.env.example

# =============================================================================
# RabbitMQ - Environment Configuration
# =============================================================================
# Professional, quorum-ready RabbitMQ 4 broker with declarative JSON
# provisioning, layered TLS, and Prometheus metrics.
#
# /!\ BEFORE FIRST START — replace every value containing "CHANGE_ME" /!\
#
# One-shot, cross-platform (Windows / Linux / macOS):
#
#   python scripts/generate-env.py
#
# This creates .env from this template and fills every CHANGE_ME_* secret with
# a fresh random hex value. Pure stdlib, no dependencies. The CHANGE_ME
# placeholders also let `docker compose config` validate this file in CI.
#
# Deployment:
#   Development (local build): docker compose -f docker-compose.development.yml up -d --build
#   Single (direct ports):     docker compose -f docker-compose.single.yml      up -d
#   Traefik (HTTPS UI + LE):   docker compose -f docker-compose.traefik.yml     up -d
#   Coolify:                   configure env in dashboard -> docker-compose.coolify.yml
# =============================================================================


# =============================================================================
# Stack Configuration
# =============================================================================

# Container / volume / network name prefix
STACK_NAME=amqp_example_domain_com

# Container timezone (e.g. Europe/Berlin, Etc/UTC)
TIME_ZONE=Etc/UTC

# Stable node identity (keep short, no dots — drives the persistent data dir
# rabbit@<hostname>). Only change for a multi-node cluster.
RABBITMQ_NODE_HOSTNAME=rabbitmq


# =============================================================================
# Image Configuration
# =============================================================================

# -----------------------------------------------------------------------------
# Production images (pre-built from GHCR) — single / traefik / coolify
# -----------------------------------------------------------------------------
RABBITMQ_IMAGE=ghcr.io/bauer-group/cs-rabbitmq/rabbitmq
RABBITMQ_IMAGE_VERSION=latest

RABBITMQ_INIT_IMAGE=ghcr.io/bauer-group/cs-rabbitmq/rabbitmq-init
RABBITMQ_INIT_VERSION=latest

# -----------------------------------------------------------------------------
# Build base (development build) — RabbitMQ upstream image the server wraps
# -----------------------------------------------------------------------------
RABBITMQ_REPOSITORY=rabbitmq
# Floating tag: tracks the latest 4.x patch/minor. Major is pinned to 4 to avoid
# a breaking jump to 5.x; the base-image monitor rebuilds when its digest moves.
# Pin to an exact tag (e.g. 4.3.1-management) only if you need reproducibility.
RABBITMQ_VERSION=4-management


# =============================================================================
# Administrator Credentials (REQUIRED)
# =============================================================================
# The admin is created by the broker on first boot (RABBITMQ_DEFAULT_USER).
# Defining it means the insecure 'guest' account is never created. The init
# container authenticates to the Management API with these credentials.

RABBITMQ_ADMIN_USER=admin
# Generate: openssl rand -hex 16
RABBITMQ_ADMIN_PASSWORD=CHANGE_ME_ADMIN_PASSWORD

# Erlang distribution cookie (cluster/CLI auth secret). Required even for a
# single node. Generate: openssl rand -hex 32
RABBITMQ_ERLANG_COOKIE=CHANGE_ME_ERLANG_COOKIE


# =============================================================================
# Sizing Presets  (default = SMALL)
# =============================================================================
# RabbitMQ RAM is driven by CONNECTIONS + QUEUES + BACKLOG (unconsumed messages)
# + message size — NOT by raw throughput. A single node sustains thousands to
# tens of thousands of msg/s, so daily message totals rarely limit you; size by
# the real drivers below. (Peak rate matters far more than a daily average — a
# 1-minute burst can dwarf the 24h total.)
#
# Memory model: an ABSOLUTE publish-throttle threshold
# (vm_memory_high_watermark.absolute), and deliberately NO Docker mem_limit — a
# hard cap would OOM-kill (SIGKILL) the broker on a transient spike; the
# watermark throttles publishers gracefully instead. Keep it ~40–50 % of the RAM
# the broker can actually use.
#
#   ╔════════════════╤════════════╤═════════╤══════════════╤═══════════╤═══════════╤═══════════╗
#   ║ Profile        │ Conns      │ Queues  │ Peak backlog │ WATERMARK │ DISK_FREE │ Host RAM  ║
#   ╠════════════════╪════════════╪═════════╪══════════════╪═══════════╪═══════════╪═══════════╣
#   ║ SMALL (default)│ < 200      │ < 100   │ < 100k msgs  │ 2GB       │ 2GB       │ 4 GB      ║
#   ╟════════════════┼════════════┼═════════┼══════════════┼═══════════┼═══════════┼═══════════╢
#   ║ MEDIUM         │ 200–2 000  │ 100–1k  │ < 1M msgs    │ 4GB       │ 8GB       │ 8–12 GB   ║
#   ╟════════════════┼════════════┼═════════┼══════════════┼═══════════┼═══════════┼═══════════╢
#   ║ LARGE          │ 2k–10k+    │ 1k–5k   │ < 10M msgs   │ 8GB       │ 16GB      │ 16–32 GB  ║
#   ╚════════════════╧════════════╧═════════╧══════════════╧═══════════╧═══════════╧═══════════╝
#
# Throughput is rarely the bottleneck. For 10k+ connections also raise the host
# file-descriptor limit (ulimit -n). Beyond LARGE on one node, scale out:
# docs/clustering.md (single-node here is quorum-ready → non-destructive upgrade).

# ABSOLUTE memory threshold at which publishers are throttled (e.g. 2GB, 4GB,
# 8GB). Keep it ~40–50 % of the RAM the broker can use. NO Docker mem_limit by
# design — see the memory model note above.
RABBITMQ_VM_MEMORY_HIGH_WATERMARK=2GB

# Free-disk floor below which publishing is blocked. Scale with peak backlog x
# avg message size + headroom (e.g. 2GB, 8GB, 16GB).
RABBITMQ_DISK_FREE_LIMIT=2GB

# Max channels PER CONNECTION (0 = unlimited). A leak guard, NOT a sizing lever:
# leave it at the default; lower it (e.g. 200) to catch channel leaks earlier.
# (RabbitMQ default: 2047.)
RABBITMQ_CHANNEL_MAX=2048

# Consumer ack timeout in ms (4.x default 1800000 = 30 min). Raise for slow
# consumers; lowering surfaces stuck consumers faster.
RABBITMQ_CONSUMER_TIMEOUT=1800000

# AMQP heartbeat interval in seconds (0 disables).
RABBITMQ_HEARTBEAT=60

# --- Frame size & message size (both in BYTES) ---
#
# RABBITMQ_FRAME_MAX — max AMQP frame = a single transmission chunk on the wire.
#   This is NOT a message-size limit: larger messages are split across multiple
#   frames. 131072 = 128 KiB is the RabbitMQ/AMQP default and rarely needs
#   changing.
RABBITMQ_FRAME_MAX=131072
#
# RABBITMQ_MAX_MESSAGE_SIZE — absolute max size of a SINGLE message body. Larger
#   messages are rejected with a channel exception.
#     RabbitMQ 4.x default : 16777216   = 16 MiB
#     hard ceiling         : 536870912  = 512 MiB  (cannot be exceeded)
#     set here             : 268435456  = 256 MiB
#   /!\ Big messages are expensive: on publish AND deliver the broker buffers the
#   WHOLE message in RAM (256 MiB x concurrent in-flight messages = RAM spike),
#   even though it is then persisted to disk (quorum queues + persistent classic
#   messages always go to disk). Keep large messages a rare exception; for routine
#   large payloads put the data in object storage (MinIO) and send only a
#   reference. With many large messages, raise RABBITMQ_VM_MEMORY_HIGH_WATERMARK
#   above — the Small preset's 2GB watermark holds very few 256 MiB messages.
#   Byte sizes: 64 MiB=67108864  128 MiB=134217728  256 MiB=268435456  512 MiB=536870912
RABBITMQ_MAX_MESSAGE_SIZE=268435456

# Default queue type for queues that don't declare one: quorum | classic | stream
RABBITMQ_DEFAULT_QUEUE_TYPE=quorum

# Broker log level: debug | info | warning | error
RABBITMQ_LOG_LEVEL=info


# =============================================================================
# TLS / Certificates
# =============================================================================
# Mode (see docs/tls-and-certificates.md):
#   selfsigned  — generate a self-signed cert on first boot (default, zero-config)
#   managed     — use cert.pem/key.pem written by the certs-dumper sidecar (LE)
#   byo         — use operator bind-mounted cert.pem/key.pem (fail fast if absent)
RABBITMQ_TLS_MODE=selfsigned

# Certificate Common Name / SAN (public AMQP hostname). Defaults to the node
# hostname when AMQP_HOSTNAME is unset.
# AMQP_HOSTNAME=amqp.example.domain.com

# Seconds the entrypoint waits for a managed cert before falling back to
# self-signed (managed mode only).
RABBITMQ_TLS_MANAGED_WAIT=30

# Peer verification: verify_none (self-signed friendly) | verify_peer (mTLS)
RABBITMQ_SSL_VERIFY=verify_none
RABBITMQ_SSL_FAIL_IF_NO_PEER_CERT=false


# =============================================================================
# Optional Protocols (default OFF)
# =============================================================================
# Each enables a listener (more surface area + memory). Toggle here, then
# uncomment the matching host ports in the compose file.
RABBITMQ_ENABLE_MQTT=false
RABBITMQ_ENABLE_WEB_MQTT=false
RABBITMQ_ENABLE_STOMP=false
RABBITMQ_ENABLE_WEB_STOMP=false


# =============================================================================
# Port Settings (development / single — direct host binding)
# =============================================================================
PORT_AMQP=5672
PORT_AMQPS=5671
PORT_MANAGEMENT=15672
PORT_PROMETHEUS=15692

# Optional protocol ports (uncomment in compose when the plugin is enabled)
# PORT_MQTT=1883
# PORT_MQTTS=8883
# PORT_WEB_MQTT=15675
# PORT_STOMP=61613
# PORT_WEB_STOMP=15674


# =============================================================================
# Traefik Configuration (docker-compose.traefik.yml)
# =============================================================================
# DNS must resolve to this host before starting.

# Management UI hostname (served over HTTPS by Traefik via Let's Encrypt)
CONSOLE_HOSTNAME=amqp-console.example.domain.com

# External Traefik network name (must already exist)
PROXY_NETWORK=EDGEPROXY

# --- Optional: real Let's Encrypt cert on AMQPS via the certs-dumper sidecar ---
# Enable with:  docker compose -f docker-compose.traefik.yml --profile tls-letsencrypt up -d
# and set RABBITMQ_TLS_MODE=managed above. See docs/tls-and-certificates.md.
CERTS_DUMPER_IMAGE=ldez/traefik-certs-dumper
CERTS_DUMPER_VERSION=latest
# Path to Traefik's ACME storage on this host (bind-mounted read-only).
TRAEFIK_ACME_FILE=./acme.json


# =============================================================================
# Init Container / Topology Provisioning
# =============================================================================
# The init container processes, in order:
#   1. Built-in default (admin perms on '/', quorum default) — always
#   2. Your topology config — vhosts, users, permissions, exchanges, queues,
#      bindings, policies, parameters, limits  (full reference:
#      docs/messaging-topology.md; JSON values support ${ENV_VAR} resolution)
#
# Where config #2 lives, per deployment:
#   - development:            repo file  config/rabbitmq-init.json  (bind-mounted,
#                             edit it in your IDE; the shipped DEMO by default)
#   - single/traefik/coolify: the 'rabbitmq-config' Docker VOLUME — seeded with
#                             the same demo on first boot, then editable at
#                             runtime (e.g. the Coolify file browser / a Coolify
#                             File Mount to /config/init.json). Not in the repo.
#
# The DEMO creates a vhost/queue/user "demo" (the demo user reuses the admin
# password — change it for real workloads). Replace /config/init.json with your
# own topology, or start from config/rabbitmq-init.example.json (all features).

# Seconds the init container polls for the broker Management API before giving
# up. The init starts with the broker (depends_on: service_started) and waits
# internally, so this covers a cold boot (cert-gen + quorum init).
RABBITMQ_WAIT_TIMEOUT=120

# Optional: override the in-container path the init reads (default /config/init.json).
# RABBITMQ_INIT_CONFIG=/config/init.json

# Credentials referenced by config/rabbitmq-init.example.json (the full example).
# Generate passwords: openssl rand -hex 16
APP_USER=app
APP_PASSWORD=CHANGE_ME_APP_PASSWORD
MONITORING_USER=metrics
MONITORING_PASSWORD=CHANGE_ME_MONITORING_PASSWORD