.env.example

# =============================================================================
# atl.chat base environment (.env.example)
# Copy to .env and adjust values. This file is the shared baseline for both
# dev and prod. Use .env.dev / .env.prod for mode-specific overrides.
#
# Prosody reads many optional tuneables from the environment (see
# apps/prosody/config/prosody.cfg.lua). Only the most common ones are listed
# here; the rest use safe defaults when unset.
# =============================================================================

# -----------------------------------------------------------------------------
# Core
# -----------------------------------------------------------------------------
PUID=1000
PGID=1000
TZ=UTC

# Host networking defaults (dev-friendly baseline)
ATL_GATEWAY_IP=127.0.0.1
ATL_CHAT_IP=127.0.0.1

# Logging
LOG_MAX_SIZE=50m
LOG_MAX_FILES=5

# TLS automation (prod use)
LETSENCRYPT_EMAIL=admin@allthingslinux.org
CLOUDFLARE_DNS_API_TOKEN=

# -----------------------------------------------------------------------------
# Explicit mode behavior (no ATL_ENVIRONMENT)
# -----------------------------------------------------------------------------
IRC_TLS_VERIFY=false
IRC_LOUNGE_REJECT_UNAUTHORIZED=false
IRC_WEBSOCKET_USE_TLS=true
BRIDGE_IRC_TLS_VERIFY=false

# -----------------------------------------------------------------------------
# IRC / UnrealIRCd
# -----------------------------------------------------------------------------
UNREALIRCD_VERSION=6.2.0.1

IRC_DOMAIN=irc.localhost
IRC_ROOT_DOMAIN=atl.chat
IRC_NETWORK_NAME=All Things Linux IRC
IRC_CLOAK_PREFIX=atl

IRC_TLS_PORT=6697
IRC_SERVER_PORT=6900
IRC_RPC_PORT=8600
IRC_WEBSOCKET_PORT=8000

IRC_ADMIN_NAME=All Things Linux
IRC_ADMIN_EMAIL=admin@allthingslinux.org
IRC_STAFF_VHOST=allthingslinux.org

IRC_STS_DURATION=1m
IRC_STS_PRELOAD=no

# Runtime cert paths inside container (shared cert mount)
IRC_SSL_CERT_PATH=/home/unrealircd/unrealircd/certs/live/irc.localhost/fullchain.pem
IRC_SSL_KEY_PATH=/home/unrealircd/unrealircd/certs/live/irc.localhost/privkey.pem

# Secrets (replace before non-local use)
IRC_CLOAK_KEY_1=replace_with_cloak_key_1
IRC_CLOAK_KEY_2=replace_with_cloak_key_2
IRC_CLOAK_KEY_3=replace_with_cloak_key_3
IRC_OPER_PASSWORD=change_me_irc_oper_password
IRC_DRPASS=change_me_irc_drpass
IRC_SERVICES_PASSWORD=change_me_irc_services_password
ATL_WEBIRC_PASSWORD=change_me_webirc_password
WEBPANEL_RPC_USER=adminpanel
WEBPANEL_RPC_PASSWORD=change_me_webpanel_password

# -----------------------------------------------------------------------------
# Atheme (reduced env surface)
# -----------------------------------------------------------------------------
ATHEME_VERSION=master
ATHEME_SERVER_NAME=services.atl.chat
ATHEME_SERVER_DESC=All Things Linux IRC Services
ATHEME_NUMERIC=00A
ATHEME_RECONTIME=10
ATHEME_NETNAME=atl.chat
ATHEME_HIDEHOST_SUFFIX=users.atl.chat
ATHEME_ADMIN_NAME=All Things Linux
ATHEME_ADMIN_EMAIL=admin@allthingslinux.org
ATHEME_REGISTER_EMAIL=noreply@allthingslinux.org
ATHEME_UPLINK_HOST=127.0.0.1
ATHEME_UPLINK_PORT=6901
ATHEME_HTTPD_PORT=8081
ATHEME_SRA_BOOTSTRAP_ACCOUNT=admin
ATHEME_HELP_CHANNEL=#help
ATHEME_HELP_URL=https://allthingslinux.org

# -----------------------------------------------------------------------------
# XMPP / Prosody
# -----------------------------------------------------------------------------
XMPP_DOMAIN=xmpp.localhost
PROSODY_DOMAIN=xmpp.localhost

# Storage: omit PROSODY_STORAGE (default sqlite file in prosody.cfg.lua) for normal dev.
# For PostgreSQL-backed storage, set PROSODY_STORAGE=sql and network driver vars:
# PROSODY_STORAGE=sql
# PROSODY_DB_DRIVER=PostgreSQL
# PROSODY_DB_HOST=xmpp-postgres
# PROSODY_DB_PORT=5432
# PROSODY_DB_NAME=prosody
# PROSODY_DB_USER=prosody
# PROSODY_DB_PASSWORD=

PROSODY_C2S_PORT=5222
PROSODY_S2S_PORT=5269
PROSODY_C2S_DIRECT_TLS_PORT=5223
PROSODY_S2S_DIRECT_TLS_PORT=5270
PROSODY_HTTP_PORT=5280
PROSODY_HTTPS_PORT=5281
# atl-xmpp-nginx maps 127.0.0.1:443 → :443 (same TLS as :5281) so https://<XMPP_DOMAIN>/… works without :5281 (Fluux host-meta, default wss). Remove that mapping in infra/compose/xmpp.yaml if 127.0.0.1:443 is already taken.
PROSODY_PROXY65_PORT=5000

PROSODY_ADMIN_JID=admin@xmpp.localhost
PROSODY_ADMIN_EMAIL=admin@allthingslinux.org
PROSODY_OAUTH2_REGISTRATION_KEY=change_me_prosody_oauth2_registration_key
PROSODY_ALLOW_PLACEHOLDER_KEY=true

PROSODY_HTTPS_VIA_PROXY=false
PROSODY_UPLOAD_EXTERNAL_URL=https://xmpp.localhost:5281/upload/
PROSODY_HTTP_EXTERNAL_URL=http://xmpp.localhost:5280/
PROSODY_PROXY_ADDRESS=xmpp.localhost
PROSODY_SSL_KEY=/etc/prosody/certs/live/xmpp.localhost/privkey.pem
PROSODY_SSL_CERT=/etc/prosody/certs/live/xmpp.localhost/fullchain.pem

PROSODY_REST_URL=http://atl-xmpp-server:5280/admin_api
PROSODY_REST_TOKEN=
PROSODY_FEED_URL=https://allthingslinux.org/feed

# TURN (optional)
TURN_SECRET=change_me_turn_secret
TURN_EXTERNAL_HOST=turn.atl.network
TURN_PORT=3478
TURNS_PORT=5349

# -----------------------------------------------------------------------------
# Bridge
# -----------------------------------------------------------------------------
BRIDGE_DISCORD_TOKEN=
BRIDGE_DISCORD_CHANNEL_ID=

BRIDGE_PORTAL_BASE_URL=
BRIDGE_PORTAL_TOKEN=

IRC_BRIDGE_SERVER=atl-irc-server
BRIDGE_IRC_NICK=bridge
BRIDGE_IRC_OPER_PASSWORD=

BRIDGE_XMPP_COMPONENT_JID=bridge.xmpp.localhost
BRIDGE_XMPP_COMPONENT_SECRET=change_me_xmpp_component_secret
BRIDGE_XMPP_COMPONENT_SERVER=atl-xmpp-server
BRIDGE_XMPP_COMPONENT_PORT=5347
# Append to Discord→XMPP puppet MUC nicks. Required when a real XMPP user is in the same room with the
# same nick (otherwise join_muc_wait times out). Example: BRIDGE_XMPP_PUPPET_NICK_SUFFIX=_d → occupant kaizen_d;
# join presence also includes XEP-0172 display nick kaizen (client-dependent).
# BRIDGE_XMPP_PUPPET_NICK_SUFFIX=

BRIDGE_RELAYMSG_CLEAN_NICKS=true
BRIDGE_IRC_REDACT_ENABLED=true
# Bridge container only; prepare-config also maps BRIDGE_IRC_TLS_VERIFY → IRC_TLS_VERIFY for UnrealIRCd.
BRIDGE_IRC_TLS_VERIFY=false
LOG_LEVEL=INFO

# Optional bridge helpers
XMPP_AVATAR_BASE_URL=http://atl-xmpp-server:5280
XMPP_AVATAR_PUBLIC_URL=
XMPP_UPLOAD_FETCH_URL=http://atl-xmpp-server:5280

# -----------------------------------------------------------------------------
# The Lounge / web IRC
# -----------------------------------------------------------------------------
THELOUNGE_PORT=9000
THELOUNGE_WEBIRC_PASSWORD=change_me_thelounge_webirc
THELOUNGE_DELETE_UPLOADS_AFTER_MINUTES=1440

# -----------------------------------------------------------------------------
# Web frontend (apps/web)
# -----------------------------------------------------------------------------
NEXT_PUBLIC_IRC_WS_URL=wss://irc.localhost/ws
# Match PROSODY_HTTPS_PORT / atl-xmpp-nginx (TLS on 5281, not default 443).
NEXT_PUBLIC_XMPP_BOSH_URL=https://xmpp.localhost:5281/http-bind
# WebSocket transport: wss://xmpp.localhost:5281/xmpp-websocket (canonical) or .../ws (nginx alias)

# -----------------------------------------------------------------------------
# Fluux messenger
# -----------------------------------------------------------------------------
FLUUX_VERSION=v0.13.3
FLUUX_DOMAIN=webxmpp.atl.chat
FLUUX_CERT_DOMAIN=atl.chat
FLUUX_MESSENGER_PORT=8091
FLUUX_MESSENGER_HTTPS_PORT=8443

# -----------------------------------------------------------------------------
# Optional — only if you use these compose fragments / overrides
# -----------------------------------------------------------------------------
# UnrealIRCd → Atheme link target (default: ATHEME_SERVER_NAME, else services.${IRC_ROOT_DOMAIN})
# IRC_SERVICES_SERVER=services.atl.chat

# UnrealIRCd GeoIP classic (downloads DBs at startup; off by default in dev via prepare-config)
# IRC_ENABLE_GEOIP_CLASSIC=true

# WebPanel port mapping (infra/compose/irc.yaml)
# WEBPANEL_PORT=8080

# Prosody MUC webchat / Fluux integration (compose passes XMPP_WEBCHAT_URL)
# XMPP_WEBCHAT_URL=

# Let's Encrypt helper (infra/compose/cert-manager.yaml)
# SSL_DOMAIN=

# ObsidianIRC (infra/compose/obsidianirc.yaml)
# OBSIDIANIRC_PORT=8090
# OBSIDIANIRC_IRC_WS_URL=wss://irc.localhost/ws
# OBSIDIANIRC_SERVER_NAME=irc.localhost
# OBSIDIANIRC_AUTOJOIN=#general