# Docker/production configuration, copy this file to .env at the repo root.

# This .env is read by Docker Compose to inject variables into containers.

# For local development, use apps/api/.env and apps/web/.env instead.

# ============================================

# Docker Image Version (Single Source of Truth)

# ============================================

# Specify which version of Openinary to use

# This version is used for:

# 1. Docker image tag (e.g., openinary:v0.1.0)

# 2. Version displayed in the UI sidebar

# See: https://github.com/openinary/openinary/releases

# Options:

# - latest (always pulls newest)

# - v0.1.0 (specific version)

# - 0.1 (minor version, gets latest patches automatically)

# - 0 (major version, gets latest minor/patches automatically)

# Note: v0.x.x versions may include breaking changes

IMAGE_TAG=latest

# Custom image names (optional)

# OPENINARY_FULL_IMAGE=openinary/openinary

# OPENINARY_API_IMAGE=openinary/openinary-api

# ============================================

# Authentication (Required)

# ============================================

# Generate a secure secret: openssl rand -base64 32

BETTER_AUTH_SECRET=your-secret-here-min-32-chars

# Your Openinary instance URL (used for authentication and CORS)

BETTER_AUTH_URL=http://localhost:3000

# Optional internal URL for server-side Better Auth calls.

# Leave unset unless your reverse-proxy setup needs a separate internal route.

# BETTER_AUTH_INTERNAL_URL=http://127.0.0.1:3001

# Secret used to sign/verify signed URLs and presigned, authenticated uploads.

# Generate a 64-character secret: openssl rand -hex 32

API_SECRET=your-secret-here-64-chars

# Initial account setup credentials and api generation (optional)

# An API key is always generated when first launch happenes in API mode.

# Initial gernerated API keys are only valid for 1 year.

#

# make sure to REMOVE these again after first launch

#

# OPENINARY_ADMIN_NAME=adminname

# OPENINARY_ADMIN_EMAIL=your@email.com

# OPENINARY_ADMIN_PASSWORD=your-secure-password

# OPENINARY_GENERATE_API_KEY=true

# ============================================

# Accessibility (Optional)

# ============================================

# If you want to use openinary from within another

# website, then you need to configure the allowed CORS origin.

# CORS_ORIGIN=https://yourwebsite.com

# ============================================

# API Configuration (Full Stack)

# ============================================

# Public base URL the browser uses to reach the API. Defaults to your

# instance's single project URL, same as BETTER_AUTH_URL above, the bundled

# full-stack image keeps this as /api since nginx already proxies the API

# there. Only change it if the API is reachable at a different origin (e.g.

# an API-only deployment, or an external app embedding the File Uploader).

NEXT_PUBLIC_API_BASE_URL=/api

# ============================================

# Upload Configuration (Optional)

# ============================================

# Maximum file size for uploads in megabytes (default: 50)

# Increase for large video uploads in self-hosted setups

# MAX_FILE_SIZE_MB=50

# ============================================

# Docker Resources (Recommended Settings)

# ============================================

# For 4GB RAM server:

DOCKER_CPU_LIMIT=2.0

DOCKER_MEMORY_LIMIT=4G

# For 16GB RAM server (uncomment):

# DOCKER_CPU_LIMIT=4.0

# DOCKER_MEMORY_LIMIT=12G

# VIDEO_MAX_CONCURRENT=4

# ============================================

# Anonymous Usage Telemetry (Optional)

# ============================================

# Openinary sends a small, anonymous, aggregated usage ping on startup and

# then once a day (instance ID, version, deployment mode, bucketed counts).

# No file names, media content, or IP addresses are ever collected.

# See docs/configuration/telemetry.mdx for the exact payload. Disable with:

# OPENINARY_TELEMETRY=false