# Non-secret settings for the reference deployment's Compose project. Copy to deploy/.env, which
# Compose reads automatically from this directory. Nothing here is a secret; secrets live in the
# per-service files under EKKLESIA_ENV_DIR.

# Which Compose files make up this installation, so that every plain `docker compose …` command
# run from this directory, operator commands through `migrate` included, sees the same services and
# settings as the running stack. Add compose.tunnel.yaml if you use the tunnel connector. Without
# the proxy overlay here, Doctor checks a `migrate` that lacks the API's client-address settings.
COMPOSE_FILE=compose.yaml:compose.proxy.yaml

# The image to run, by registry, name, and tag (or digest). Required.
EKKLESIA_IMAGE=

# Where the root-owned, mode-600 env files and the TLS directory live on the host.
EKKLESIA_ENV_DIR=/etc/ekklesia
EKKLESIA_TLS_DIR=/etc/ekklesia/tls

# --- compose.proxy.yaml ---------------------------------------------------------------------------
# The Ekklesia hostname and the storage hostname (signed object URLs). In the default same-origin
# topology (Caddyfile.example) EKKLESIA_HOSTNAME serves the Dashboard, the API, and displays.
EKKLESIA_HOSTNAME=
EKKLESIA_STORAGE_HOSTNAME=
# The split topology only (ADR 0045, Caddyfile.split.example): the Dashboard's own hostname, while
# EKKLESIA_HOSTNAME is the API's and the displays'. Both must share one registrable domain, for
# example dash.example.org and api.example.org. Leave empty for the same-origin topology.
EKKLESIA_DASHBOARD_HOSTNAME=
# Contact address for the ACME account (certificate expiry notices).
EKKLESIA_ACME_EMAIL=
# EKKLESIA_CADDYFILE=./Caddyfile
# EKKLESIA_PUBLISH_ADDRESS=0.0.0.0
# EKKLESIA_HTTP_PORT=80
# EKKLESIA_HTTPS_PORT=443

# The edge network. Change the subnet only if it collides with one already on the host. Docker
# assigns dynamic addresses only from EKKLESIA_EDGE_DYNAMIC_RANGE (the lower half); the proxy and
# the tunnel connector take fixed addresses from the upper half, so nothing else can ever hold them.
# EKKLESIA_EDGE_SUBNET=10.249.250.0/24
# EKKLESIA_EDGE_DYNAMIC_RANGE=10.249.250.0/25
# EKKLESIA_PROXY_ADDRESS=10.249.250.254
# EKKLESIA_TUNNEL_ADDRESS=10.249.250.253