Warp/Docker/.env.example

# Settings for every compose file in this folder.
#
#   cp .env.example .env
#
# then edit .env. Compose reads it for the ports, the registry and the
# PostgreSQL password, and hands all of it to the containers, so anything
# below takes effect on the next `docker compose ... up -d`.
#
# An empty value means the built-in default, given in the comment above it.
# Every homeserver setting is described in docs/configuration.md.
#
# Set by the compose files, not here: the database driver and connection
# string (each file is one database), the listen addresses, the signing key
# and media paths inside /data, and the address the admin panel and web
# client reach the homeserver on.

# ---------------------------------------------------------------- compose

# Host ports for the homeserver, the admin panel and the web client.
WARP_PORT=8008
WARP_ADMIN_PORT=8009
WARP_WEB_PORT=8080

# The *.prod.yml files pull $WARP_REGISTRY/warp, warp-admin and warp-web at
# this tag. Pin a release in production.
WARP_REGISTRY=ghcr.io/dariuszjaniak
WARP_VERSION=latest

# docker-compose.postgresql*.yml only. Used when PostgreSQL is first set up;
# changing it later does not change the database's password. The prod file
# refuses to start without it.
WARP_POSTGRES_PASSWORD=change-me

# ------------------------------------------------------------- seaweedfs

# docker-compose.pocketbase.seaweedfs*.yml only; set WARP_PB_S3_ACCESS_KEY
# and WARP_PB_S3_SECRET below as well.
#
# The SeaweedFS image every SeaweedFS container runs. Pin it: the data
# volume outlives the image.
SEAWEED_IMAGE=chrislusf/seaweedfs:4.45

# The S3 gateway's host port, on loopback unless the bind address says
# otherwise. The homeserver reaches it over the compose network; this is
# for aws-cli and the like.
SEAWEED_S3_BIND=127.0.0.1
SEAWEED_S3_PORT=8333

# The split file only: SeaweedFS's admin UI. It can mint credentials for
# the bucket, so the password is required. Put it behind a reverse proxy
# before binding it to 0.0.0.0. The read-only login is optional.
SEAWEED_ADMIN_BIND=127.0.0.1
SEAWEED_ADMIN_PORT=23646
SEAWEED_ADMIN_USER=admin
SEAWEED_ADMIN_PASSWORD=
SEAWEED_ADMIN_READONLY_USER=
SEAWEED_ADMIN_READONLY_PASSWORD=

# ------------------------------------------------------------ homeserver

# Part of every user and room ID: it cannot be changed later.
WARP_SERVER_NAME=localhost

# The URL clients are told to use, in /.well-known/matrix/client.
# Default https://<server name>.
WARP_WELL_KNOWN_CLIENT_BASE_URL=http://localhost:8008
# Default empty.
WARP_WELL_KNOWN_IDENTITY_SERVER_BASE_URL=
# host:port other homeservers should use. Default empty: no delegation.
WARP_WELL_KNOWN_SERVER_ADDRESS=

# Registration. Default false; the admin API can switch it at runtime.
WARP_REGISTRATION_ENABLED=false
# Default true.
WARP_REGISTRATION_ALLOW_RUNTIME_TOGGLE=
# Comma-separated sign-up tokens. Default none.
WARP_REGISTRATION_TOKENS=
# Default false.
WARP_REGISTRATION_REQUIRE_TOKEN=

# Federation. Default false.
WARP_FEDERATION_ENABLED=false
# Default true.
WARP_FEDERATION_ALLOW_RUNTIME_TOGGLE=
# Comma-separated server names. Default none.
WARP_FEDERATION_ALLOWLIST=
WARP_FEDERATION_DENYLIST=
WARP_FEDERATION_TRUSTED_KEY_SERVERS=
# Default 24h.
WARP_FEDERATION_KEY_VALIDITY_PERIOD=
# A second, TLS listener for federation, e.g. :8448, with its certificate
# and key (paths inside the container). Publish the port yourself.
WARP_LISTEN_FEDERATION_ADDRESS=
WARP_TLS_CERT_FILE=
WARP_TLS_KEY_FILE=
WARP_FEDERATION_TLS_CA_FILE=

# HTTP server. Defaults 10s, 60s, 120s, 120s, 1048576, 30s.
WARP_READ_HEADER_TIMEOUT=
WARP_READ_TIMEOUT=
WARP_WRITE_TIMEOUT=
WARP_IDLE_TIMEOUT=
WARP_MAX_HEADER_BYTES=
WARP_SHUTDOWN_TIMEOUT=

# Database pool (PostgreSQL). Defaults 10, 5, 1h, true.
WARP_DB_MAX_OPEN_CONNS=
WARP_DB_MAX_IDLE_CONNS=
WARP_DB_CONN_MAX_LIFETIME=
WARP_DB_AUTO_MIGRATE=

# docker-compose.pocketbase*.yml only: keep media in an S3 bucket instead
# of pb_data/storage. Bucket, region, endpoint and keys are all required
# when it is on.
#
# The pocketbase.seaweedfs files turn it on themselves, against their own
# SeaweedFS; there only the access key and secret are needed (required:
# they are the gateway's credentials too), and the bucket defaults to warp.
#
# The pocketbase.s3 files turn it on against a bucket elsewhere: the
# endpoint, access key and secret are required, the bucket (default warp)
# must exist, the region defaults to us-east-1 and path style to true
# (SeaweedFS, MinIO; set false for AWS S3). For a gateway on the Docker
# host, use http://host.docker.internal:8333.
WARP_PB_S3_ENABLED=false
WARP_PB_S3_BUCKET=
WARP_PB_S3_REGION=
WARP_PB_S3_ENDPOINT=
WARP_PB_S3_ACCESS_KEY=
WARP_PB_S3_SECRET=
WARP_PB_S3_FORCE_PATH_STYLE=

# Client API. Defaults *, false, 0s (never expire), 0s, true.
WARP_CORS_ALLOWED_ORIGINS=
WARP_TRUST_X_FORWARDED_FOR=
WARP_ACCESS_TOKEN_LIFETIME=
WARP_REFRESH_TOKEN_LIFETIME=
WARP_RATE_LIMIT_ENABLED=

# Calls: the LiveKit JWT service's URL (see docs/calls.md). Default empty.
WARP_RTC_LIVEKIT_SERVICE_URL=
# Delayed events. Defaults 24h, 100.
WARP_DELAYED_EVENTS_MAX_DELAY=
WARP_DELAYED_EVENTS_MAX_PER_USER=
# TURN for legacy 1:1 calls: comma-separated URIs, then a shared secret or
# a static username and password. Lifetime default 1h.
WARP_TURN_URIS=
WARP_TURN_SHARED_SECRET=
WARP_TURN_USER_LIFETIME=
WARP_TURN_USERNAME=
WARP_TURN_PASSWORD=

# Sync. Defaults false, 30s, 30s.
WARP_SYNC_PRESENCE=
WARP_SYNC_TYPING_TIMEOUT=
WARP_SYNC_LONG_POLL_TIMEOUT=

# Media. Defaults 52428800 (50 MiB), 0 (no limit), 32000000, 24h, 10, false.
WARP_MEDIA_MAX_UPLOAD_BYTES=
WARP_MEDIA_MAX_USER_STORAGE_BYTES=
WARP_MEDIA_MAX_THUMBNAIL_PIXELS=
WARP_MEDIA_PENDING_UPLOAD_EXPIRY=
WARP_MEDIA_MAX_PENDING_UPLOADS=
WARP_MEDIA_LEGACY_UNAUTHENTICATED_DOWNLOADS=

# Push. Defaults true, true, 10s, 720h.
WARP_PUSH_ENABLED=
WARP_PUSH_INCLUDE_CONTENT=
WARP_PUSH_GATEWAY_TIMEOUT=
WARP_PUSH_NOTIFICATION_RETENTION=

# Application services: comma-separated registration files (paths inside
# the container). Timeout default 30s.
WARP_APPSERVICE_CONFIG_FILES=
WARP_APPSERVICE_TIMEOUT=

# Server notices. Defaults false, server-notices, Server Notices, Server
# Notices.
WARP_SERVER_NOTICES_ENABLED=
WARP_SERVER_NOTICES_LOCALPART=
WARP_SERVER_NOTICES_DISPLAY_NAME=
WARP_SERVER_NOTICES_ROOM_NAME=

# Logging: debug, info, warn or error; text or json; file and line.
WARP_LOG_LEVEL=info
WARP_LOG_FORMAT=json
WARP_LOG_ADD_SOURCE=

# Metrics. Defaults true, /metrics.
WARP_METRICS_ENABLED=
WARP_METRICS_PATH=

# OpenTelemetry tracing. Defaults false, localhost:4318, 1, warp.
WARP_TRACING_ENABLED=false
WARP_TRACING_ENDPOINT=
WARP_TRACING_SAMPLE_RATIO=
WARP_TRACING_SERVICE_NAME=

# ----------------------------------------------------------- admin panel

# text or json.
WARP_ADMIN_LOG_FORMAT=json

# ------------------------------------------------------------ web client

# The homeserver's public URL. Set, the browser talks to it directly and
# the web client proxies nothing; empty, it proxies the client API.
WARP_WEB_PUBLIC_HOMESERVER=
# Space-separated origins of the LiveKit JWT service and SFU, for calls.
WARP_WEB_CALL_ORIGINS=
# text or json.
WARP_WEB_LOG_FORMAT=json