.env.example

# Bootstrap password. Used ONCE, to claim the first admin account from the
# login screen. After an admin user exists it authenticates nothing.
ADMIN_PASSWORD=change-me

# Session signing secret (random long string)
SECRET_KEY=change-me-to-a-long-random-string

# Fernet key for encrypting RCON passwords at rest (url-safe base64, 32 bytes).
# MUST be a Fernet key, not a random password/phrase.
# Generate with:
#   python -c "from cryptography.fernet import Fernet; print(Fernet.generate_key().decode())"
# Leave empty to auto-create DATA_DIR/.encryption_key on first boot.
ENCRYPTION_KEY=

# ---- Postgres (Docker Compose default) ----
POSTGRES_USER=rcon
POSTGRES_PASSWORD=change-me-db-password
POSTGRES_DB=rcon_manager
# Host port if you need tools/psql against the container
# POSTGRES_PUBLISH_PORT=5432

# Full SQLAlchemy URL (Compose sets this for the app container automatically)
# Local uvicorn against Docker Postgres:
# DATABASE_URL=postgresql+psycopg://rcon:change-me-db-password@127.0.0.1:5432/rcon_manager
#
# Local pure SQLite (no Postgres): leave DATABASE_URL and POSTGRES_HOST empty
# DATA_DIR=../data

# Optional pool tuning
# DB_POOL_SIZE=5
# DB_MAX_OVERFLOW=10

# Steam Web API key - resolve SteamID64 → persona name (ban list, etc.)
# Free key: https://steamcommunity.com/dev/apikey
# STEAM_WEB_API_KEY=
# IDENTITY_CACHE_TTL_SECONDS=604800

# HOST=0.0.0.0
# PORT=8080
# SESSION_HTTPS_ONLY=false
# QUERY_TIMEOUT=2.0

# ---- Users, invites and password resets ----
# Email delivery (SMTP host, credentials, sender and the application URL used
# to build links) is configured IN THE APP under Settings -> Email, and stored in
# the database. There is nothing to set here.
#
# The SMTP_* and PUBLIC_BASE_URL variables are still read as a fallback for
# installs that predate that screen, and are ignored permanently once the form
# has been saved once.
# RESET_TOKEN_TTL_MINUTES=60
# INVITE_TOKEN_TTL_HOURS=72

# ---- Pterodactyl panel (optional) ----
# The panel URL and its Client API key are configured IN THE APP under
# Settings -> Pterodactyl, and stored in the database with the key encrypted by
# ENCRYPTION_KEY. There is nothing to set here, and no environment fallback.

# ---- Cloudflare Turnstile (optional) ----
# Both must be set or Turnstile stays off. The site key is public; the secret
# is not - keep it out of version control.
# TURNSTILE_SITE_KEY=
# TURNSTILE_SECRET=

# When the app sits behind a reverse proxy, set the header that carries the
# real client IP (rate limiting, Turnstile remoteip). Empty = no proxy; use the
# TCP peer. Cloudflare: CF-Connecting-IP. Only set this when clients cannot
# reach the app without the proxy. Settings -> Helpers lists arriving headers.
# CLIENT_IP_HEADER=CF-Connecting-IP