.env.example

# lab — environment configuration
#
# Standalone:  copy to ~/.labby/.env and fill in.
# Docker:      mount or copy this file to ~/.labby/.env inside the container.
#
# Only services you actually use need values; unset services are skipped at
# runtime by `labby serve` / `labby health`.
#
# Naming convention:
#   {SERVICE}_URL       — base URL (no trailing slash)
#   {SERVICE}_API_KEY   — for ApiKey auth
#   {SERVICE}_TOKEN     — for Bearer/Token auth
#   {SERVICE}_USERNAME  — for Basic auth
#   {SERVICE}_PASSWORD  — for Basic auth
#
# Scope discipline: config.toml already supports most preferences/toggles
# (transport, CORS, admin, log level, timeouts) — prefer setting those there
# over adding new .env entries. This file should stay limited to URLs,
# secrets, and the log-related bootstrap vars noted below.

# ─── lab MCP server / auth secrets ───────────────────────────────────────────
# HTTP bearer token. Generate with: openssl rand -hex 32
LABBY_MCP_HTTP_TOKEN=

# HMAC key for signing ACP permission outcomes across restarts.
# Without this, the key rotates on every process restart and stored permission
# signatures become unverifiable. Generate with: openssl rand -hex 32
LABBY_ACP_HMAC_SECRET=

# Public URL used for OAuth metadata, callbacks, and JWT issuer/audience
LABBY_PUBLIC_URL=
# Optional comma-separated redirect allowlist for OAuth client callbacks.
# When unset, Labby seeds common ChatGPT/Claude callback patterns. Set to an
# explicit value to replace those defaults; use https://* only if you want to
# trust any HTTPS DCR callback.
# LABBY_AUTH_ALLOWED_REDIRECT_URIS=
# Required (oauth mode): Google email of the bootstrap admin permitted to log in.
# Case-insensitive; trailing whitespace is ignored. Startup fails under
# LABBY_AUTH_MODE=oauth if unset, so no Google account can authenticate unless
# explicitly permitted. Additional users will be granted access through the
# web UI (planned), backed by a SQLite allowlist table.
LABBY_AUTH_ADMIN_EMAIL=
# Google OAuth app credentials (required in oauth mode)
LABBY_GOOGLE_CLIENT_ID=
LABBY_GOOGLE_CLIENT_SECRET=

# ─── Code Mode `openapi` provider credentials ────────────────────────────────
# Per-spec credentials for the Code Mode `openapi` provider. The spec itself
# (label, base_url, spec_url, allow-list) is NON-secret and lives in
# config.toml's [[openapi.specs]] — only the credential belongs here. <LABEL> is
# the uppercased spec label. Injected server-side, after the sandbox boundary —
# the JS snippet never sees the value. Set at most one per spec; TOKEN wins.
#   OPENAPI_<LABEL>_TOKEN     — sent as `Authorization: Bearer <token>`
#   OPENAPI_<LABEL>_API_KEY   — sent as the header named by `api_key_header`
#                               (config.toml; default `X-API-Key`)
# e.g. for a spec labeled "petstore":
# OPENAPI_PETSTORE_TOKEN=
# OPENAPI_PETSTORE_API_KEY=

# ─── Servarr stack ────────────────────────────────────────────────────────────
RADARR_API_KEY=
RADARR_URL=http://localhost:7878

SONARR_API_KEY=
SONARR_URL=http://localhost:8989

PROWLARR_API_KEY=
PROWLARR_URL=http://localhost:9696

# ─── Media ────────────────────────────────────────────────────────────────────
JELLYFIN_API_KEY=
JELLYFIN_URL=http://localhost:8096

PLEX_TOKEN=
PLEX_URL=http://localhost:32400

TAUTULLI_API_KEY=
TAUTULLI_URL=http://localhost:8181

IMMICH_API_KEY=
IMMICH_URL=http://localhost:2283

OVERSEERR_API_KEY=
OVERSEERR_URL=http://localhost:5055

NAVIDROME_TOKEN=
NAVIDROME_URL=http://localhost:4533
NAVIDROME_USERNAME=
NAVIDROME_SALT=

# ─── Downloaders ──────────────────────────────────────────────────────────────
SABNZBD_API_KEY=
SABNZBD_URL=http://localhost:8080

QBITTORRENT_PASSWORD=
QBITTORRENT_URL=http://localhost:8112
QBITTORRENT_USERNAME=admin

# ─── Network ──────────────────────────────────────────────────────────────────
TAILSCALE_API_KEY=
TAILSCALE_TAILNET=-
TAILSCALE_URL=https://api.tailscale.com
# Optional ephemeral, preauthorized auth key used only by provisioning/bootstrap
# to join the host/container to Tailscale. Do not commit a real key.
TS_AUTHKEY=

# UniFi Network Application (local controller, not cloud Site Manager)
UNIFI_API_KEY=
UNIFI_URL=https://10.1.0.1

# ─── Notifications ───────────────────────────────────────────────────────────
# App token for sending messages.
GOTIFY_APP_TOKEN=
# Client token for management operations.
GOTIFY_CLIENT_TOKEN=
# Legacy fallback when scoped tokens are not set.
GOTIFY_TOKEN=
GOTIFY_URL=http://localhost:8081

APPRISE_TOKEN=
APPRISE_URL=http://localhost:8001

# ─── Knowledge / notes ────────────────────────────────────────────────────────
LINKDING_TOKEN=
LINKDING_URL=http://localhost:9090

MEMOS_TOKEN=
MEMOS_URL=http://localhost:5230

BYTESTASH_TOKEN=
BYTESTASH_URL=http://localhost:5000

# ─── Infrastructure ───────────────────────────────────────────────────────────
# Arcane — Docker management UI
ARCANE_API_KEY=
ARCANE_URL=http://localhost:3552

# Unraid GraphQL API
UNRAID_API_KEY=
UNRAID_URL=https://tower.local/graphql

# Dozzle — Docker log viewer
DOZZLE_URL=http://localhost:8080
DOZZLE_SESSION_COOKIE=  # optional; for authenticated instances

# Scrutiny — hard drive health monitoring
SCRUTINY_API_KEY=
SCRUTINY_URL=http://localhost:8080

# Glances — system monitoring
GLANCES_TOKEN=  # optional; for authenticated instances
GLANCES_URL=http://localhost:61208

# Uptime Kuma — uptime monitoring
UPTIME_KUMA_PASSWORD=
UPTIME_KUMA_URL=http://localhost:3001
UPTIME_KUMA_USERNAME=admin

# AdGuard Home — DNS ad-blocker
ADGUARD_PASSWORD=
ADGUARD_URL=http://localhost:3000
ADGUARD_USERNAME=admin

# Pi-hole — DNS ad-blocker
PIHOLE_PASSWORD=
PIHOLE_URL=http://localhost:80

# Neo4j — graph database
NEO4J_DB=  # optional; defaults to "neo4j"
NEO4J_PASSWORD=
NEO4J_POOL_SIZE=  # optional; connection pool size
NEO4J_URL=bolt://localhost:7687
NEO4J_USER=neo4j

# FreshRSS — RSS aggregator
FRESHRSS_API_PASSWORD=
FRESHRSS_URL=http://localhost:80/api/greader.php
FRESHRSS_USERNAME=

# Loggifly — container log webhook bridge
LOGGIFLY_CONFIG_ROOT=  # optional; path to loggifly config dir
LOGGIFLY_URL=http://localhost:5000

# ─── AI / embeddings ──────────────────────────────────────────────────────────
OPENAI_API_KEY=
OPENAI_ORG_ID=
OPENAI_URL=

QDRANT_API_KEY=
QDRANT_URL=http://localhost:6333

TEI_API_KEY=
TEI_URL=http://localhost:8080

# ─── Docker deployment ────────────────────────────────────────────────────────
# Remap the host-side port without editing docker-compose.yml.
# LABBY_HOST_PORT=8765

# Override the tracing filter set in config/config.toml.
# RUST_LOG=lab=debug,warn

# LABBY_LOG / LABBY_LOG_DIR / LABBY_LOG_FORMAT / LABBY_LOG_COLOR: tracing
# initializes from config.toml BEFORE this .env file is loaded, so setting
# these here only has no effect at cold boot. If you need one of these to
# take effect at startup, set it as a real process/shell environment variable
# (or a systemd `Environment=` line), not just in this file.

# Opt-in: host adb client bind-mounted into labby:dev for the claude-in-mobile
# MCP server (it shells out to adb, talking to the host adb server via the
# host.docker.internal alias — see extra_hosts in docker-compose.yml — configured
# in config.toml as ANDROID_ADB_SERVER_ADDRESS=host.docker.internal +
# ANDROID_ADB_SERVER_PORT=5037). Set this to the host's adb binary so the
# in-container client version matches the host server's. Leave unset on hosts
# without the Android SDK — the mount defaults to a harmless /dev/null no-op.
# ADB_PATH=/home/youruser/Android/Sdk/platform-tools/adb