+# Required, with no default: WARP_POSTGRES_PASSWORD.
+#
+# Compose reads .env for the values it puts into the compose file, and hands
+# all of it to the containers, so a change takes effect on the next `up -d`.
+# An empty value means the built-in default, given in the comment above it;
+# every homeserver setting is described in docs/configuration.md.
+#
+# Set by the compose file, not here: the database driver and connection
+# string, and the address the admin panel and web client reach the
+# homeserver on.
+
+# ---------------------------------------------------------------- compose
+
+# Host ports for the homeserver, the admin panel and the web client.
+WARP_PORT=8008
+WARP_ADMIN_PORT=8009
+WARP_WEB_PORT=8080
+
+# The images are pulled from $WARP_REGISTRY/warp, warp-admin and warp-web
+# at this tag. Pin a release in production.
+WARP_REGISTRY=ghcr.io/dariuszjaniak
+WARP_VERSION=latest
+
+# PostgreSQL's password, used when its database is first set up; changing
+# it later does not change the database's password.
+# Required: this file refuses to start without it.
+WARP_POSTGRES_PASSWORD=
+
+# ------------------------------------------------------------ homeserver
+
+# Part of every user and room ID: it cannot be changed later.
+WARP_SERVER_NAME=matrix.example.org
+
+# The URL clients are told to use, in /.well-known/matrix/client.
+# Default https://<server name>.
+WARP_WELL_KNOWN_CLIENT_BASE_URL=https://matrix.example.org
+# Default empty.
+WARP_WELL_KNOWN_IDENTITY_SERVER_BASE_URL=
+# host:port other homeservers should use. Default empty: no delegation.
+WARP_WELL_KNOWN_SERVER_ADDRESS=
+
+# Registration. Default false; the admin API can switch it at runtime.
+WARP_REGISTRATION_ENABLED=false
+# Default true.
+WARP_REGISTRATION_ALLOW_RUNTIME_TOGGLE=
+# Comma-separated sign-up tokens. Default none.
+WARP_REGISTRATION_TOKENS=
+# Default false.
+WARP_REGISTRATION_REQUIRE_TOKEN=
+
+# Federation. Default false.
+WARP_FEDERATION_ENABLED=false
+# Default true.
+WARP_FEDERATION_ALLOW_RUNTIME_TOGGLE=
+# Comma-separated server names. Default none.
+WARP_FEDERATION_ALLOWLIST=
+WARP_FEDERATION_DENYLIST=
+WARP_FEDERATION_TRUSTED_KEY_SERVERS=
+# Default 24h.
+WARP_FEDERATION_KEY_VALIDITY_PERIOD=
+# A second, TLS listener for federation, e.g. :8448, with its certificate
+# and key (paths inside the container). Publish the port yourself.
+WARP_LISTEN_FEDERATION_ADDRESS=
+WARP_TLS_CERT_FILE=
+WARP_TLS_KEY_FILE=
+WARP_FEDERATION_TLS_CA_FILE=
+
+# HTTP server. Defaults 10s, 60s, 120s, 120s, 1048576, 30s.
+WARP_READ_HEADER_TIMEOUT=
+WARP_READ_TIMEOUT=
+WARP_WRITE_TIMEOUT=
+WARP_IDLE_TIMEOUT=
+WARP_MAX_HEADER_BYTES=
+WARP_SHUTDOWN_TIMEOUT=
+
+# Database pool (PostgreSQL). Defaults 10, 5, 1h, true.
+WARP_DB_MAX_OPEN_CONNS=
+WARP_DB_MAX_IDLE_CONNS=
+WARP_DB_CONN_MAX_LIFETIME=
+WARP_DB_AUTO_MIGRATE=
+
+# Client API. Defaults *, false, 0s (never expire), 0s, true.
+WARP_CORS_ALLOWED_ORIGINS=
+WARP_TRUST_X_FORWARDED_FOR=
+WARP_ACCESS_TOKEN_LIFETIME=
+WARP_REFRESH_TOKEN_LIFETIME=
+WARP_RATE_LIMIT_ENABLED=
+
+# Calls: the LiveKit JWT service's URL (see docs/calls.md). Default empty.
+WARP_RTC_LIVEKIT_SERVICE_URL=
+# Delayed events. Defaults 24h, 100.
+WARP_DELAYED_EVENTS_MAX_DELAY=
+WARP_DELAYED_EVENTS_MAX_PER_USER=
+# TURN for legacy 1:1 calls: comma-separated URIs, then a shared secret or
+# a static username and password. Lifetime default 1h.
+WARP_TURN_URIS=
+WARP_TURN_SHARED_SECRET=
+WARP_TURN_USER_LIFETIME=
+WARP_TURN_USERNAME=
+WARP_TURN_PASSWORD=
+
+# Sync. Defaults false, 30s, 30s.
+WARP_SYNC_PRESENCE=
+WARP_SYNC_TYPING_TIMEOUT=
+WARP_SYNC_LONG_POLL_TIMEOUT=
+
+# Media. Defaults 52428800 (50 MiB), 0 (no limit), 32000000, 24h, 10, false.
+WARP_MEDIA_MAX_UPLOAD_BYTES=
+WARP_MEDIA_MAX_USER_STORAGE_BYTES=
+WARP_MEDIA_MAX_THUMBNAIL_PIXELS=
+WARP_MEDIA_PENDING_UPLOAD_EXPIRY=
+WARP_MEDIA_MAX_PENDING_UPLOADS=
+WARP_MEDIA_LEGACY_UNAUTHENTICATED_DOWNLOADS=
+
+# Push. Defaults true, true, 10s, 720h.
+WARP_PUSH_ENABLED=
+WARP_PUSH_INCLUDE_CONTENT=
+WARP_PUSH_GATEWAY_TIMEOUT=
+WARP_PUSH_NOTIFICATION_RETENTION=
+
+# Application services: comma-separated registration files (paths inside
+# the container). Timeout default 30s.
+WARP_APPSERVICE_CONFIG_FILES=
+WARP_APPSERVICE_TIMEOUT=
+
+# Server notices. Defaults false, server-notices, Server Notices, Server
+# Notices.
+WARP_SERVER_NOTICES_ENABLED=
+WARP_SERVER_NOTICES_LOCALPART=
+WARP_SERVER_NOTICES_DISPLAY_NAME=
+WARP_SERVER_NOTICES_ROOM_NAME=
+
+# Logging: debug, info, warn or error; text or json; file and line.
+WARP_LOG_LEVEL=info
+WARP_LOG_FORMAT=json
+WARP_LOG_ADD_SOURCE=
+
+# Metrics. Defaults true, /metrics.
+WARP_METRICS_ENABLED=
+WARP_METRICS_PATH=
+
+# OpenTelemetry tracing. Defaults false, localhost:4318, 1, warp.
+WARP_TRACING_ENABLED=false
+WARP_TRACING_ENDPOINT=
+WARP_TRACING_SAMPLE_RATIO=
+WARP_TRACING_SERVICE_NAME=
+
+
+# ----------------------------------------------------------- admin panel
+
+# text or json.
+WARP_ADMIN_LOG_FORMAT=json
+
+# ------------------------------------------------------------ web client
+
+# The homeserver's public URL. Set, the browser talks to it directly and
+# the web client proxies nothing; empty, it proxies the client API.
+WARP_WEB_PUBLIC_HOMESERVER=
+# Space-separated origins of the LiveKit JWT service and SFU, for calls.
+WARP_WEB_CALL_ORIGINS=
+# text or json.
+WARP_WEB_LOG_FORMAT=json
diff --git a/Docker/.env.sqlite.example b/Docker/.env.sqlite.example
new file mode 100644
index 0000000..4e880e6
--- /dev/null
+++ b/Docker/.env.sqlite.example
@@ -0,0 +1,154 @@
+# Settings for docker-compose.sqlite.yml:
+# the homeserver on SQLite, the admin panel and the web client, each in
+# its own container.
+#
+#   cp .env.sqlite.example .env      # then edit it
+#   docker compose -f docker-compose.sqlite.yml up -d --build
+#
+# Compose reads .env for the values it puts into the compose file, and hands
+# all of it to the containers, so a change takes effect on the next `up -d`.
+# An empty value means the built-in default, given in the comment above it;
+# every homeserver setting is described in docs/configuration.md.
+#
+# Set by the compose file, not here: the database driver and connection
+# string, and the address the admin panel and web client reach the
+# homeserver on.
+
+# ---------------------------------------------------------------- compose
+
+# Host ports for the homeserver, the admin panel and the web client.
+WARP_PORT=8008
+WARP_ADMIN_PORT=8009
+WARP_WEB_PORT=8080
+
+# ------------------------------------------------------------ homeserver
+
+# Part of every user and room ID: it cannot be changed later.
+WARP_SERVER_NAME=localhost
+
+# The URL clients are told to use, in /.well-known/matrix/client.
+# Default https://<server name>.
+WARP_WELL_KNOWN_CLIENT_BASE_URL=http://localhost:8008
+# Default empty.
+WARP_WELL_KNOWN_IDENTITY_SERVER_BASE_URL=
+# host:port other homeservers should use. Default empty: no delegation.
+WARP_WELL_KNOWN_SERVER_ADDRESS=
+
+# Registration. Default false; the admin API can switch it at runtime.
+WARP_REGISTRATION_ENABLED=false
+# Default true.
+WARP_REGISTRATION_ALLOW_RUNTIME_TOGGLE=
+# Comma-separated sign-up tokens. Default none.
+WARP_REGISTRATION_TOKENS=
+# Default false.
+WARP_REGISTRATION_REQUIRE_TOKEN=
+
+# Federation. Default false.
+WARP_FEDERATION_ENABLED=false
+# Default true.
+WARP_FEDERATION_ALLOW_RUNTIME_TOGGLE=
+# Comma-separated server names. Default none.
+WARP_FEDERATION_ALLOWLIST=
+WARP_FEDERATION_DENYLIST=
+WARP_FEDERATION_TRUSTED_KEY_SERVERS=
+# Default 24h.
+WARP_FEDERATION_KEY_VALIDITY_PERIOD=
+# A second, TLS listener for federation, e.g. :8448, with its certificate
+# and key (paths inside the container). Publish the port yourself.
+WARP_LISTEN_FEDERATION_ADDRESS=
+WARP_TLS_CERT_FILE=
+WARP_TLS_KEY_FILE=
+WARP_FEDERATION_TLS_CA_FILE=
+
+# HTTP server. Defaults 10s, 60s, 120s, 120s, 1048576, 30s.
+WARP_READ_HEADER_TIMEOUT=
+WARP_READ_TIMEOUT=
+WARP_WRITE_TIMEOUT=
+WARP_IDLE_TIMEOUT=
+WARP_MAX_HEADER_BYTES=
+WARP_SHUTDOWN_TIMEOUT=
+
+# Apply pending database migrations at startup. Default true.
+WARP_DB_AUTO_MIGRATE=
+
+# Client API. Defaults *, false, 0s (never expire), 0s, true.
+WARP_CORS_ALLOWED_ORIGINS=
+WARP_TRUST_X_FORWARDED_FOR=
+WARP_ACCESS_TOKEN_LIFETIME=
+WARP_REFRESH_TOKEN_LIFETIME=
+WARP_RATE_LIMIT_ENABLED=
+
+# Calls: the LiveKit JWT service's URL (see docs/calls.md). Default empty.
+WARP_RTC_LIVEKIT_SERVICE_URL=
+# Delayed events. Defaults 24h, 100.
+WARP_DELAYED_EVENTS_MAX_DELAY=
+WARP_DELAYED_EVENTS_MAX_PER_USER=
+# TURN for legacy 1:1 calls: comma-separated URIs, then a shared secret or
+# a static username and password. Lifetime default 1h.
+WARP_TURN_URIS=
+WARP_TURN_SHARED_SECRET=
+WARP_TURN_USER_LIFETIME=
+WARP_TURN_USERNAME=
+WARP_TURN_PASSWORD=
+
+# Sync. Defaults false, 30s, 30s.
+WARP_SYNC_PRESENCE=
+WARP_SYNC_TYPING_TIMEOUT=
+WARP_SYNC_LONG_POLL_TIMEOUT=
+
+# Media. Defaults 52428800 (50 MiB), 0 (no limit), 32000000, 24h, 10, false.
+WARP_MEDIA_MAX_UPLOAD_BYTES=
+WARP_MEDIA_MAX_USER_STORAGE_BYTES=
+WARP_MEDIA_MAX_THUMBNAIL_PIXELS=
+WARP_MEDIA_PENDING_UPLOAD_EXPIRY=
+WARP_MEDIA_MAX_PENDING_UPLOADS=
+WARP_MEDIA_LEGACY_UNAUTHENTICATED_DOWNLOADS=
+
+# Push. Defaults true, true, 10s, 720h.
+WARP_PUSH_ENABLED=
+WARP_PUSH_INCLUDE_CONTENT=
+WARP_PUSH_GATEWAY_TIMEOUT=
+WARP_PUSH_NOTIFICATION_RETENTION=
+
+# Application services: comma-separated registration files (paths inside
+# the container). Timeout default 30s.
+WARP_APPSERVICE_CONFIG_FILES=
+WARP_APPSERVICE_TIMEOUT=
+
+# Server notices. Defaults false, server-notices, Server Notices, Server
+# Notices.
+WARP_SERVER_NOTICES_ENABLED=
+WARP_SERVER_NOTICES_LOCALPART=
+WARP_SERVER_NOTICES_DISPLAY_NAME=
+WARP_SERVER_NOTICES_ROOM_NAME=
+
+# Logging: debug, info, warn or error; text or json; file and line.
+WARP_LOG_LEVEL=info
+WARP_LOG_FORMAT=json
+WARP_LOG_ADD_SOURCE=
+
+# Metrics. Defaults true, /metrics.
+WARP_METRICS_ENABLED=
+WARP_METRICS_PATH=
+
+# OpenTelemetry tracing. Defaults false, localhost:4318, 1, warp.
+WARP_TRACING_ENABLED=false
+WARP_TRACING_ENDPOINT=
+WARP_TRACING_SAMPLE_RATIO=
+WARP_TRACING_SERVICE_NAME=
+
+
+# ----------------------------------------------------------- admin panel
+
+# text or json.
+WARP_ADMIN_LOG_FORMAT=json
+
+# ------------------------------------------------------------ web client
+
+# The homeserver's public URL. Set, the browser talks to it directly and
+# the web client proxies nothing; empty, it proxies the client API.
+WARP_WEB_PUBLIC_HOMESERVER=
+# Space-separated origins of the LiveKit JWT service and SFU, for calls.
+WARP_WEB_CALL_ORIGINS=
+# text or json.
+WARP_WEB_LOG_FORMAT=json
diff --git a/Docker/.env.sqlite.prod.example b/Docker/.env.sqlite.prod.example
new file mode 100644
index 0000000..9a1f305
--- /dev/null
+++ b/Docker/.env.sqlite.prod.example
@@ -0,0 +1,159 @@
+# Settings for docker-compose.sqlite.prod.yml:
+# the homeserver on SQLite, the admin panel and the web client, each in
+# its own container.
+#
+#   cp .env.sqlite.prod.example .env      # then edit it
+#   docker compose -f docker-compose.sqlite.prod.yml up -d
+#
+# Compose reads .env for the values it puts into the compose file, and hands
+# all of it to the containers, so a change takes effect on the next `up -d`.
+# An empty value means the built-in default, given in the comment above it;
+# every homeserver setting is described in docs/configuration.md.
+#
+# Set by the compose file, not here: the database driver and connection
+# string, and the address the admin panel and web client reach the
+# homeserver on.
+
+# ---------------------------------------------------------------- compose
+
+# Host ports for the homeserver, the admin panel and the web client.
+WARP_PORT=8008
+WARP_ADMIN_PORT=8009
+WARP_WEB_PORT=8080
+
+# The images are pulled from $WARP_REGISTRY/warp, warp-admin and warp-web
+# at this tag. Pin a release in production.
+WARP_REGISTRY=ghcr.io/dariuszjaniak
+WARP_VERSION=latest
+
+# ------------------------------------------------------------ homeserver
+
+# Part of every user and room ID: it cannot be changed later.
+WARP_SERVER_NAME=matrix.example.org
+
+# The URL clients are told to use, in /.well-known/matrix/client.
+# Default https://<server name>.
+WARP_WELL_KNOWN_CLIENT_BASE_URL=https://matrix.example.org
+# Default empty.
+WARP_WELL_KNOWN_IDENTITY_SERVER_BASE_URL=
+# host:port other homeservers should use. Default empty: no delegation.
+WARP_WELL_KNOWN_SERVER_ADDRESS=
+
+# Registration. Default false; the admin API can switch it at runtime.
+WARP_REGISTRATION_ENABLED=false
+# Default true.
+WARP_REGISTRATION_ALLOW_RUNTIME_TOGGLE=
+# Comma-separated sign-up tokens. Default none.
+WARP_REGISTRATION_TOKENS=
+# Default false.
+WARP_REGISTRATION_REQUIRE_TOKEN=
+
+# Federation. Default false.
+WARP_FEDERATION_ENABLED=false
+# Default true.
+WARP_FEDERATION_ALLOW_RUNTIME_TOGGLE=
+# Comma-separated server names. Default none.
+WARP_FEDERATION_ALLOWLIST=
+WARP_FEDERATION_DENYLIST=
+WARP_FEDERATION_TRUSTED_KEY_SERVERS=
+# Default 24h.
+WARP_FEDERATION_KEY_VALIDITY_PERIOD=
+# A second, TLS listener for federation, e.g. :8448, with its certificate
+# and key (paths inside the container). Publish the port yourself.
+WARP_LISTEN_FEDERATION_ADDRESS=
+WARP_TLS_CERT_FILE=
+WARP_TLS_KEY_FILE=
+WARP_FEDERATION_TLS_CA_FILE=
+
+# HTTP server. Defaults 10s, 60s, 120s, 120s, 1048576, 30s.
+WARP_READ_HEADER_TIMEOUT=
+WARP_READ_TIMEOUT=
+WARP_WRITE_TIMEOUT=
+WARP_IDLE_TIMEOUT=
+WARP_MAX_HEADER_BYTES=
+WARP_SHUTDOWN_TIMEOUT=
+
+# Apply pending database migrations at startup. Default true.
+WARP_DB_AUTO_MIGRATE=
+
+# Client API. Defaults *, false, 0s (never expire), 0s, true.
+WARP_CORS_ALLOWED_ORIGINS=
+WARP_TRUST_X_FORWARDED_FOR=
+WARP_ACCESS_TOKEN_LIFETIME=
+WARP_REFRESH_TOKEN_LIFETIME=
+WARP_RATE_LIMIT_ENABLED=
+
+# Calls: the LiveKit JWT service's URL (see docs/calls.md). Default empty.
+WARP_RTC_LIVEKIT_SERVICE_URL=
+# Delayed events. Defaults 24h, 100.
+WARP_DELAYED_EVENTS_MAX_DELAY=
+WARP_DELAYED_EVENTS_MAX_PER_USER=
+# TURN for legacy 1:1 calls: comma-separated URIs, then a shared secret or
+# a static username and password. Lifetime default 1h.
+WARP_TURN_URIS=
+WARP_TURN_SHARED_SECRET=
+WARP_TURN_USER_LIFETIME=
+WARP_TURN_USERNAME=
+WARP_TURN_PASSWORD=
+
+# Sync. Defaults false, 30s, 30s.
+WARP_SYNC_PRESENCE=
+WARP_SYNC_TYPING_TIMEOUT=
+WARP_SYNC_LONG_POLL_TIMEOUT=
+
+# Media. Defaults 52428800 (50 MiB), 0 (no limit), 32000000, 24h, 10, false.
+WARP_MEDIA_MAX_UPLOAD_BYTES=
+WARP_MEDIA_MAX_USER_STORAGE_BYTES=
+WARP_MEDIA_MAX_THUMBNAIL_PIXELS=
+WARP_MEDIA_PENDING_UPLOAD_EXPIRY=
+WARP_MEDIA_MAX_PENDING_UPLOADS=
+WARP_MEDIA_LEGACY_UNAUTHENTICATED_DOWNLOADS=
+
+# Push. Defaults true, true, 10s, 720h.
+WARP_PUSH_ENABLED=
+WARP_PUSH_INCLUDE_CONTENT=
+WARP_PUSH_GATEWAY_TIMEOUT=
+WARP_PUSH_NOTIFICATION_RETENTION=
+
+# Application services: comma-separated registration files (paths inside
+# the container). Timeout default 30s.
+WARP_APPSERVICE_CONFIG_FILES=
+WARP_APPSERVICE_TIMEOUT=
+
+# Server notices. Defaults false, server-notices, Server Notices, Server
+# Notices.
+WARP_SERVER_NOTICES_ENABLED=
+WARP_SERVER_NOTICES_LOCALPART=
+WARP_SERVER_NOTICES_DISPLAY_NAME=
+WARP_SERVER_NOTICES_ROOM_NAME=
+
+# Logging: debug, info, warn or error; text or json; file and line.
+WARP_LOG_LEVEL=info
+WARP_LOG_FORMAT=json
+WARP_LOG_ADD_SOURCE=
+
+# Metrics. Defaults true, /metrics.
+WARP_METRICS_ENABLED=
+WARP_METRICS_PATH=
+
+# OpenTelemetry tracing. Defaults false, localhost:4318, 1, warp.
+WARP_TRACING_ENABLED=false
+WARP_TRACING_ENDPOINT=
+WARP_TRACING_SAMPLE_RATIO=
+WARP_TRACING_SERVICE_NAME=
+
+
+# ----------------------------------------------------------- admin panel
+
+# text or json.
+WARP_ADMIN_LOG_FORMAT=json
+
+# ------------------------------------------------------------ web client
+
+# The homeserver's public URL. Set, the browser talks to it directly and
+# the web client proxies nothing; empty, it proxies the client API.
+WARP_WEB_PUBLIC_HOMESERVER=
+# Space-separated origins of the LiveKit JWT service and SFU, for calls.
+WARP_WEB_CALL_ORIGINS=
+# text or json.
+WARP_WEB_LOG_FORMAT=json
diff --git a/Docker/README.md b/Docker/README.md
index 39f75e3..a39b4ae 100644
--- a/Docker/README.md
+++ b/Docker/README.md
@@ -16,7 +16,7 @@ The homeserver (`warp`), the admin panel (`warp-admin`) and the web client
 
 ```sh
 cd Docker
-cp .env.example .env      # then edit it
+cp .env.sqlite.example .env      # then edit it
 docker compose -f docker-compose.sqlite.yml up -d --build
 docker compose -f docker-compose.sqlite.yml exec warp warp create-account --username admin --admin
 ```
@@ -81,11 +81,16 @@ done
 
 ## Settings
 
-Every setting is in `.env`, copied from [`.env.example`](.env.example),
-which lists them all with their defaults; an empty value means the
-default. Compose reads it for the ports, the registry and the PostgreSQL
-password, and passes all of it to the homeserver, the admin panel and the
-web client. `.env` is not committed.
+Every compose file has its own settings file, named after it:
+`docker-compose.<name>.yml` takes `.env.<name>.example`, so
+`docker-compose.pocketbase.seaweedfs.prod.yml` takes
+`.env.pocketbase.seaweedfs.prod.example`. Each lists only the settings
+its compose file uses, with their defaults, and names the ones that are
+required; an empty value means the default. Copy the one you need to
+`.env`, which compose reads for the ports, the registry and the passwords,
+and passes to the homeserver, the admin panel and the web client. `.env`
+is not committed. The prod examples start from a public server name
+rather than `localhost`.
 
 The compose files set only what makes each one what it is: the database
 driver and connection string, and the address the admin panel and web
diff --git a/Docker/docker-compose.pocketbase.prod.yml b/Docker/docker-compose.pocketbase.prod.yml
index efd2643..aac6efb 100644
--- a/Docker/docker-compose.pocketbase.prod.yml
+++ b/Docker/docker-compose.pocketbase.prod.yml
@@ -2,7 +2,7 @@
 # each in its own container, pulled from a registry.
 #
 #   cd Docker
-#   cp .env.example .env      # then edit it
+#   cp .env.pocketbase.prod.example .env      # then edit it
 #   docker compose -f docker-compose.pocketbase.prod.yml up -d
 #
 # PocketBase is embedded in the homeserver (the pocketbase database driver),
diff --git a/Docker/docker-compose.pocketbase.s3.prod.yml b/Docker/docker-compose.pocketbase.s3.prod.yml
index 94bd3bb..5de51e5 100644
--- a/Docker/docker-compose.pocketbase.s3.prod.yml
+++ b/Docker/docker-compose.pocketbase.s3.prod.yml
@@ -3,8 +3,7 @@
 # from a registry.
 #
 #   cd Docker
-#   cp .env.example .env      # then edit it; set WARP_PB_S3_ENDPOINT,
-#                             # WARP_PB_S3_ACCESS_KEY and WARP_PB_S3_SECRET
+#   cp .env.pocketbase.s3.prod.example .env      # then edit it
 #   docker compose -f docker-compose.pocketbase.s3.prod.yml up -d
 #
 # The database stays in /data/pb_data (warp-data); media goes to the bucket
diff --git a/Docker/docker-compose.pocketbase.s3.yml b/Docker/docker-compose.pocketbase.s3.yml
index cf34a6c..35cc2b5 100644
--- a/Docker/docker-compose.pocketbase.s3.yml
+++ b/Docker/docker-compose.pocketbase.s3.yml
@@ -3,8 +3,7 @@
 # this checkout.
 #
 #   cd Docker
-#   cp .env.example .env      # then edit it; set WARP_PB_S3_ENDPOINT,
-#                             # WARP_PB_S3_ACCESS_KEY and WARP_PB_S3_SECRET
+#   cp .env.pocketbase.s3.example .env      # then edit it
 #   docker compose -f docker-compose.pocketbase.s3.yml up -d --build
 #
 # The database stays in /data/pb_data (warp-data); media goes to the bucket
diff --git a/Docker/docker-compose.pocketbase.seaweedfs.prod.yml b/Docker/docker-compose.pocketbase.seaweedfs.prod.yml
index 5cc7b35..8213f82 100644
--- a/Docker/docker-compose.pocketbase.seaweedfs.prod.yml
+++ b/Docker/docker-compose.pocketbase.seaweedfs.prod.yml
@@ -4,8 +4,7 @@
 # process).
 #
 #   cd Docker
-#   cp .env.example .env      # then edit it; set WARP_PB_S3_ACCESS_KEY
-#                             # and WARP_PB_S3_SECRET
+#   cp .env.pocketbase.seaweedfs.prod.example .env      # then edit it
 #   docker compose -f docker-compose.pocketbase.seaweedfs.prod.yml up -d
 #
 # The database stays in /data/pb_data (warp-data); media goes to the bucket
@@ -96,7 +95,7 @@ services:
       WARP_PB_S3_ENABLED: "true"
       WARP_PB_S3_ENDPOINT: http://seaweedfs:8333
       WARP_PB_S3_BUCKET: ${WARP_PB_S3_BUCKET:-warp}
-      WARP_PB_S3_REGION: ${WARP_PB_S3_REGION:-us-east-1}
+      WARP_PB_S3_REGION: us-east-1   # SeaweedFS ignores it; the client wants one
       WARP_PB_S3_FORCE_PATH_STYLE: "true"
       WARP_PB_S3_ACCESS_KEY: ${WARP_PB_S3_ACCESS_KEY:?set WARP_PB_S3_ACCESS_KEY in .env}
       WARP_PB_S3_SECRET: ${WARP_PB_S3_SECRET:?set WARP_PB_S3_SECRET in .env}
diff --git a/Docker/docker-compose.pocketbase.seaweedfs.split.prod.yml b/Docker/docker-compose.pocketbase.seaweedfs.split.prod.yml
index b4229a8..1226403 100644
--- a/Docker/docker-compose.pocketbase.seaweedfs.split.prod.yml
+++ b/Docker/docker-compose.pocketbase.seaweedfs.split.prod.yml
@@ -4,8 +4,7 @@
 # separate containers.
 #
 #   cd Docker
-#   cp .env.example .env      # then edit it; set WARP_PB_S3_ACCESS_KEY,
-#                             # WARP_PB_S3_SECRET and SEAWEED_ADMIN_PASSWORD
+#   cp .env.pocketbase.seaweedfs.split.prod.example .env      # then edit it
 #   docker compose -f docker-compose.pocketbase.seaweedfs.split.prod.yml up -d
 #
 # The database stays in /data/pb_data (warp-data); media goes to the bucket
@@ -199,7 +198,7 @@ services:
       WARP_PB_S3_ENABLED: "true"
       WARP_PB_S3_ENDPOINT: http://seaweedfs-s3:8333
       WARP_PB_S3_BUCKET: ${WARP_PB_S3_BUCKET:-warp}
-      WARP_PB_S3_REGION: ${WARP_PB_S3_REGION:-us-east-1}
+      WARP_PB_S3_REGION: us-east-1   # SeaweedFS ignores it; the client wants one
       WARP_PB_S3_FORCE_PATH_STYLE: "true"
       WARP_PB_S3_ACCESS_KEY: ${WARP_PB_S3_ACCESS_KEY:?set WARP_PB_S3_ACCESS_KEY in .env}
       WARP_PB_S3_SECRET: ${WARP_PB_S3_SECRET:?set WARP_PB_S3_SECRET in .env}
diff --git a/Docker/docker-compose.pocketbase.seaweedfs.split.yml b/Docker/docker-compose.pocketbase.seaweedfs.split.yml
index 10b4fa8..20eb3e7 100644
--- a/Docker/docker-compose.pocketbase.seaweedfs.split.yml
+++ b/Docker/docker-compose.pocketbase.seaweedfs.split.yml
@@ -4,8 +4,7 @@
 # separate containers.
 #
 #   cd Docker
-#   cp .env.example .env      # then edit it; set WARP_PB_S3_ACCESS_KEY,
-#                             # WARP_PB_S3_SECRET and SEAWEED_ADMIN_PASSWORD
+#   cp .env.pocketbase.seaweedfs.split.example .env      # then edit it
 #   docker compose -f docker-compose.pocketbase.seaweedfs.split.yml up -d --build
 #
 # The database stays in /data/pb_data (warp-data); media goes to the bucket
@@ -194,7 +193,7 @@ services:
       WARP_PB_S3_ENABLED: "true"
       WARP_PB_S3_ENDPOINT: http://seaweedfs-s3:8333
       WARP_PB_S3_BUCKET: ${WARP_PB_S3_BUCKET:-warp}
-      WARP_PB_S3_REGION: ${WARP_PB_S3_REGION:-us-east-1}
+      WARP_PB_S3_REGION: us-east-1   # SeaweedFS ignores it; the client wants one
       WARP_PB_S3_FORCE_PATH_STYLE: "true"
       WARP_PB_S3_ACCESS_KEY: ${WARP_PB_S3_ACCESS_KEY:?set WARP_PB_S3_ACCESS_KEY in .env}
       WARP_PB_S3_SECRET: ${WARP_PB_S3_SECRET:?set WARP_PB_S3_SECRET in .env}
diff --git a/Docker/docker-compose.pocketbase.seaweedfs.yml b/Docker/docker-compose.pocketbase.seaweedfs.yml
index f5968a4..a62b6da 100644
--- a/Docker/docker-compose.pocketbase.seaweedfs.yml
+++ b/Docker/docker-compose.pocketbase.seaweedfs.yml
@@ -4,8 +4,7 @@
 # process).
 #
 #   cd Docker
-#   cp .env.example .env      # then edit it; set WARP_PB_S3_ACCESS_KEY
-#                             # and WARP_PB_S3_SECRET
+#   cp .env.pocketbase.seaweedfs.example .env      # then edit it
 #   docker compose -f docker-compose.pocketbase.seaweedfs.yml up -d --build
 #
 # The database stays in /data/pb_data (warp-data); media goes to the bucket
@@ -91,7 +90,7 @@ services:
       WARP_PB_S3_ENABLED: "true"
       WARP_PB_S3_ENDPOINT: http://seaweedfs:8333
       WARP_PB_S3_BUCKET: ${WARP_PB_S3_BUCKET:-warp}
-      WARP_PB_S3_REGION: ${WARP_PB_S3_REGION:-us-east-1}
+      WARP_PB_S3_REGION: us-east-1   # SeaweedFS ignores it; the client wants one
       WARP_PB_S3_FORCE_PATH_STYLE: "true"
       WARP_PB_S3_ACCESS_KEY: ${WARP_PB_S3_ACCESS_KEY:?set WARP_PB_S3_ACCESS_KEY in .env}
       WARP_PB_S3_SECRET: ${WARP_PB_S3_SECRET:?set WARP_PB_S3_SECRET in .env}
diff --git a/Docker/docker-compose.pocketbase.yml b/Docker/docker-compose.pocketbase.yml
index a707772..40935df 100644
--- a/Docker/docker-compose.pocketbase.yml
+++ b/Docker/docker-compose.pocketbase.yml
@@ -2,7 +2,7 @@
 # each in its own container, built from this checkout.
 #
 #   cd Docker
-#   cp .env.example .env      # then edit it
+#   cp .env.pocketbase.example .env      # then edit it
 #   docker compose -f docker-compose.pocketbase.yml up -d --build
 #
 # PocketBase is embedded in the homeserver (the pocketbase database driver),
diff --git a/Docker/docker-compose.postgresql.prod.yml b/Docker/docker-compose.postgresql.prod.yml
index 4d6ca9f..ee4e8a4 100644
--- a/Docker/docker-compose.postgresql.prod.yml
+++ b/Docker/docker-compose.postgresql.prod.yml
@@ -2,7 +2,7 @@
 # PostgreSQL, each in its own container, pulled from a registry.
 #
 #   cd Docker
-#   cp .env.example .env      # then edit it; set WARP_POSTGRES_PASSWORD
+#   cp .env.postgresql.prod.example .env      # then edit it
 #   docker compose -f docker-compose.postgresql.prod.yml up -d
 #
 # Homeserver http://localhost:8008, admin panel http://localhost:8009, web
diff --git a/Docker/docker-compose.postgresql.yml b/Docker/docker-compose.postgresql.yml
index 62d573d..53d64b7 100644
--- a/Docker/docker-compose.postgresql.yml
+++ b/Docker/docker-compose.postgresql.yml
@@ -2,7 +2,7 @@
 # PostgreSQL, each in its own container, built from this checkout.
 #
 #   cd Docker
-#   cp .env.example .env      # then edit it; set WARP_POSTGRES_PASSWORD
+#   cp .env.postgresql.example .env      # then edit it
 #   docker compose -f docker-compose.postgresql.yml up -d --build
 #
 # Homeserver http://localhost:8008, admin panel http://localhost:8009, web
diff --git a/Docker/docker-compose.sqlite.prod.yml b/Docker/docker-compose.sqlite.prod.yml
index 0044283..0e203ef 100644
--- a/Docker/docker-compose.sqlite.prod.yml
+++ b/Docker/docker-compose.sqlite.prod.yml
@@ -2,7 +2,7 @@
 # in its own container, pulled from a registry.
 #
 #   cd Docker
-#   cp .env.example .env      # then edit it
+#   cp .env.sqlite.prod.example .env      # then edit it
 #   docker compose -f docker-compose.sqlite.prod.yml up -d
 #
 # Homeserver http://localhost:8008, admin panel http://localhost:8009, web
diff --git a/Docker/docker-compose.sqlite.yml b/Docker/docker-compose.sqlite.yml
index 14fd466..46c6f23 100644
--- a/Docker/docker-compose.sqlite.yml
+++ b/Docker/docker-compose.sqlite.yml
@@ -2,7 +2,7 @@
 # in its own container, built from this checkout.
 #
 #   cd Docker
-#   cp .env.example .env      # then edit it
+#   cp .env.sqlite.example .env      # then edit it
 #   docker compose -f docker-compose.sqlite.yml up -d --build
 #
 # Homeserver http://localhost:8008, admin panel http://localhost:8009, web