.env.example

# GeoPulse Configuration
# Copy this file to .env
# For production deployment, update the URLs and enable secure cookies below
# Note: Many settings can also be managed via the Admin Panel UI once you have an admin user

# The version of the app, frontend and backend should use the same version
GEOPULSE_VERSION=1.39.0

# Frontend (UI) URL (legacy)
# DEPRECATED: kept for backward compatibility with older deployments.
# New deployments should use GEOPULSE_CORS_ORIGINS and GEOPULSE_PUBLIC_BASE_URL.
GEOPULSE_UI_URL=http://localhost:5555

# CORS configuration
# Standard docker-compose deployment uses nginx reverse proxy and same-origin requests,
# so CORS can be disabled by default.
GEOPULSE_CORS_ENABLED=false
# When CORS is enabled, set allowed origins as comma-separated URLs.
# Example: http://localhost:5555,http://192.168.1.100:5555,https://geopulse.yourdomain.com
GEOPULSE_CORS_ORIGINS=

# Public base URL for callback/link generation (optional, recommended for OIDC)
# Example: https://geopulse.yourdomain.com
GEOPULSE_PUBLIC_BASE_URL=

# Cookie domain for authentication cookies
#
# IMPORTANT: GeoPulse uses nginx to proxy all requests (frontend + backend), so the browser
# sees everything as same-origin (e.g., all requests to geopulse.mydomain.com).
#
# For standard deployments (with nginx proxy):
#   - Local/Homelab/Production: LEAVE EMPTY (recommended for 99% of deployments)
#   - Example domains that should use empty value:
#     * http://localhost:5555
#     * http://192.168.1.100:5555
#     * https://geopulse.mydomain.com
#
# Only set this if deploying WITHOUT nginx proxy AND using separate subdomains:
#   - Frontend: app.mydomain.com
#   - Backend: api.mydomain.com
#   - In this case, set: GEOPULSE_COOKIE_DOMAIN=.mydomain.com
#   - This is NOT a standard GeoPulse deployment scenario
#
# Security Note: Setting a domain like ".mydomain.com" shares cookies with ALL subdomains,
# which can be a security risk. Only use when absolutely necessary.
GEOPULSE_COOKIE_DOMAIN=""

# Set to true in production to ensure auth cookies are only sent over HTTPS.
# Requires a reverse proxy with TLS/SSL termination.
# If you deploy to local machine and use HTTP protocol, keep it as false
GEOPULSE_AUTH_SECURE_COOKIES=false

# Backend URL used by nginx proxy in Docker containers
# For Docker: http://geopulse-backend:8080 (internal container communication)
# For development with separate backend: http://localhost:8080
# If you plan to deploy this app via docker-compose (prefferable way) do not change this value.
GEOPULSE_BACKEND_URL=http://geopulse-backend:8080

# Postgres Database
GEOPULSE_POSTGRES_HOST=geopulse-postgres
GEOPULSE_POSTGRES_PORT=5432
GEOPULSE_POSTGRES_DB=geopulse
GEOPULSE_POSTGRES_USERNAME=geopulse-user
GEOPULSE_POSTGRES_PASSWORD=change-this-secure-password

GEOPULSE_DATABASE_TRANSACTION_TIMEOUT_MINUTES=60

# Import processing gets a separate transaction timeout for large files.
# Reverse-geocoding data is committed separately and survives import rollback.
GEOPULSE_IMPORT_TRANSACTION_TIMEOUT_MINUTES=1440

# ============================================
# Admin User Configuration
# ============================================
# Email address of the user to automatically promote to ADMIN role.
# - New user: Gets ADMIN role on registration
# - Existing user: Gets promoted to ADMIN on next login
# Once you have an admin, they can promote others via the Admin Panel UI.
GEOPULSE_ADMIN_EMAIL=

# Default measurement unit for newly created users.
# Existing users keep their own profile preference.
# Allowed values: METRIC, IMPERIAL
GEOPULSE_USER_DEFAULT_MEASURE_UNIT=METRIC

# MQTT (optional)
# Change GEOPULSE_MQTT_ENABLED to true if you plan to deploy MQTT broker
GEOPULSE_MQTT_ENABLED=false
GEOPULSE_MQTT_BROKER_HOST=geopulse-mosquitto
GEOPULSE_MQTT_BROKER_PORT=1883
GEOPULSE_MQTT_USERNAME=geopulse_mqtt_admin
# Mosquitto admin password, change it for more secure value
GEOPULSE_MQTT_PASSWORD=change-this-mqtt-admin-password
# Optional: enable TLS when using an external MQTT broker
GEOPULSE_MQTT_TLS_ENABLED=false
# Optional: TLS protocol used by MQTT client (for example TLSv1.2 or TLSv1.3)
GEOPULSE_MQTT_TLS_PROTOCOL=TLSv1.2
# Optional: path inside geopulse-backend container to truststore (for private/self-signed broker certs)
GEOPULSE_MQTT_TLS_TRUSTSTORE_PATH=
# Optional: truststore password
GEOPULSE_MQTT_TLS_TRUSTSTORE_PASSWORD=
# Optional: truststore type (usually PKCS12 or JKS)
GEOPULSE_MQTT_TLS_TRUSTSTORE_TYPE=PKCS12
# Optional: path inside geopulse-backend container to client cert keystore (required only for mTLS brokers)
GEOPULSE_MQTT_TLS_KEYSTORE_PATH=
# Optional: keystore password
GEOPULSE_MQTT_TLS_KEYSTORE_PASSWORD=
# Optional: keystore type (usually PKCS12 or JKS)
GEOPULSE_MQTT_TLS_KEYSTORE_TYPE=PKCS12
# Optional: disable TLS hostname verification (for debugging only; not recommended for production)
GEOPULSE_MQTT_TLS_INSECURE_SKIP_HOSTNAME_VERIFICATION=false

# ============================================
# Apprise Notifications (Optional)
# ============================================
# External geofence notifications via Apprise API.
# These can also be configured in Admin Panel > System Settings > System.
GEOPULSE_NOTIFICATIONS_APPRISE_ENABLED=false
GEOPULSE_NOTIFICATIONS_APPRISE_API_URL=
GEOPULSE_NOTIFICATIONS_APPRISE_AUTH_TOKEN=
GEOPULSE_NOTIFICATIONS_APPRISE_TIMEOUT_MS=5000
GEOPULSE_NOTIFICATIONS_APPRISE_VERIFY_TLS=true

# ============================================
# OIDC Configuration (Optional)
# ============================================
# Enable/disable OIDC authentication support
# Note: OIDC providers can also be managed via Admin Panel > OIDC Providers
GEOPULSE_OIDC_ENABLED=false

# OIDC Callback URL Override (optional)
# Callback URL resolution order:
# 1. GEOPULSE_OIDC_CALLBACK_BASE_URL (this value)
# 2. GEOPULSE_PUBLIC_BASE_URL
# 3. GEOPULSE_UI_URL (legacy fallback)
# Set this explicitly when your callback base URL must differ from your public UI URL.
# Example: GEOPULSE_OIDC_CALLBACK_BASE_URL=https://geopulse.mydomain.com
GEOPULSE_OIDC_CALLBACK_BASE_URL=

# ============================================
# Login Control (Optional)
# ============================================
# Control who can log in to the system
# Default: true (all login methods enabled)

# Global login control - master switch for all login methods
GEOPULSE_AUTH_LOGIN_ENABLED=true

# Password/email login control
GEOPULSE_AUTH_PASSWORD_LOGIN_ENABLED=true

# OIDC login control
GEOPULSE_AUTH_OIDC_LOGIN_ENABLED=true

# Admin login bypass control
# When true (default), admins can bypass login restrictions to prevent lockout
# When false, admins are subject to the same login restrictions as regular users
# WARNING: Setting to false can lock out all users if login is disabled
GEOPULSE_AUTH_ADMIN_LOGIN_BYPASS_ENABLED=true

# Guest root behavior
# false (default): signed-out users opening "/" see the Home page
# true: signed-out users opening "/" are redirected to "/login"
GEOPULSE_AUTH_GUEST_ROOT_REDIRECT_TO_LOGIN_ENABLED=false

# ============================================
# Google OIDC Configuration
# ============================================
# To enable Google OIDC:
# 1. Go to https://console.cloud.google.com/apis/credentials
# 2. Create OAuth 2.0 Client ID
# 3. Add your callback URL to authorized redirect URIs: http://your-domain:port/oidc/callback
# 4. Copy Client ID and Client Secret below
GEOPULSE_OIDC_PROVIDER_GOOGLE_ENABLED=false
GEOPULSE_OIDC_PROVIDER_GOOGLE_CLIENT_ID=
GEOPULSE_OIDC_PROVIDER_GOOGLE_CLIENT_SECRET=
GEOPULSE_OIDC_PROVIDER_GOOGLE_DISCOVERY_URL=https://accounts.google.com/.well-known/openid-configuration

# ============================================
# Generic OIDC Provider Configuration
# ============================================
# Use this for Okta, Authentik, PocketId, Keycloak, or any custom OIDC provider
# You can configure one generic provider at a time
GEOPULSE_OIDC_PROVIDER_GENERIC_ENABLED=false

# Display name for the provider (appears on login buttons)
GEOPULSE_OIDC_PROVIDER_GENERIC_NAME=Custom OIDC

# OIDC client credentials
GEOPULSE_OIDC_PROVIDER_GENERIC_CLIENT_ID=
GEOPULSE_OIDC_PROVIDER_GENERIC_CLIENT_SECRET=

# OIDC discovery URL (usually ends with /.well-known/openid-configuration)
# Examples:
# - Keycloak: https://your-keycloak-server/realms/your-realm/.well-known/openid-configuration
# - Authentik: https://your-authentik-server/application/o/your-app/.well-known/openid-configuration
# - Okta: https://your-org.okta.com/.well-known/openid-configuration
# - PocketId: https://your-pocketid-server/.well-known/openid-configuration
GEOPULSE_OIDC_PROVIDER_GENERIC_DISCOVERY_URL=

# Frontend max upload file size
CLIENT_MAX_BODY_SIZE=1000M

# DNS servers (127.0.0.11 is default Docker DNS server) that are used to resolve OpenStreetMaps hosts.
# Change it only if default DNS don't work for your setup. For 99% users default value works just fine.
OSM_RESOLVER=127.0.0.11 8.8.8.8

# Geocoding delay between requests in milliseconds. Default value is 1000ms (1 second).
# For selfhosted solutions you can decrease it to lower values, including 0
# Note: This setting can also be changed via Admin Panel > System Settings > Geocoding
GEOPULSE_GEOCODING_DELAY_MS=1000
# Max geocoding bounding box area (in km²) used for containment matching.
# Oversized provider bboxes are automatically dropped and matching falls back to coordinate tolerance.
GEOPULSE_GEOCODING_CACHE_MAX_BBOX_AREA_KM2=5000

# ============================================
# Weather (Optional Enrichment)
# ============================================
# Weather is enabled by default for ongoing/current timeline activity.
# Historical backfill is disabled by default to avoid sending past timeline locations automatically.
# These settings can also be changed via Admin Panel > System Settings > Weather.
GEOPULSE_WEATHER_ENABLED=true
GEOPULSE_WEATHER_PRIMARY_PROVIDER=OPEN_METEO
GEOPULSE_WEATHER_SECONDARY_PROVIDER=
GEOPULSE_WEATHER_OPEN_METEO_ENABLED=true
GEOPULSE_WEATHER_OPEN_METEO_FORECAST_URL=https://api.open-meteo.com
GEOPULSE_WEATHER_OPEN_METEO_ARCHIVE_URL=https://archive-api.open-meteo.com
# Optional: set only if your Open-Meteo account or deployment requires an API key.
GEOPULSE_WEATHER_OPEN_METEO_API_KEY=
GEOPULSE_WEATHER_PIRATE_ENABLED=false
GEOPULSE_WEATHER_PIRATE_BASE_URL=https://api.pirateweather.net
GEOPULSE_WEATHER_PIRATE_TIME_MACHINE_URL=https://timemachine.pirateweather.net
GEOPULSE_WEATHER_PIRATE_API_KEY=
GEOPULSE_WEATHER_ONGOING_ENABLED=true
GEOPULSE_WEATHER_ONGOING_INTERVAL_MINUTES=60
GEOPULSE_WEATHER_BACKFILL_ENABLED=false
GEOPULSE_WEATHER_QUOTA_DAILY_REQUEST_LIMIT=10000
GEOPULSE_WEATHER_QUOTA_ONGOING_RESERVE=500
GEOPULSE_WEATHER_COORDINATE_PRECISION=2

# ============================================
# Map Matching (Optional Route Refinement)
# ============================================
# Requires a reachable Valhalla instance. Admin settings override these defaults.
GEOPULSE_TIMELINE_MAP_MATCHING_ENABLED=false
GEOPULSE_TIMELINE_MAP_MATCHING_PROVIDER=valhalla
GEOPULSE_TIMELINE_MAP_MATCHING_VALHALLA_BASE_URL=
GEOPULSE_TIMELINE_MAP_MATCHING_AUTOMATIC_ENABLED=false
GEOPULSE_TIMELINE_MAP_MATCHING_BACKFILL_ENABLED=false

# ============================================
# Import (Drop Folder)
# ============================================
# Enable server-side drop folder imports. When enabled, files placed under
# /data/geopulse-import/<user-email>/ are imported automatically.
GEOPULSE_IMPORT_DROP_FOLDER_ENABLED=false
GEOPULSE_IMPORT_DROP_FOLDER_PATH=/data/geopulse-import
GEOPULSE_IMPORT_DROP_FOLDER_POLL_INTERVAL_SECONDS=10
GEOPULSE_IMPORT_DROP_FOLDER_STABLE_AGE_SECONDS=10
GEOPULSE_IMPORT_DROP_FOLDER_GEOPULSE_MAX_SIZE_MB=200

# Override the base URL for share links. If not set, the current base URL is used.
# Example: GEOPULSE_SHARE_BASE_URL=https://share.geopulse.com
GEOPULSE_SHARE_BASE_URL=

# ============================================
# GPS Duplicate Detection (OwnTracks)
# ============================================
# Time threshold for location-based duplicate detection in minutes.
# OwnTracks devices often send the same location repeatedly (e.g., every 30s while stationary).
# This setting prevents storing duplicate coordinates within the time window.
#
# - Default: 2 minutes (recommended for most users)
# - Set to 0 or negative value to disable duplicate detection
# - Allows historical GPS data import when disabled
#
# Note: This only affects OwnTracks GPS source. Other sources use exact timestamp matching.
GEOPULSE_GPS_DUPLICATE_DETECTION_LOCATION_TIME_THRESHOLD_MINUTES=2

# Full backup / staged restore runtime configuration (not stored in database)
# Must remain on persistent storage across backend restart / pod replacement.
GEOPULSE_BACKUP_WORK_PATH=/data/geopulse-backups/.work
# Directory containing matching-major pg_dump and pg_restore; empty uses PATH.
# Native images already set /usr/pgsql-17/bin; omit this variable to retain that default.
# GEOPULSE_BACKUP_BINARY_DIRECTORY=/usr/lib/postgresql/17/bin
GEOPULSE_BACKUP_MAINTENANCE_DATABASE=postgres
# Optional dedicated privileged role. Empty uses the application database credentials.
# GEOPULSE_BACKUP_RESTORE_USERNAME=
# GEOPULSE_BACKUP_RESTORE_PASSWORD=