Phraseanet/.env

###
#
# Environment variables are assigned at different times in docker.
# 3 tags make it possible to distinguish them :
#
# - @install
# - @build
# - @run
#
# The "@deprecated" tag targets a deprecated variable.
#
# For better readability, see url below :
# https://docs.phraseanet.com/4.1/en/Admin/EnvironnementVariables.html


# --- ATTENTION POINTS FOR PHRASEANET CONFIGURATION -------------------------------------------------------------------
# 1. Default Passwords: Ensure all default passwords defined in this configuration are changed to secure, personalized passwords before deployment.
# 2. MariaDB Container: The provided MariaDB container is not ready for production as-is and requires adjustments. It is recommended to use an external, redundant service for the primary datastore.
# 3. Configuration Persistence: Changes made in this file need appropriate backups as they are crucial for system restoration and disaster recovery.
# 4. Environment Specifics: Ensure that settings like database hosts, ports, and credentials are correctly configured for your specific environment.
# 5. Environment Variable Customization: Environment variables should be tailored to fit the specific needs and usage intentions of the application. Always review and adjust these settings to align with operational requirements.
# 6. Plugin Dependencies: some features, such as SAML authentication, require additional paid plugins not included in the public images.



# --- Phraseanet stack composition -------------------------------------------------------------------------------------

# Stack composition use "COMPOSE_FILES" and "COMPOSE_PROFILES" variables. Use it
# to adapt the stack in accordance with your needs.
#
# 1/ "COMPOSE_FILE" value define docker-compose files to include. See available
# files list below :
# - "docker-compose.yml"            : Services Nginx, Phraseanet, workers,
#                                     scheduler
# - "docker-compose.datastores.yml" : All data storage services required by
#                                     Phraseanet except for files storage.
# - "docker-compose.tools.yml"      : Dev and debug tools
# - "docker-compose.override.yml"   : For dev only, use the code from hosts,
#                                     activate ide debugger, ports mapping for
#                                     datastores
# - "docker-compose.phrasea.yml"    : For integrate this stack in the "traefik" of Phrasea stack
#
# - "docker-compose.limits.yml"     : defines containers cpu and memory limits for all Phraseanet and gateway containers only.
#
# - "docker-compose.alternatives.yml": all alternative services, used only on evolution or transition or testing periods
#
# 2/ "COMPOSE_PROFILES" value define which profiles you want to use
# in docker-compose.
# See available services and worker profiles below:
#
# Profiles service list:
# - "app"             : launch Phraseanet and Workers.
# - "setup"           : launch a Phraseanet installation and configuration container, this container is launched to perform a default installation and
#                       each time it is necessary to update the Phraseanet configuration using the env variables.
#                       when an update is performed, the current phraseanet 'config/' repository is backuped in  
# - "gateway-classic" : launch Nginx service.
# - "gateway-traefik" : Nginx is launched behind a traefik service, at this time `traefik` is not include in this stack but you can use your own
#                       or use `Traefik` include in Phrasea Stack.
# - "workers"         : launch one worker container by kind of Jobs, you can also
#                       choose to launch only some workers, see worker profile list below.
# - "worker"          : launch one container worker with all jobs run on it.
# - "cmd"             : launch a container based on worker image, useful for run cmd manualy. 
# - "db"              : db profile will launch a mariadb container, with data stored on host and mounted in the db container.
#                       because this is the primary datastore, you should use you own SGDD service for production needs.
# - "db-docker-vol"   : same as "db" profile but with data stored in a docker volume.
# - "elastisearch"    : launch a elasticsearch container.
# - "rabbitmq"        : launch a rabbitmq container.
# - "redis"           : launch a redis container for app cache.
# - "redis-session"   : launch a redis container for store fpm session.
# - "builder"         : launch the builder container, for dev only.
# - "elk"             : launch an elk stack, for dev only.
# - "squid"           : reverse proxy for dev only.
# - "mailhog"         : for catching all email emit by app for dev and testing.
# - "db-backup"       : launch and run a container to cron database backups and backup file's rotation.
# - "pma"             : launch a phpmyadmin container for test and dev purpose.
# - "db-mysql8"       : launch a mysql8 container (beta), (/!\ do not mix with the "db" profile)
#                       Because this is the primary datastore, you should use you own SGDD service for production needs.
#
# Profiles worker list:
# - "assetsInjest"
# - "createRecord"
# - "deleteRecord"
# - "editRecord"
# - "exportMail"
# - "downloadAsync"
# - "exposeUpload"
# - "exportFtp"
# - "mainQueue"
# - "populateIndex"
# - "pullAssets"
# - "recordsActions"
# - "subdefCreation"
# - "subtitle" Not working (fixed in a future version)
# - "validationReminder"
# - "webhook"
# - "writeMetadatas"
# - "shareBasket"
#
# - "scheduler" : legacy task manager. Warning! Use only if your stack
#                 require using old task.
#
# See [Docker compose profile documentation|https://docs.docker.com/compose/profiles/]
# for more information about docker compose profiles.
#
#
# See below some examples of stack composition:
#
# For development:
# - COMPOSE_FILE=docker-compose.yml:docker-compose.datastores.yml:docker-compose.tools.yml:docker-compose.override.yml
# - COMPOSE_PROFILES=app,setup,db,pma,elasticsearch,redis,redis-session,rabbitmq,workers,mailhog,builder,gateway-classic,cmd
#
# For testing with tools:
# - COMPOSE_FILE=docker-compose.yml:docker-compose.datastores.yml:docker-compose.tools.yml
# - COMPOSE_PROFILES=app,setup,db,pma,elasticsearch,rabbitmq,redis,redis-session,workers,cmd,mailhog,gateway-classic
#
# # To test with tools and apply resources throttling on Phraseanet containers :
# - COMPOSE_FILE=docker-compose.yml:docker-compose.datastores.yml:docker-compose.tools.yml:docker-compose.limits.yml
# - COMPOSE_PROFILES=app,setup,db,pma,elasticsearch,rabbitmq,redis,redis-session,workers,cmd,mailhog,gateway-classic
#
# For testing with debug and SSL (the traekik is provide by Phrasea stack):
# - COMPOSE_FILE=docker-compose.yml:docker-compose.datastores.yml:docker-compose.tools.yml:docker-compose.under-phrasea.yml
# - COMPOSE_PROFILES=app,setup,gateway-traefik,db,pma,elasticsearch,rabbitmq,redis,redis-session,worker,workers,mailhog
#
# For production (require using your own databases services and SSL):
# - COMPOSE_FILE=docker-compose.yml:docker-compose.datastores.yml:docker-compose.tools.yml:docker-compose.scheduler.yml
# - COMPOSE_PROFILES=app,setup,workers,gateway-traefik
#
# Example with all profiles:
# - COMPOSE_FILE=docker-compose.yml:docker-compose.datastores.yml:docker-compose.tools.yml:docker-compose.limits.yml
# - COMPOSE_PROFILES=app,setup,gateway-classic,db,elasticsearch,redis,redis-session,rabbitmq,pma,mailhog,assetsInjest,createRecord,deleteRecord,editRecord,
#                    exportMail,downloadAsync,exposeUpload,exportFtp,mainQueue,populateIndex,pullAssets,recordsActions,subdefCreation,
#                    validationReminder,webhook,writeMetadatas,shareBasket,scheduler,cmd,elk,db-backup,phraseanet-saml-sp
#


# Define "docker-compose" files to include.
# @run
COMPOSE_FILE=docker-compose.yml:docker-compose.datastores.yml:docker-compose.tools.yml

# Define which profiles you want to use in "docker-compose".
# @run
COMPOSE_PROFILES=app,setup,gateway-classic,db,elasticsearch,rabbitmq,redis,redis-session,worker,mailhog,db-backup



# --- Phraseanet container settings ------------------------------------------------------------------------------------

# Registry from which you pull docker images.
# Avalaible values:
# - "local"     : build and use your images.
# - "alchemyfr" : using predbuild images from Alchemy registry from dockerhub.
#
# @run
PHRASEANET_DOCKER_REGISTRY=alchemyfr

# Docker images tag.
# @run
PHRASEANET_DOCKER_TAG=4.1.20

# Stack Name
# An optionnal Name for the stack
# @run
STACK_NAME=

# --- CPU and Memory Configuration for Docker Services -------------------------------------------------------------------
# These settings are only active if 'docker-compose.limits.yml' is specified in the COMPOSE_FILE variable.
# they define the resources allocated to the containers, for more explanation see the docker compose documentation

# Number of CPUs allocated to the worker service.
# @run
WORKER_CPU=2

# Number of CPUs allocated to the gateway service.
# @run
GATEWAY_CPU=2

# Number of CPUs allocated to the PHP-FPM service.
# @run
FPM_CPU=2

# Maximum memory that the worker service can use.
# @run
WORKER_MEMORY_LIMIT=2048M

# Maximum memory that the gateway service can use.
# @run
GATEWAY_MEMORY_LIMIT=2048M

# Maximum memory that the PHP-FPM service can use.
# @run
FPM_MEMORY_LIMIT=2048M

# Reserved memory for the worker service.
# @run
WORKER_MEMORY_RESERVATION=256M

# Reserved memory for the gateway service.
# @run
GATEWAY_MEMORY_RESERVATION=256M

# Reserved memory for the PHP-FPM service.
# @run
FPM_MEMORY_RESERVATION=256M


# --- Phraseanet container network settings ------------------------------------------------------------------------------------
# Phraseanet network settings are used to define the network configuration 
# of the Phraseanet stack when traefik is used.
# see phraseanet under traefik in Phrasea stack

# Phrasea network Name, the name of Phrasea network and see by traefik
# @run
PHRASEA_NETWORK_NAME=ps_internal

# Domain Name used by traefik in Phrasea stack
# @run
PHRASEA_DOMAIN=phrasea.local

# Phrasea Gateway IP, the IP of the gateway container (traefik) in the Phrasea stack
# @run
PHRASEA_GATEWAY_IP=172.30.0.1

# Phrasea Gateway Name, the name of the gateway container (traefik) in the Phrasea stack
# @run
PHRASEA_COMPOSE_PROJECT_NAME=ps


# --- Phraseanet container entrypoint settings -------------------------------------------------------------------------

# Do an installation if Phraseanet is not installed.
# Avalaible values: "0" | "1"      
# @run
PHRASEANET_INSTALL=1

# Apply they env variables values to config/configuration.yml file.
# Avalaible values: "0" | "1"
# @run
PHRASEANET_SETUP=1

# Play an upgrade.
# Avalaible values: "0" | "1"
# @run
PHRASEANET_UPGRADE=0

# Maintenance mode
# show an Nginx unavailability message
# Available values: "0" | "1" 
# 0 - for no maintenance mode
# 1 - for persisting maintenance mode 
# During an upgrade, the unavailability message is automatically activated with a default message
# "We are performing scheduled maintenance and will be back online in a few minutes."
# @run
PHRASEANET_MAINTENANCE=0

# Customize the maintenance message
# this is possible to customize the displayed maintenance message.
# Note: space needs to be encoded with space html character, quote and double quote need to be escaped 
# Example :
# PHRASEANET_MAINTENANCE_MESSAGE="<p>Under&#32;maintenance!</p><p>More&#32;information&#32;<a href=\"https://www.yoururl.fr\">here</a></p>"
# @run
PHRASEANET_MAINTENANCE_MESSAGE=

# --- RabbitMQ settings ------------------------------------------------------------------------------------------------

# RabbitMQ user account : create an account in RabbitMQ container and use it
# in Phraseanet configuration.
# @run
RABBITMQ_DEFAULT_USER=alchemy

# RabbitMQ password account.
# @run
RABBITMQ_DEFAULT_PASS=vdh4dpe5Wy3R

# RabbitMQ Http interface management port.
# @run
RABBITMQ_MANAGEMENT_PORT=10811

# rabbit hostname, need also for the name of rabbit database dir to avoid random name after dc down/up
# @run
RABBITMQ_HOSTNAME=rabbit_phraseanet

# @run
RABBITMQ_IMAGE_TAG=rabbitmq:4.1.0-management

# --- Gateway settings (Nginx) -----------------------------------------------------------------------------------------

# Value applied to "send_timeout", "keepalive_timeout", "client_header_timeout"
# and "client_body_timeout" Nginx settings.
# @run
GATEWAY_SEND_TIMEOUT=120

# Timeout for establishing a connection with a proxied server. See [documentation|
# https://nginx.org/en/docs/http/ngx_http_proxy_module.html#proxy_connect_timeout].
# @run
GATEWAY_PROXY_TIMEOUT=120

# Value applied to "fastcgi_connect_timeout", "fastcgi_read_timeout"
# and "fastcgi_send_timeout" Nginx settings.
# @run
GATEWAY_FASTCGI_TIMEOUT=300

# --- Gateway restricted access settings (Nginx) -----------------------------------------------------------------------------------------
# Activate application access restrictions.
# Restrictions can be based on IP and/or password. Use these settings to control who can access the application.

# Allowed IPs: Comma-separated list of IP addresses that are allowed to access the gateway.
# Uncomment and specify IPs to enable. Example: GATEWAY_ALLOWED_IPS=10.0.0.1,10.0.1.1
# @run
GATEWAY_ALLOWED_IPS=

# Denied IPs: Comma-separated list of IP addresses that are denied access to the gateway.
# Uncomment and specify IPs to enable. Example: GATEWAY_DENIED_IPS=172.1.0.1,172.1.0.2
# @run
GATEWAY_DENIED_IPS=

# Users: Specifies credentials for accessing the gateway. Format "username:password".
# Uncomment and specify user credentials to enable. Example: GATEWAY_USERS="user1:password1,user2:password2"
# @run
GATEWAY_USERS=

# Status and ping access Allowed IPs: Comma-separated list of IP addresses that are allowed to access the /status or /ping pages.
# Uncomment and specify IPs to enable. Example: GATEWAY_STATUS_ALLOWED_IPS=10.0.0.1,10.0.1.1
# @run
GATEWAY_STATUS_ALLOWED_IPS=

# --- Gateway HTTP requests quota management (Nginx) -----------------------------------------------------------------------------------------
# Manage http incoming request limits by verbs using the "ngx_http_limit_req_module" module.
# this feature is based on ip adresses and need PHRASEANET_TRUSTED_PROXIES defined to get real_ip
# READ is for GET and HEAD requests
# WRITE is for POST, PUT, DELETE and PATCH requests
# Enabling the requests Limit
# @run
HTTP_REQUEST_LIMITS=false

# In megabyte For Exemple 16,000 IP addresses takes 1 megabyte, so our zone can store about 160,000 addresses.
# @run
HTTP_READ_REQUEST_LIMIT_MEMORY=10

# request/seconde, sets the maximum request rate. By default here the rate cannot exceed 100 requests per second
# @run
HTTP_READ_REQUEST_LIMIT_RATE=100

# The burst parameter defines how many requests a client can make in excess of the rate specified
# @run
HTTP_READ_REQUEST_LIMIT_BURST=20

# (m) For Exemple 16,000 IP addresses takes 1 megabyte, so our zone can store about 160,000 addresses.
# @run
HTTP_WRITE_REQUEST_LIMIT_MEMORY=10

# (r/s) Sets the maximum request rate. By default here the rate cannot exceed 10 requests per second
# @run
HTTP_WRITE_REQUEST_LIMIT_RATE=100

# The burst parameter defines how many requests a client can make in excess of the rate specified
# @run
HTTP_WRITE_REQUEST_LIMIT_BURST=20

# --- Gateway HTTPS settings (Nginx) ------------------------------------------------------------------------------------
# https and reverse proxy (on/off)
# set to on in the case : https behind a proxy
# @run
GATEWAY_FASTCGI_HTTPS=off

# --- Gateway CSP settings (Nginx) --------------------------------------------------------------------------------------
# Content Security Policy (CSP)
# helps to detect and mitigate some types of attacks, including Cross-Site Scripting (XSS).
# CSP default values are included in the "Gateway" container entrypoint.
# Use GATEWAY_CSP env var if you want to define yours or override Gateway default CSP values.

# default value GATEWAY_CSP="default-src 'self' 127.0.0.1 https://sockjs-eu.pusher.com:443 wss://ws-eu.pusher.com https://apiws.carrick-skills.com:8443 https://apiws.carrick-flow.com:8443 https://fonts.gstatic.com *.tiles.mapbox.com https://api.mapbox.com https://events.mapbox.com *.axept.io *.matomo.cloud *.newrelic.com *.nr-data.net https://www.googletagmanager.com *.google-analytics.com *.phrasea.io https://apiws.carrick-flow.com:8443 https://apiws.carrick-skills.com:8443  https://maxcdn.bootstrapcdn.com data: ; script-src 'unsafe-inline' 'unsafe-eval' 'self' https://www.gstatic.com *.alchemyasp.com *.axept.io *.matomo.cloud *.newrelic.com https://www.googletagmanager.com https://apiws.carrick-flow.com:8443 https://apiws.carrick-skills.com:8443  https://maxcdn.bootstrapcdn.com  data: blob: ; style-src 'self' 'unsafe-inline' https://fonts.gstatic.com https://fonts.googleapis.com https://www.google.com https://www.gstatic.com https://apiws.carrick-flow.com:8443 https://apiws.carrick-skills.com:8443  https://maxcdn.bootstrapcdn.com ; img-src 'self'  data: blob: *.tiles.mapbox.com https://axeptio.imgix.net *.cloudfront.net *.phrasea.io *.amazonaws.com https://apiws.carrick-flow.com:8443 https://apiws.carrick-skills.com:8443  https://maxcdn.bootstrapcdn.com https://www.gnu.org/graphics/ ; object-src 'self'; frame-ancestors 'self'"
# @run
GATEWAY_CSP=

# --- PHP settings -----------------------------------------------------------------------------------------------------

# Maximum request body size for Php and Nginx. Example "1G"
# @run
MAX_BODY_SIZE=1G

# Maximum Php input var. See [max-input-vars Php documentation|
# https://www.php.net/manual/en/info.configuration.php#ini.max-input-vars].
# @run
MAX_INPUT_VARS=12000

# Maximum Php execution time in second. See [max-execution-time Php documentation|
# https://www.php.net/manual/en/info.configuration.php#ini.max-execution-time].
# @run
MAX_EXECUTION_TIME=120

# Maximum Php input time in second. See [max-input-time Php documentation|
# https://www.php.net/manual/en/info.configuration.php#ini.max-input-time].
# @run
MAX_INPUT_TIME=60

# Php timeout for serving a single request after which the worker process will
# be killed. This option should be used when the "max_execution_time" ini option
# does not stop script execution for some reason. A value of "0" means "off".
# Available units: s(econds)[default], m(inutes), h(ours), or d(ays).
# @run
REQUEST_TERMINATE_TIMEOUT=300s

# Maximum amount of memory a script may consume (128MB)
# http://php.net/memory-limit
# Memory limit in FPM context
# @run
FPM_MEMORY_LIMIT=2048M
# Memory limit for php-cli
# @run
PHP_CLI_MEMORY_LIMIT=2048M

# Temporary directory for HTTP uploaded files (will use system default if not
# specified).
# http://php.net/upload-tmp-dir
# @run
PHP_UPLOAD_TMP_DIR=/var/alchemy/Phraseanet/tmp/php_upload_tmp

# Php Opcache status. See [opcache Php documentation|
# https://www.php.net/manual/en/intro.opcache.php].
# Avalaible values: "0" | "1"
# @run
OPCACHE_ENABLED=1

# Php session cache limiter. See [session-cache-limiter Php documentation|
# https://www.php.net/manual/en/function.session-cache-limiter].
# Avalaible values: "off" | "on"
# @run
SESSION_CACHE_LIMITER=off

# Php logging level. See [error-reporting Php documentation|
# https://www.php.net/manual/en/function.error-reporting.php].
# Available values: "alert" | "error" | "warning" | "notice" | "debug"
# @run
PHP_LOG_LEVEL=warning

# PHP Handler used to store/retrieve data.
# http://php.net/session.save-handler
# session handler can be "files" and path must be than
# @run
SESSION_SAVE_HANDLER=redis
# @run
SESSION_SAVE_PATH=tcp://redis-session:6379

# PHP session cookies to be secured 
# only works if the application is under ssl protection
# @run
COOKIE_SECURE=false

# FPM
# Choose how the process manager will control the number of child processes.
# Possible Values:
# static  - a fixed number (pm.max_children) of child processes;
# dynamic - the number of child processes are set dynamically based on the
# @run
FPM_PM_TYPE=dynamic

# FPM
# The number of child processes to be created when pm is set to 'static' and the
# maximum number of child processes when pm is set to 'dynamic' or 'ondemand'.
# @run
FPM_MAXCHILDREN=9

# FPM
# The number of child processes created on startup.
# Note: Used only when pm is set to 'dynamic'
# @run
FPM_STARTSERVERS=3

# FPM
# The desired minimum number of idle server processes.
# Note: Used only when pm is set to 'dynamic'
# Note: Mandatory when pm is set to 'dynamic'
# @run
FPM_MINSPARESERVER=2

# FPM
# The desired maximum number of idle server processes.
# Note: Used only when pm is set to 'dynamic'
# Note: Mandatory when pm is set to 'dynamic'
# @run
FPM_MAXSPARESERVER=4

# FPM 
# The number of requests each child process should execute before respawning.
# @run
FPM_MAX_REQUESTS=1000

# --- MySQL settings ---------------------------------------------------------------------------------------------------

# MySQL root password.
# A change is mandatory for security reasons.
# @build
MYSQL_ROOT_PASSWORD=root

# MySQL server host address.
# @build
SERVER_NAME=phraseanet-docker

# MySQL maximum allowed packet.
# Value applied to "max_allowed_packet" MySQL server setting.
# @run
MYSQL_MAX_ALLOWED_PACKET=16M

# Value applied to "max_connection" MySQL server setting.
# @run
MYSQL_MAX_CONNECTION=200

# Enable the slow query log to see queries with especially long duration.
# Value applied to "slow_query_log" MySQL server setting.
# @run
MYSQL_SLOW_QUERY_LOG=0

# Value applied to "long_query_time" MySQL server setting.
# @run
MYSQL_LONG_QUERY_TIME=10

# Cache only tiny result sets, so we can fit more in the query cache.
# Value applied to "query_cache_limit" MySQL server setting.
# @run
MYSQL_QUERY_CACHE_LIMIT=128k

# Value applied to "query_cache_size" MySQL server setting.
# @run
MYSQL_QUERY_CACHE_SIZE=64M

# Value applied to "key_buffer_size" MySQL server setting.
# @run
MYSQL_KEY_BUFFER_SIZE=128M

# Value applied to "connect_timeout" MySQL server setting.
# @run
MYSQL_CONNECT_TIMEOUT=60

# Value applied to "wait_timeout" MySQL server setting.
# @run
MYSQL_WAIT_TIMEOUT=600

# This Environment variable will run mariadb-upgrade is essential when mariadb version changes.
# https://mariadb.com/kb/en/mariadb-upgrade/
# @run
MARIADB_AUTO_UPGRADE=1

# --- DB Backup settings ---------------------------------------------------------------------------------------------
# "db-backup"  profile launch and run a container to cron database backups and backup file's rotation.
# This container is based on the "alpine" image and use the "mysql-client" package to perform backups. 

# Path where the backuped files will be locally stored
# @run
DB_BACKUP_VOLUME_PATH=./datas 

# The database server host
# @run
DB_BACKUP_MYSQL_HOST=db

# The database server user
# @run
DB_BACKUP_MYSQL_USER=root

# The database server pass
# @run
DB_BACKUP_MYSQL_PASS=${MYSQL_ROOT_PASSWORD}

# The backup file's rotation time in days
# @run
DB_BACKUP_MAX_BACKUPS=7

# If set, create a backup when the container starts
# @run
DB_BACKUP_INIT_BACKUP=0

# If set, restores latest backup.
# @run
DB_BACKUP_INIT_RESTORE_LATEST=0

# Every day at 03:00
# @run
#DB_BACKUP_CRON_TIME=0 3 * *
DB_BACKUP_CRON_TIME=

# Make it small
# @run
DB_BACKUP_GZIP_LEVEL=9

# --- redis cache settings ---------------------------------------------------------------------------------------------

# Redis session Image Tag.
# @run
REDIS_CACHE_IMAGE_TAG=redis:8.0.1

# --- redis session settings ---------------------------------------------------------------------------------------------

# Redis cache Image Tag.
# @run
REDIS_SESSION_IMAGE_TAG=redis:8.0.1

# --- Pusher Settings ---
# Phraseanet use the Pusher service to notify users of asynchronous downloads https://pusher.com.
# These settings are required when asynchronous downloads are enabled via 'download_async / enabled=true' in configuration.yml.
# A Pusher account is necessary. 
# For account setup and further details, refer to the official Pusher documentation at https://pusher.com/docs.

# Pusher Authentication Key: Key used for authenticating with the Pusher API.
# @run
PUSHER_AUTH_KEY=

# Pusher Secret: Secret key for secure interactions with the Pusher API.
# @run
PUSHER_SECRET=

# Pusher App ID: The unique identifier for your Pusher application.
# @run
PUSHER_APP_ID=


# --- Application Cache Settings ---
# Configuration for caching mechanisms within the application.
# Supports 'redis' for distributed caching or 'arraycache' for in-memory caching.
# These settings are effective when the corresponding cache type is enabled in the system configuration.

# Cache Type: Specifies the caching mechanism ('redis' or 'arraycache').
# @run
PHRASEANET_CACHE_TYPE=redis

# Cache Host: Hostname or IP address of the cache server.
# @run
PHRASEANET_CACHE_HOST=redis

# Cache Port: Port number on which the cache server is running.
# @run
PHRASEANET_CACHE_PORT=6379

# --- PHP Session Management Settings ---
# Configures storage mechanism for PHP sessions, correlating with the SESSION_SAVE_HANDLER setting. 
# Options are 'redis', 'file', or 'native'.
# 'redis' : Using Redis as a session storage mechanism.
# 'file' : Using file-based session storage.
# 'native' : Using PHP’s built-in session management which is file-based but can be configured to use a custom session handler.
# When `native` is choseen  see also SESSION_SAVE_HANDLER and SESSION_SAVE_PATH setting in php section  
# 'native' is mandatory for environments where SAML authentication is enabled,
# see SAML section below

# Session Type: Specifies the session storage mechanism.
# @run
PHRASEANET_SESSION_TYPE=redis

# Session Host: Hostname or IP address of the session storage server.
# @run
PHRASEANET_SESSION_HOST=redis-session

# Session Port: Port number on which the session storage server is running.
# @run
PHRASEANET_SESSION_PORT=6379


# --- Phraseanet general settings --------------------------------------------------------------------------------------

# Variables below are used in the "configuration.yml" file:

# Application title displayed on Phraseanet homepage.
# Available values:
# - "0" : Keep value define configuration.yml
# - "1" : Use PHRASEANET_PROJECT_NAME
#
# @run
ENV_SET_PHRASEANET_PROJECT_NAME=1

# Application title displayed on Phraseanet homepage. Depend on
# "ENV_SET_PHRASEANET_PROJECT_NAME" variable value.
# @run
PHRASEANET_PROJECT_NAME=Phraseanet

# Application static url is made by combining PHRASEANET_SCHEME, PHRASEANET_HOSTNAME and PHRASEANET_APP_PORT
# An non declarative variable is generated for other uses needed for deploiment (helm for exemple)
# Domain name used by traefik in Phrasea stack
# @run
PHRASEANET_HOSTNAME=phraseanet.phrasea.local
# @run
PHRASEANET_SCHEME=http
# @run
PHRASEANET_APP_PORT=8082

# Variables below used to define the first user / email couple :
# Phraseanet root account ID. If this variable is filled in,
# "PHRASEANET_ADMIN_ACCOUNT_PASSWORD" variable value will override
# targeted account ID password each time Phraseanet is started.
# @run
PHRASEANET_ADMIN_ACCOUNT_ID=

# @run
PHRASEANET_ADMIN_ACCOUNT_EMAIL=admin@phraseanet.local

# require to be change for securitie reasons
# @run
PHRASEANET_ADMIN_ACCOUNT_PASSWORD=iJRqXU0MwbyJewQLBbra6IWHsWly

# Use Pusher to enable async download.
# @run
PHRASEANET_DOWNLOAD_ASYNC=false

# --- User Session Duration Settings ---
# These settings control the lifetime and idle timeout of user sessions in the application.

# User Session Idle Timeout: Duration in seconds a session can remain inactive before being ended by the server.
# This setting helps manage resources efficiently and improves security by limiting the risk of sessions being hijacked during periods of inactivity.
# @run
PHRASEANET_USER_SESSION_IDLE=14400

# User Session Lifetime: Maximum duration in seconds that a session can exist, regardless of activity.
# This setting defines the absolute maximum time a session will remain active,
# after which it will be terminated to prevent long-lived sessions.
# @run
PHRASEANET_USER_SESSION_LIFETIME=86400

# --- Phraseanet SGBD Settings ---
# Configure the database settings for Phraseanet. 
# Note: The default settings provided below are for initial setup and development purposes only. 
# For production environments, ensure to use secure credentials and consider connecting to a managed database service for enhanced security and performance.

# SGBD Host: Specifies the hostname or IP address of the database server.
# @install
PHRASEANET_DB_HOST=db

# SGBD Port: Specifies the port number on which the database server is accessible.
# @install
PHRASEANET_DB_PORT=3306

# SGBD User: Username for accessing the database. Change from default 'root' to a user with lesser privileges for security reasons.
# @install
PHRASEANET_DB_USER=root  # Recommend changing to a specific, non-root user for production.

# SGBD Password: Password for the database user. Ensure to change this from the default for security reasons.
# @install
PHRASEANET_DB_PASSWORD=root  # Strongly recommend setting a strong, unique password for production.


# --- Phraseanet Database Settings ---------------------------------------------------------------------------------------
# Configure the initial database settings for Phraseanet installation.
# These settings specify the templates and database identifiers used during the setup process.
# Note: The databases specified here exist by default in the provided 'db' container. 
# If using an external database server, ensure these databases are created prior to installation.

# Database Template: Specifies the template for database setup, guiding the initial configuration structure.
# @install
INSTALL_DB_TEMPLATE=DublinCore

# Application Database Identifier: Specifies the identifier for the primary application database.
# Typically named as 'ab_master' or similar; adjust as needed.
# @install
INSTALL_APPBOX=ab_master

# Data Database Identifier: Specifies the identifier for the primary data storage database.
# Typically named as 'db_databox1' or similar; adjust as needed.
# @install
INSTALL_DATABOX=db_databox1





# --- Phraseanet languages settings ------------------------------------------------------------------------------------

# Available languages (list of language code separated by comma).
# @run
PHRASEANET_AVAILABLE_LANGUAGE=de,en,fr,nl

# Default language code.
# @run
PHRASEANET_DEFAULT_LANGUAGE=en

# --- Phraseanet Binaries Execution Timeouts Settings -------------------------------------------------------------------
# These settings define the maximum allowed execution time in minutes for various media processing tools used by Phraseanet.
# If a process exceeds the specified timeout, it will be considered as having encountered an error.
# These timeouts should be adjusted based on the file sizes being processed.

# FFMPEG Timeout: Maximum execution time for FFMPEG processes, used for video encoding and processing.
# @run
PHRASEANET_FFMPEG_TIMEOUT=7200

# FFPROBE Timeout: Maximum execution time for FFPROBE processes, used for video file analysis.
# @run
PHRASEANET_FFPROBE_TIMEOUT=120

# Ghostscript Timeout: Maximum execution time for Ghostscript processes, used for processing PDFs and PostScript files.
# @run
PHRASEANET_GS_TIMEOUT=120

# MP4Box Timeout: Maximum execution time for MP4Box processes, used for multimedia stream manipulation.
# @run
PHRASEANET_MP4BOX_TIMEOUT=120

# SWFTools Timeout: Maximum execution time for SWFTools processes, used for processing SWF files.
# @run
PHRASEANET_SWFTOOLS_TIMEOUT=120

# Unoconv Timeout: Maximum execution time for Unoconv processes, used for document conversion between various formats.
# @run
PHRASEANET_UNOCON_TIMEOUT=120

# ExifTool Timeout: Maximum execution time for ExifTool processes, used for managing metadata within media files.
# @run
PHRASEANET_EXIFTOOL_TIMEOUT=120


# --- Phraseanet RabbitMQ Settings ---
# Configuration settings for RabbitMQ, used for message queuing within Phraseanet.
# These settings define how Phraseanet connects to the RabbitMQ server to handle asynchronous message queuing.

# RabbitMQ Host: The hostname or IP address of the RabbitMQ server.
# @run
PHRASEANET_RABBITMQ_HOST=rabbitmq

# RabbitMQ Port: The port number on which the RabbitMQ server is accessible.
# @run
PHRASEANET_RABBITMQ_PORT=5672

# RabbitMQ SSL: Whether to use SSL/TLS to encrypt the connection. Set to 'false' to disable.
# @run
PHRASEANET_RABBITMQ_SSL=false

# RabbitMQ Virtual Host: The namespace where queues and exchanges are defined within RabbitMQ.
# @run
PHRASEANET_RABBITMQ_VHOST=/

# RabbitMQ Heartbeat: The timeout interval in seconds for sending heartbeats to keep the connection alive.
# @run
PHRASEANET_RABBITMQ_HEARTBEAT=30

# --- Phraseanet Elasticsearch Settings ---
# Initial configuration for Elasticsearch during the installation process of Phraseanet.
# Note: These environment variables are used only during installation. 
# To modify these settings post-installation, use the configuration.yml file or the Phraseanet admin GUI.

# Elasticsearch Host: The hostname or IP address of the Elasticsearch server.
# @install
PHRASEANET_ELASTICSEARCH_HOST=elasticsearch

# Elasticsearch Port: The port number on which Elasticsearch is accessible.
# @install
PHRASEANET_ELASTICSEARCH_PORT=9200

# Elasticsearch Index: The default index name for Elasticsearch. Set to 'null' to use the default setting from Phraseanet.
# @install
PHRASEANET_ELASTICSEARCH_INDEX=null

# Elasticsearch Number of Shards: The number of shards for the Elasticsearch index.
# @install
PHRASEANET_ELASTICSEARCH_SHARD=3

# Elasticsearch Number of Replicas: The number of replicas for each shard in the Elasticsearch index.
# @install
PHRASEANET_ELASTICSEARCH_REPLICAS=0

# Elasticsearch Minimum Score: The minimum score for search results to be considered relevant.
# @install
PHRASEANET_ELASTICSEARCH_MINSCORE=2

# Elasticsearch Highlight: Whether search results should be highlighted. Set to 'true' to enable.
# @install
PHRASEANET_ELASTICSEARCH_HIGHLIGHT=true

# Elasticsearch Max Result Window: The maximum number of search results that can be returned in a single query.
# @install
PHRASEANET_ELASTICSEARCH_MAXRESULTWINDOW=500000

# Elasticsearch Populate Order: The default order in which search results are populated.
# @install
PHRASEANET_ELASTICSEARCH_POPULATEORDER=RECORD_ID

# Elasticsearch Active Tab: The active tab in the Elasticsearch dashboard. Set to 'null' to use the default setting from Phraseanet.
# @install
PHRASEANET_ELASTICSEARCH_ACTIVETAB=null

# Elasticsearch Facet Base: Base number for calculating facets in search results.
# @install
PHRASEANET_ELASTICSEARCH_FACET_BASE=10

# Elasticsearch Facet per Collection: Number of facets to be calculated for collection in search results.
# @install
PHRASEANET_ELASTICSEARCH_FACET_COLLECTION=10

# Elasticsearch Facet per Document Type: Number of facets to be calculated for document type in search results.
# @install
PHRASEANET_ELASTICSEARCH_FACET_DOCTYPE=10

# Elasticsearch Facet Orientation: Number of facets to be calculated based on the orientation of media in search results.
# @install
PHRASEANET_ELASTICSEARCH_FACET_ORIENTATION=10


# --- Phraseanet Network Settings ---
# Configure trusted IPs and network settings for secure access and operation within a controlled network environment.

# Trusted Proxies: Comma-separated list of IP addresses or subnets that are trusted as proxies by Phraseanet.
# @run
PHRASEANET_TRUSTED_PROXIES=

# Debug Allowed IP: Comma-separated list of IP addresses allowed to access debugging features.
# @run
PHRASEANET_DEBUG_ALLOWED_IP=

# Subnet IPs: Define the IP subnet within which Phraseanet services will operate.
# @run
PHRASEANET_SUBNET_IPS=172.32.0.0/16

# --- Phraseanet API Settings ---
# Enable and configure the API settings to dictate how external applications interact with Phraseanet.

# API Enabled: Enables the API functionality, allowing for external access.
# @run
PHRASEANET_API_ENABLED=true

# API SSL: Enables SSL encryption for API connections, ensuring data security.
# @run
PHRASEANET_API_SSL=true

# API Auth Token Header Only: Restricts API authentication to headers only, enhancing security by not allowing token in URL.
# @run
PHRASEANET_API_AUTH_TOKEN_HEADER_ONLY=false

# --- Phraseanet Mapbox Geolocation Settings ---
# Configure settings for geolocation features within Phraseanet, using Mapbox services.
# Require a Mapbox account and access token to enable and use these features.

# Mapbox Activate: Enables or disables Mapbox integration.
# @run
PHRASEANET_MAPBOX_ACTIVATE=false

# Mapbox Token: The access token for using Mapbox services.
# @run
PHRASEANET_MAPBOX_TOKEN=

# Mapbox Kind: Specifies the type of Mapbox service to use.
# @run
PHRASEANET_MAPBOX_KIND=

# --- Phraseanet Mail Settings ---
# Configure email sending capabilities and SMTP settings for Phraseanet.

# Emitter Email: The email address that appears as the sender for emails sent by Phraseanet.
# @run
PHRASEANET_EMITTER_EMAIL=phraseanet@example.com

# Mail Object Prefix: A prefix for the subject line of emails sent by Phraseanet.
# @run
PHRASEANET_MAIL_OBJECT_PREFIX="phraseanet"

# SMTP Enabled: Toggle to enable SMTP settings from .env file or disable to configure in GUI.
# @run
PHRASEANET_SMTP_ENABLED=true

# SMTP Host: The hostname of the SMTP server used for sending emails.
# @run
PHRASEANET_SMTP_HOST=mailhog

# SMTP Port: The port number on which the SMTP server is accessible.
# @run
PHRASEANET_SMTP_PORT=1025

# SMTP Auth Enabled: Toggle to require authentication for sending emails via SMTP.
# @run
PHRASEANET_SMTP_AUTH_ENABLED=false

# SMTP Secure Mode: Defines the encryption method used (e.g., SSL, TLS), set to null to disable.
# @run
PHRASEANET_SMTP_SECURE_MODE=null

# SMTP User: Username for SMTP authentication, if required.
# @run
PHRASEANET_SMTP_USER=

# SMTP Password: Password for SMTP authentication, if required.
# @run
PHRASEANET_SMTP_PASSWORD=


# --- Phraseanet Workers and Scheduler settings ------------------------------------------------------------------------

# Define how many process are launched in the "worker" container:
# - "0" : Only one process is launched inside the container with no specializing,
#         in this case the scaling needs to be made by the orchestation eg K8S.
#         This is the recommended way.
# - "1" : Deploys one phraseanet worker for each kind of job, the parallelime is
#         defined by value of envs started by "PHRASEANET_WORKER_XXX"
#
# Eg: For two subdefinitions builded at the same time, set
#      "PHRASEANET_WORKER_subdefCreation=2"
# @run
PHRASEANET_EXPLODE_WORKER=1

# When PHRASEANET_EXPLODE_WORKER=1, it define the method for launching
# Phraseanet workers process.
# Available values :
# - "supervisor" : Launch it with supervisor.
# - ""           : Launch phraseanet workers with a "bin/console".
#
# Note for old Phraseanet task planner AKA "Phraseanet scheduler": To launch the
# "scheduler" container, add "scheduler" profile to "COMPOSE_PROFILES" env
# variable.
# Launch this container only if you need to use the old Phraseanet Archive tasks.
# @run
PHRASEANET_WORKERS_LAUNCH_METHOD=

# --- Phraseanet Worker Settings ----------------------------------------------------------------------------------------
# Define the number of parallel processes launched in a worker container.
# Prefer scaling the number of containers over the number of processes within a container.
# this default setting is for a test platform, for production, adjust the number of workers based on the expected workload and to your infrastructure capacity.

# @run
PHRASEANET_WORKER_assetsIngest=1

# @run
PHRASEANET_WORKER_createRecord=1

# @run
PHRASEANET_WORKER_deleteRecord=1

# @run
PHRASEANET_WORKER_editRecord=1

# @run
PHRASEANET_WORKER_exportMail=1

# @run
PHRASEANET_WORKER_downloadAsync=1

# @run
PHRASEANET_WORKER_exposeUpload=1

# @run
PHRASEANET_WORKER_ftp=1

# @run
PHRASEANET_WORKER_mainQueue=1

# @run
PHRASEANET_WORKER_populateIndex=1

# @run
PHRASEANET_WORKER_pullAssets=1

# @run
PHRASEANET_WORKER_recordsActions=1

# @run
PHRASEANET_WORKER_subdefCreation=1

# @run
PHRASEANET_WORKER_subtitle=1

# @run
PHRASEANET_WORKER_validationReminder=1

# @run
PHRASEANET_WORKER_webhook=1

# @run
PHRASEANET_WORKER_writeMetadatas=1

# @run
PHRASEANET_WORKER_shareBasket=1

# PHRASEANET_CMD_MODE=1, set a worker container for run bin/console... or bin/maintenance... manualy
# Add "cmd" profile to COMPOSE_PROFILE 
# @run
PHRASEANET_CMD_MODE=1

# --- Phraseanet Locales settings --------------------------------------------------------------------------------------

# @run
LC_MESSAGES=C.UTF-8

# @run
LC_COLLATE=C.UTF-8

# @run
LC_IDENTIFICATION=C.UTF-8

# @run
LANG=C.UTF-8

# @run
LC_MEASUREMENT=C.UTF-8

# @run
LC_CTYPE=C.UTF-8

# @run
LC_TIME=C.UTF-8

# @run
LC_NAME=C.UTF-8



# --- Phraseanet Volumes Location Settings ------------------------------------------------------------------------------
# Configure the directory paths for various operational and data storage aspects of Phraseanet.
# These settings specify the locations on the file system where different types of data and operational files are stored,
# ensuring proper data management and accessibility.

# Configuration Directory: Location for Phraseanet configuration files.
# @run
PHRASEANET_CONFIG_DIR=./config

# Logs Directory: Location for storing logs generated by Phraseanet operations.
# @run
PHRASEANET_LOGS_DIR=./logs

# Data Directory: General data storage location used by Phraseanet.
# any change here must be reflected in the db. 
# @run
PHRASEANET_DATA_DIR=./datas

# Database Directory: Location for database volume storage.
# @run
PHRASEANET_DB_DIR=./volumes/db

# Elasticsearch Directory: Location for Elasticsearch data storage.
# @run
PHRASEANET_ELASTICSEARCH_DIR=./volumes/elasticsearch

# Thumbnails Directory: Location for storing generated thumbnails.
# @run
PHRASEANET_THUMBNAILS_DIR=./www/thumbnails

# Custom Directory: Location for custom scripts or extensions.
# @run
PHRASEANET_CUSTOM_DIR=./www/custom

# Plugins Directory: Location for Phraseanet plugins.
# @run
PHRASEANET_PLUGINS_DIR=./www/plugins

# Temporary Directory: Location for temporary files.
# @run
PHRASEANET_TMP_DIR=./tmp

# Cache Directory: Location for caching data to improve application performance.
# @run
PHRASEANET_CACHE_DIR=./cache

# Download Directory: Location for storing files that are available for download.
# @run
PHRASEANET_DOWNLOAD_DIR=./datas/download

# Lazaret Directory: Location for storing temporary or quarantined files before final processing or deletion.
# @run
PHRASEANET_LAZARET_DIR=./datas/lazaret

# Caption Directory: Location for storing caption data for media files.
# @run
PHRASEANET_CAPTION_DIR=./tmp/caption

# Worker Temporary Directory: Temporary storage for worker processes.
# @run
PHRASEANET_WORKER_TMP=./tmp/worker

# Backup Directory: Location for backup Phraseanet 'config/' repository.
# the backup is perfomed by 'setup' container before performing an update
# Executed 
# @run
PHRASEANET_BACKUP_DIR=./backup

# FTP Directory: Location for FTP uploads or downloads.
# @run
PHRASEANET_FTP_DIR=./ftp


# --- Phraseanet plugin support settings -------------------------------------------------------------------------------
# Configure settings for enabling and managing plugins within Phraseanet.

# Plugins git repository, separated by comma.
# @build
PHRASEANET_PLUGINS=

# key for git repository access
# @build
PHRASEANET_SSH_PRIVATE_KEY=



# --- ImageMagick Default Policy Override Setting ---------------------------------------------------------------------
# Configure specific operational limits for ImageMagick to manage resource usage and ensure performance and security.
# reference: https://imagemagick.org/script/security-policy.php

# Policy Version: Specifies the version of ImageMagick policies being applied.
# @run
IMAGEMAGICK_POLICY_VERSION=7

# Maximum Width: Maximum width in pixels that ImageMagick is allowed to process.
# default value is 48,000 pixels
# @run
IMAGEMAGICK_POLICY_WIDTH=48KP

# Map Limit: Maximum amount of memory map ImageMagick is allowed to allocate for image cache.
# default value is 2,048 Megabytes
# @run
IMAGEMAGICK_POLICY_MAP=2048MiB

# Area Limit: Maximum area in pixels ImageMagick is allowed to allocate for an image.
# default value is 4,096 Megabytes
# @run
IMAGEMAGICK_POLICY_AREA=4096MB

# Disk Limit: Maximum amount of disk space ImageMagick is allowed to use for iamge cache.
# default value is 6 Gigabyte
# @run
IMAGEMAGICK_POLICY_DISK=6GiB

# Temporary Path: Location for ImageMagick's temporary files.
# default value is /tmp
# @run
IMAGEMAGICK_POLICY_TEMPORARY_PATH=/tmp

# --- New Relic Monitoring Settings ---
# Enable and configure the New Relic agent for platform monitoring to analyze and optimize the application's performance.
# refer to the official New Relic documentation at https://docs.newrelic.com/docs/agents/php-agent/getting-started/introduction-new-relic-php

# New Relic Enabled: Toggle to enable or disable New Relic monitoring.
# @run
NEWRELIC_ENABLED=false

# New Relic License Key: The license key for your New Relic account.
# @run
NEWRELIC_LICENSE_KEY=

# New Relic App Name: The name of the application as registered in New Relic.
# @run
NEWRELIC_APP_NAME=

# --- SAML Authentication Settings --------------------------------------------------------------------------------------
# Configure settings for SAML (Security Assertion Markup Language) authentication within Phraseanet to enable secure single sign-on (SSO) capabilities.
# Note: This setup requires an additional paid plugin that is not included in the public images. 
# It also requires extra containers that must be declared in the Docker compose stack by adding 'phraseanet-saml-sp' to COMPOSE_PROFILES.

# Allow Debug: Enables detailed logging for SAML operations. Useful for troubleshooting during setup and testing.
# @run
SAML_ALLOW_DEBUG=true

# Phraseanet Host: The URL where Phraseanet is hosted, used in SAML exchanges.
# @run
SAML_PHRASEANET_HOST=http://127.0.0.1:8082

# Service Provider Config Directory: Path to the directory where the SAML service provider configuration is stored.
# @run
SAML_SP_CONFIG_DIR=./saml-config/

# Service Provider Auth Sources: Specifies the authentication sources configuration for the service provider.
# @run
SAML_SP_AUTHSOURCES=

# Service Provider Certificate Directory: Path to the directory where the SAML service provider certificates are stored.
# @run
SAML_SP_CERT_DIR=./saml-cert/

# Identity Provider Metadata Configuration: Configuration details for the SAML identity provider.
# @run
SAML_IDP_METADATA_CONFIG=

# Local Identity Provider Metadata Directory: Path to the directory where local metadata configurations for identity providers are stored.
# @run
SAML_IDP_METADATA_LOCAL_CONFIG_DIR=./saml-metadata/

# --- Development purpose ----------------------------------------------------------------------------------------------

# See [Phraseanet development-mode documentation|
# https://github.com/alchemy-fr/Phraseanet#development-mode] for more information.

# "PhpMyAdmin" http port mapping.
# @run
PHRASEANET_PHPMYADMIN_PORT=8089

# "Mailhog" http port mapping.
# @run
MAILHOG_GUI_PORT=8025

# "Xdebug" settings:

# @run
XDEBUG_ENABLED=0

# @run
XDEBUG_PROFILER_ENABLED=0

# @run
IDE_KEY=PHPSTORM

# @run
XDEBUG_REMOTE_HOST=172.32.0.1

# @run
PHP_IDE_CONFIG=serverName=docker-server-phraseanet

# For dev or testing export ftp-server
# @run
PHRASEANET_FTP_DIR=./datas/ftp

# For dev proxy squid WIP:
# - PHRASEANET_SQUID_DIR=./volumes/squid
# - PHRASEANET_SQUID_CONF= ./docker/squid/squid.conf
# - PHRASEANET_SQUID_PORT=3128
#

# For dev who don't have SSH_AUTH_SOCK (avoid an empty volume name)
# @run
SSH_AUTH_SOCK=/dev/null

# Kubernet context needs full pod hosname on Nginx reverse proxing 
# This is need for PHraseanet  SAML context on K8S
# @run
PHRASEANET_K8S_NAMESPACE=