warp/Docker/.env.pocketbase.s3.example

# Settings for docker-compose.pocketbase.s3.yml:
# the homeserver on PocketBase with media in an S3 bucket elsewhere, the
# admin panel and the web client, each in its own container.
#
#   cp .env.pocketbase.s3.example .env      # then edit it
#   docker compose -f docker-compose.pocketbase.s3.yml up -d --build
#
# Required, with no default: WARP_PB_S3_ENDPOINT, WARP_PB_S3_ACCESS_KEY
# and WARP_PB_S3_SECRET.
#
# Compose reads .env for the values it puts into the compose file, and hands
# all of it to the containers, so a change takes effect on the next `up -d`.
# An empty value means the built-in default, given in the comment above it;
# every homeserver setting is described in docs/configuration.md.
#
# Set by the compose file, not here: the database driver and connection
# string, and the address the admin panel and web client reach the
# homeserver on.

# ---------------------------------------------------------------- compose

# Host ports for the homeserver, the admin panel and the web client.
WARP_PORT=8008
WARP_ADMIN_PORT=8009
WARP_WEB_PORT=8080

# The PocketBase image; any PocketBase 0.40 or later answers the same.
WARP_PB_IMAGE=tajniak81/pocketbase-docker-root:latest

# PocketBase's port, for its admin UI at http://localhost:8070/_/. It is
# on loopback unless the bind address says otherwise; put the UI behind a
# reverse proxy before binding it to 0.0.0.0.
WARP_PB_BIND=127.0.0.1
WARP_PB_PORT=8070

# The PocketBase superuser the homeserver signs in as, and so can you, in
# the admin UI. The pocketbase container creates it on its first start and
# leaves it alone after that: to change the password, change it in the
# admin UI first, then here. It needs 8 characters or more.
WARP_PB_SUPERUSER_EMAIL=admin@example.org
WARP_PB_SUPERUSER_PASSWORD=change-me-now

# Where the data lives. Empty keeps the named volume in brackets; a
# host path (starting with . or /) bind-mounts that directory instead.
# The homeserver runs as UID 10001; warp-init chowns its directory to it
# before every start. PocketBase runs as root.
# The homeserver's /data (warp-data): its signing key.
WARP_DATA_VOLUME=
# PocketBase's pb_data (pb-data): the database, and media unless it is
# in S3.
WARP_PB_DATA_VOLUME=

# ------------------------------------------------------------- media (S3)

# Media goes to this bucket; the database stays in PocketBase. The bucket
# must already exist: nothing here runs a gateway or creates it. For a
# gateway on the Docker host, use http://host.docker.internal:8333. Media
# stored before S3 was on is not moved into the bucket.
WARP_PB_S3_ENDPOINT=
WARP_PB_S3_BUCKET=warp
WARP_PB_S3_ACCESS_KEY=
WARP_PB_S3_SECRET=
# SeaweedFS and MinIO ignore the region; the client insists on one.
WARP_PB_S3_REGION=us-east-1
# true for SeaweedFS and MinIO, false for AWS S3 proper.
WARP_PB_S3_FORCE_PATH_STYLE=true

# ------------------------------------------------------------ homeserver

# Part of every user and room ID: it cannot be changed later.
WARP_SERVER_NAME=localhost

# What the admin panel calls this server, e.g. Acme Chat. Only a label:
# change it any time, here or in the admin panel (which then wins until
# reset there). Default empty: the panel shows the server name.
WARP_DISPLAY_NAME=

# The URL clients are told to use, in /.well-known/matrix/client.
# Default https://<server name>.
WARP_WELL_KNOWN_CLIENT_BASE_URL=http://localhost:8008
# Default empty.
WARP_WELL_KNOWN_IDENTITY_SERVER_BASE_URL=
# host:port other homeservers should use. Default empty: no delegation.
# With calls on, the well-known service answers it, default <server
# name>:443, also with federation off.
WARP_WELL_KNOWN_SERVER_ADDRESS=

# The first administrator, created with this password on the first start.
# Later starts leave the account as it is: change the password in the
# admin panel. Empty: no account; make one with `warp create-account`.
WARP_ADMIN_USERNAME=
WARP_ADMIN_PASSWORD=

# Registration. Default false; the admin API can switch it at runtime.
WARP_REGISTRATION_ENABLED=false
# Default true.
WARP_REGISTRATION_ALLOW_RUNTIME_TOGGLE=
# Comma-separated sign-up tokens. Default none.
WARP_REGISTRATION_TOKENS=
# Default false.
WARP_REGISTRATION_REQUIRE_TOKEN=

# End-to-end encryption. Default true: people may encrypt their rooms,
# and the apps do so by default. Off, the server refuses to turn it on in
# a room; rooms already encrypted stay so. The admin panel can switch it
# at runtime unless the toggle below is false (default true).
WARP_ENCRYPTION_ENABLED=
WARP_ENCRYPTION_ALLOW_RUNTIME_TOGGLE=

# Federation. Default false.
WARP_FEDERATION_ENABLED=false
# Default true.
WARP_FEDERATION_ALLOW_RUNTIME_TOGGLE=
# Comma-separated server names. Default none.
WARP_FEDERATION_ALLOWLIST=
WARP_FEDERATION_DENYLIST=
WARP_FEDERATION_TRUSTED_KEY_SERVERS=
# Default 24h.
WARP_FEDERATION_KEY_VALIDITY_PERIOD=
# A second, TLS listener for federation, e.g. :8448, with its certificate
# and key (paths inside the container). Publish the port yourself.
WARP_LISTEN_FEDERATION_ADDRESS=
WARP_TLS_CERT_FILE=
WARP_TLS_KEY_FILE=
WARP_FEDERATION_TLS_CA_FILE=

# HTTP server. Defaults 10s, 60s, 120s, 120s, 1048576, 30s.
WARP_READ_HEADER_TIMEOUT=
WARP_READ_TIMEOUT=
WARP_WRITE_TIMEOUT=
WARP_IDLE_TIMEOUT=
WARP_MAX_HEADER_BYTES=
WARP_SHUTDOWN_TIMEOUT=

# Apply pending database migrations at startup. Default true.
WARP_DB_AUTO_MIGRATE=

# Client API. Defaults *, false, 0s (never expire), 0s, true.
WARP_CORS_ALLOWED_ORIGINS=
WARP_TRUST_X_FORWARDED_FOR=
WARP_ACCESS_TOKEN_LIFETIME=
WARP_REFRESH_TOKEN_LIFETIME=
WARP_RATE_LIMIT_ENABLED=

# Calls: the LiveKit JWT service's URL (see docs/calls.md). Default empty.
WARP_RTC_LIVEKIT_SERVICE_URL=
# Delayed events. Defaults 24h, 100.
WARP_DELAYED_EVENTS_MAX_DELAY=
WARP_DELAYED_EVENTS_MAX_PER_USER=
# TURN for legacy 1:1 calls: comma-separated URIs, then a shared secret or
# a static username and password. Lifetime default 1h.
WARP_TURN_URIS=
WARP_TURN_SHARED_SECRET=
WARP_TURN_USER_LIFETIME=
WARP_TURN_USERNAME=
WARP_TURN_PASSWORD=

# Sync. Defaults false, 30s, 30s.
WARP_SYNC_PRESENCE=
WARP_SYNC_TYPING_TIMEOUT=
WARP_SYNC_LONG_POLL_TIMEOUT=

# Media. Defaults 52428800 (50 MiB), 0 (no limit), 32000000, 24h, 10, false.
WARP_MEDIA_MAX_UPLOAD_BYTES=
WARP_MEDIA_MAX_USER_STORAGE_BYTES=
WARP_MEDIA_MAX_THUMBNAIL_PIXELS=
WARP_MEDIA_PENDING_UPLOAD_EXPIRY=
WARP_MEDIA_MAX_PENDING_UPLOADS=
WARP_MEDIA_LEGACY_UNAUTHENTICATED_DOWNLOADS=

# Push. Defaults true, true, 10s, 720h.
WARP_PUSH_ENABLED=
WARP_PUSH_INCLUDE_CONTENT=
WARP_PUSH_GATEWAY_TIMEOUT=
WARP_PUSH_NOTIFICATION_RETENTION=

# Application services: comma-separated registration files (paths inside
# the container). Timeout default 30s.
WARP_APPSERVICE_CONFIG_FILES=
WARP_APPSERVICE_TIMEOUT=

# Server notices. Defaults false, server-notices, Server Notices, Server
# Notices.
WARP_SERVER_NOTICES_ENABLED=
WARP_SERVER_NOTICES_LOCALPART=
WARP_SERVER_NOTICES_DISPLAY_NAME=
WARP_SERVER_NOTICES_ROOM_NAME=

# Logging: debug, info, warn or error; text or json; file and line.
WARP_LOG_LEVEL=info
WARP_LOG_FORMAT=json
WARP_LOG_ADD_SOURCE=

# Metrics. Defaults true, /metrics.
WARP_METRICS_ENABLED=
WARP_METRICS_PATH=

# OpenTelemetry tracing. Defaults false, localhost:4318, 1, warp.
WARP_TRACING_ENABLED=false
WARP_TRACING_ENDPOINT=
WARP_TRACING_SAMPLE_RATIO=
WARP_TRACING_SERVICE_NAME=


# ----------------------------------------------------------- admin panel

# text or json.
WARP_ADMIN_LOG_FORMAT=json

# ------------------------------------------------------------ web client

# The homeserver's public URL. Set, the browser talks to it directly and
# the web client proxies nothing; empty, it proxies the client API.
WARP_WEB_PUBLIC_HOMESERVER=
# Space-separated origins of the LiveKit JWT service and SFU, for calls.
WARP_WEB_CALL_ORIGINS=
# text or json.
WARP_WEB_LOG_FORMAT=json

# ----------------------------------------------------------------- calls

# LiveKit and the LiveKit JWT service, in containers of their own, for
# calls (docs/calls.md). They start only with the calls profile: set
# COMPOSE_PROFILES=calls. Then set WARP_RTC_LIVEKIT_SERVICE_URL to the JWT
# service's public URL, and WARP_WEB_CALL_ORIGINS to that URL and
# LIVEKIT_PUBLIC_URL, space-separated.
COMPOSE_PROFILES=
# LiveKit's public WebSocket URL, behind a TLS proxy, e.g.
# wss://livekit.example.org. Required for calls.
LIVEKIT_PUBLIC_URL=
# The API key LiveKit and the JWT service share. Key default warp; the
# secret is required for calls, 32 characters or more
# (openssl rand -hex 32).
LIVEKIT_KEY=
LIVEKIT_SECRET=
# Host ports for LiveKit's signalling (proxied as LIVEKIT_PUBLIC_URL) and
# the JWT service (proxied as WARP_RTC_LIVEKIT_SERVICE_URL). Defaults 7880,
# 8071.
LIVEKIT_PORT=
LIVEKIT_JWT_PORT=
# Media, straight from the browsers, not through the proxy: forward both
# from the internet to this host. Defaults 7881 (TCP), 7882 (UDP).
LIVEKIT_RTC_TCP_PORT=
LIVEKIT_RTC_UDP_PORT=
# The address browsers send media to. Default: the public address,
# found over STUN; LIVEKIT_NODE_IP gives it instead. Default true, empty.
LIVEKIT_USE_EXTERNAL_IP=
LIVEKIT_NODE_IP=
# Defaults livekit/livekit-server:v1.13.7 and
# ghcr.io/element-hq/lk-jwt-service:0.8.0.
LIVEKIT_IMAGE=
LIVEKIT_JWT_IMAGE=
# Host port of the service answering /.well-known/matrix/server for the
# JWT service: route that path to it on the proxy. Default 8072.
WARP_WELL_KNOWN_PORT=
# Default caddy:2.10.2-alpine.
WARP_WELL_KNOWN_IMAGE=