Warp/Docker-AIO/.env.pocketbase.seaweedfs.split.prod.example

# Settings for docker-compose.pocketbase.seaweedfs.split.prod.yml:
# the homeserver on PocketBase, the admin panel, the web client and
# SeaweedFS split into its roles, for media, in one container.
#
#   cp .env.pocketbase.seaweedfs.split.prod.example .env      # then edit it
#   docker compose -f docker-compose.pocketbase.seaweedfs.split.prod.yml up -d
#
# Required, with no default: WARP_PB_S3_ACCESS_KEY, WARP_PB_S3_SECRET and
# SEAWEED_ADMIN_PASSWORD.
#
# Compose reads .env for the values it puts into the compose file, and hands
# all of it to the containers, so a change takes effect on the next `up -d`.
# An empty value means the built-in default, given in the comment above it;
# every homeserver setting is described in docs/configuration.md.
#
# Set by the image or the compose file, not here: the database driver and
# connection string, the listen addresses and the paths inside /data.

# ---------------------------------------------------------------- compose

# Host ports for the homeserver, the admin panel and the web client.
WARP_PORT=8008
WARP_ADMIN_PORT=8009
WARP_WEB_PORT=8080

# The image is pulled from $WARP_REGISTRY/warp-aio-pocketbase-seaweedfs-split at this tag.
# Pin a release in production.
WARP_REGISTRY=10.2.1.10:5500/admin
WARP_VERSION=latest

# PocketBase's port, for its admin UI at http://localhost:8070/_/. It is
# on loopback unless the bind address says otherwise; put the UI behind a
# reverse proxy before binding it to 0.0.0.0.
WARP_PB_BIND=127.0.0.1
WARP_PB_PORT=8070

# The PocketBase superuser the homeserver signs in as, and so can you, in
# the admin UI. Its password is set to this one on every start, and needs 8
# characters or more. Empty: the container makes one up on first start and
# keeps it in /data/pocketbase-superuser.env.
WARP_PB_SUPERUSER_EMAIL=
WARP_PB_SUPERUSER_PASSWORD=

# Where the data lives. Empty keeps the named volume in brackets; a
# host path (starting with . or /) bind-mounts that directory instead.
# The container runs as UID 10001, so its directory must be writable by it.
# The container's /data (warp-data): the signing key, and PocketBase's
# pb_data, with the database and media unless it is in S3.
WARP_DATA_VOLUME=
# SeaweedFS's data (seaweed-data).
SEAWEED_DATA_VOLUME=
# SeaweedFS's admin UI state (seaweed-admin).
SEAWEED_ADMIN_VOLUME=

# ------------------------------------------------------------------- aio

# false runs the container without the admin panel or the web client.
WARP_AIO_ADMIN=true
WARP_AIO_WEB=true

# -------------------------------------------------------------- seaweedfs

# Media goes to this bucket in SeaweedFS, created on start; the database
# stays in PocketBase. The key pair is the homeserver's S3 identity:
# written into the filer's IAM store on every start, beside any identity
# added in the admin UI, so a new secret here lands on the next start.
# Media stored before S3 was on is not moved into the bucket.
WARP_PB_S3_BUCKET=warp
WARP_PB_S3_ACCESS_KEY=
WARP_PB_S3_SECRET=

# The S3 gateway's host port, on loopback unless the bind address says
# otherwise. The homeserver does not need it; it is for aws-cli and the
# like.
SEAWEED_S3_BIND=127.0.0.1
SEAWEED_S3_PORT=8333

# SeaweedFS's admin UI. It can mint credentials for the bucket, so the
# password is required. Put it behind a reverse proxy before binding it
# to 0.0.0.0. The read-only login is optional.
SEAWEED_ADMIN_BIND=127.0.0.1
SEAWEED_ADMIN_PORT=23646
SEAWEED_ADMIN_USER=admin
SEAWEED_ADMIN_PASSWORD=
SEAWEED_ADMIN_READONLY_USER=
SEAWEED_ADMIN_READONLY_PASSWORD=

# ------------------------------------------------------------ homeserver

# Part of every user and room ID: it cannot be changed later.
WARP_SERVER_NAME=matrix.example.org

# The URL clients are told to use, in /.well-known/matrix/client.
# Default https://<server name>.
WARP_WELL_KNOWN_CLIENT_BASE_URL=https://matrix.example.org
# Default empty.
WARP_WELL_KNOWN_IDENTITY_SERVER_BASE_URL=
# host:port other homeservers should use. Default empty: no delegation.
WARP_WELL_KNOWN_SERVER_ADDRESS=

# Registration. Default false; the admin API can switch it at runtime.
WARP_REGISTRATION_ENABLED=false
# Default true.
WARP_REGISTRATION_ALLOW_RUNTIME_TOGGLE=
# Comma-separated sign-up tokens. Default none.
WARP_REGISTRATION_TOKENS=
# Default false.
WARP_REGISTRATION_REQUIRE_TOKEN=

# Federation. Default false.
WARP_FEDERATION_ENABLED=false
# Default true.
WARP_FEDERATION_ALLOW_RUNTIME_TOGGLE=
# Comma-separated server names. Default none.
WARP_FEDERATION_ALLOWLIST=
WARP_FEDERATION_DENYLIST=
WARP_FEDERATION_TRUSTED_KEY_SERVERS=
# Default 24h.
WARP_FEDERATION_KEY_VALIDITY_PERIOD=
# A second, TLS listener for federation, e.g. :8448, with its certificate
# and key (paths inside the container). Publish the port yourself.
WARP_LISTEN_FEDERATION_ADDRESS=
WARP_TLS_CERT_FILE=
WARP_TLS_KEY_FILE=
WARP_FEDERATION_TLS_CA_FILE=

# HTTP server. Defaults 10s, 60s, 120s, 120s, 1048576, 30s.
WARP_READ_HEADER_TIMEOUT=
WARP_READ_TIMEOUT=
WARP_WRITE_TIMEOUT=
WARP_IDLE_TIMEOUT=
WARP_MAX_HEADER_BYTES=
WARP_SHUTDOWN_TIMEOUT=

# Apply pending database migrations at startup. Default true.
WARP_DB_AUTO_MIGRATE=

# Client API. Defaults *, false, 0s (never expire), 0s, true.
WARP_CORS_ALLOWED_ORIGINS=
WARP_TRUST_X_FORWARDED_FOR=
WARP_ACCESS_TOKEN_LIFETIME=
WARP_REFRESH_TOKEN_LIFETIME=
WARP_RATE_LIMIT_ENABLED=

# Calls: the LiveKit JWT service's URL (see docs/calls.md). Default empty.
WARP_RTC_LIVEKIT_SERVICE_URL=
# Delayed events. Defaults 24h, 100.
WARP_DELAYED_EVENTS_MAX_DELAY=
WARP_DELAYED_EVENTS_MAX_PER_USER=
# TURN for legacy 1:1 calls: comma-separated URIs, then a shared secret or
# a static username and password. Lifetime default 1h.
WARP_TURN_URIS=
WARP_TURN_SHARED_SECRET=
WARP_TURN_USER_LIFETIME=
WARP_TURN_USERNAME=
WARP_TURN_PASSWORD=

# Sync. Defaults false, 30s, 30s.
WARP_SYNC_PRESENCE=
WARP_SYNC_TYPING_TIMEOUT=
WARP_SYNC_LONG_POLL_TIMEOUT=

# Media. Defaults 52428800 (50 MiB), 0 (no limit), 32000000, 24h, 10, false.
WARP_MEDIA_MAX_UPLOAD_BYTES=
WARP_MEDIA_MAX_USER_STORAGE_BYTES=
WARP_MEDIA_MAX_THUMBNAIL_PIXELS=
WARP_MEDIA_PENDING_UPLOAD_EXPIRY=
WARP_MEDIA_MAX_PENDING_UPLOADS=
WARP_MEDIA_LEGACY_UNAUTHENTICATED_DOWNLOADS=

# Push. Defaults true, true, 10s, 720h.
WARP_PUSH_ENABLED=
WARP_PUSH_INCLUDE_CONTENT=
WARP_PUSH_GATEWAY_TIMEOUT=
WARP_PUSH_NOTIFICATION_RETENTION=

# Application services: comma-separated registration files (paths inside
# the container). Timeout default 30s.
WARP_APPSERVICE_CONFIG_FILES=
WARP_APPSERVICE_TIMEOUT=

# Server notices. Defaults false, server-notices, Server Notices, Server
# Notices.
WARP_SERVER_NOTICES_ENABLED=
WARP_SERVER_NOTICES_LOCALPART=
WARP_SERVER_NOTICES_DISPLAY_NAME=
WARP_SERVER_NOTICES_ROOM_NAME=

# Logging: debug, info, warn or error; text or json; file and line.
WARP_LOG_LEVEL=info
WARP_LOG_FORMAT=json
WARP_LOG_ADD_SOURCE=

# Metrics. Defaults true, /metrics.
WARP_METRICS_ENABLED=
WARP_METRICS_PATH=

# OpenTelemetry tracing. Defaults false, localhost:4318, 1, warp.
WARP_TRACING_ENABLED=false
WARP_TRACING_ENDPOINT=
WARP_TRACING_SAMPLE_RATIO=
WARP_TRACING_SERVICE_NAME=


# ----------------------------------------------------------- admin panel

# text or json.
WARP_ADMIN_LOG_FORMAT=json

# ------------------------------------------------------------ web client

# The homeserver's public URL. Set, the browser talks to it directly and
# the web client proxies nothing; empty, it proxies the client API.
WARP_WEB_PUBLIC_HOMESERVER=
# Space-separated origins of the LiveKit JWT service and SFU, for calls.
WARP_WEB_CALL_ORIGINS=
# text or json.
WARP_WEB_LOG_FORMAT=json