.env.example

# CloudFile deployment configuration.
#
#   cp .env.example .env      then edit, then: docker compose up -d
#
# Every CF_ENABLE_* switch is off by default. With all of them off this
# deployment behaves exactly like native Seafile CE -- that is the property the
# P0 regression suite checks, and what keeps following upstream cheap.

# --- image -----------------------------------------------------------------

CLOUDFILE_IMAGE=cloudfile/cloudfile:14.0.0-cf.0

# --- server ----------------------------------------------------------------

# The hostname users reach. Caddy requests a certificate for it when
# CADDY_TLS is set to an email address.
SEAFILE_SERVER_HOSTNAME=cloudfile.example.com
SEAFILE_SERVER_PROTOCOL=https
TIME_ZONE=Asia/Shanghai

HTTP_PORT=80
HTTPS_PORT=443

# "internal" issues a self-signed certificate, which is right for a LAN or a
# first trial. Put an email address here to get a real Let's Encrypt
# certificate -- that requires the hostname above to resolve to this host and
# ports 80/443 to be reachable from the internet.
CADDY_TLS=internal

# Run seafile as an unprivileged user inside the container. Needs
# ./data/seafile to be world-writable; see the upstream non-root notes.
NON_ROOT=false

# --- first-run admin -------------------------------------------------------
# Only read when the deployment is first created.

INIT_SEAFILE_ADMIN_EMAIL=admin@example.com
INIT_SEAFILE_ADMIN_PASSWORD=change-this-now

# --- database --------------------------------------------------------------

INIT_SEAFILE_MYSQL_ROOT_PASSWORD=change-this-too
SEAFILE_MYSQL_DB_USER=seafile
SEAFILE_MYSQL_DB_PASSWORD=change-this-as-well
SEAFILE_MYSQL_DB_CCNET_DB_NAME=ccnet_db
SEAFILE_MYSQL_DB_SEAFILE_DB_NAME=seafile_db
SEAFILE_MYSQL_DB_SEAHUB_DB_NAME=seahub_db

# --- CloudFile capabilities ------------------------------------------------
#
# Changing one of these and running `docker compose up -d` is enough; the
# config is rewritten on every start.

# The switch names are the stable contract and are all declared here, but the
# baseline image ships no capabilities: with a baseline build every one of
# these is inert whatever you set it to.
#
# Capabilities live on their own branches and ship in their own builds -- e.g.
# directory ACL on feature/dir-acl, whose docs/acl-semantics.md describes what
# CF_ENABLE_DIR_ACL then does. Build with CF_SERVER_REF/CF_HUB_REF pointing at
# that branch to get it.
CF_ENABLE_DIR_ACL=false
CF_ENABLE_SSO=false
CF_ENABLE_AUDIT=false
CF_ENABLE_METADATA=false
CF_ENABLE_TAGS=false
CF_ENABLE_SEARCH=false
CF_ENABLE_FILE_PREVIEW=false
CF_ENABLE_ONLYOFFICE=false
CF_ENABLE_FILE_LOCK=false
CF_ENABLE_FAVORITES_ID=false
CF_ENABLE_WATCH=false
CF_ENABLE_CONVERT_EXPORT=false
CF_LOCK_BACKEND=cloudfile
CF_ENABLE_CHECKOUT=false
CF_ENABLE_LOCAL_APP=false
CF_ENABLE_S3_STORAGE=false
CF_ENABLE_EXTERNAL_SOURCES=false
CF_ENABLE_FILEOPS=false
CF_ENABLE_SHARE_RESTRICT=false

# --- External share restriction (CF_ENABLE_SHARE_RESTRICT) ----------------
# When true, CloudFile restricts external sharing: non-admin users cannot
# create share links, and anonymous access to existing share links is denied
# (links are retained and still listed for admins). Default false = native CE
# sharing behavior. See docs/features/share-restrict.md.

# Required by both Seafile and SeaDoc when conversion/export is enabled.
# Generate once with: openssl rand -hex 32
JWT_PRIVATE_KEY=
SEADOC_IMAGE=seafileltd/sdoc-server:2.0-latest

# --- S3 object storage (CF_ENABLE_S3_STORAGE) -----------------------------
# Use three buckets: commits, filesystem objects, and blocks.  The values are
# ignored while the CloudFile switch is false, preserving native CE storage.
SEAF_SERVER_STORAGE_TYPE=
S3_COMMIT_BUCKET=cloudfile-commits
S3_FS_BUCKET=cloudfile-fs
S3_BLOCK_BUCKET=cloudfile-blocks
S3_KEY_ID=minioadmin
S3_SECRET_KEY=change-this-minio-password
S3_HOST=minio:9000
S3_AWS_REGION=us-east-1
S3_USE_HTTPS=true
S3_USE_V4_SIGNATURE=true
S3_PATH_STYLE_REQUEST=true
CF_S3_CONNECTION_TIMEOUT=10
CF_S3_REQUEST_TIMEOUT=60
CF_S3_MAX_RETRIES=2
# Optional local MinIO profile: docker compose --profile s3 up -d
MINIO_ROOT_USER=minioadmin
MINIO_ROOT_PASSWORD=change-this-minio-password
MINIO_API_PORT=9000
MINIO_CONSOLE_PORT=9001
# Required for SEAF_SERVER_STORAGE_TYPE=multiple.  JSON array following
# Seafile's storage-class schema; classes may use only "fs" or "s3" here.
CF_STORAGE_CLASSES_JSON=

# --- Extended properties / tags (metadata profile) ------------------------
# `CF_ENABLE_TAGS` requires `CF_ENABLE_METADATA=true`: tags are metadata
# columns, not a separate service. Start with `--profile metadata`.
#
# Seafile has not published a stable 14.x metadata-server tag as of 2026-07-24.
# The default is the official 14.0.3 testing image solely for compatibility
# validation; pin a tested official image in production before enabling it.
CF_METADATA_IMAGE=seafileltd/seafile-md-server:14.0.3-testing
CF_METADATA_SERVER_URL=http://cloudfile-metadata:8084
CF_METADATA_FILE_COUNT_LIMIT=100000
CF_METADATA_LOG_LEVEL=info
CF_METADATA_MAX_CACHE_SIZE=1GB
CF_METADATA_CHECK_UPDATE_INTERVAL=30m

# --- Search (CF_ENABLE_SEARCH, search profile) -----------------------------
# Unlocks CE's Pro-gated search API (seahub.api2.views.Search and
# public-repos-search). Start with `--profile search` for the backend
# container(s) -- the switch alone does not start them.
#
# CF_PROVIDER_SEARCH empty (the default) means SeaSearch: upstream CE already
# indexes and queries it end to end once seafevents.conf's [SEASEARCH] section
# is enabled, which bootstrap does from this switch plus the token below.
# Set CF_PROVIDER_SEARCH=meilisearch to switch backends instead -- cf-worker
# then also builds and maintains the Meilisearch index (needs the `worker`
# profile too, or `full`). See docs/search.md.
CF_PROVIDER_SEARCH=
# Base64 of "INIT_SS_ADMIN_USER:INIT_SS_ADMIN_PASSWORD".  This is the
# SeaSearch API credential written into seafevents' [SEASEARCH] section;
# generate it with `printf '%s' 'user:password' | base64` after setting the
# first-start account below.  Irrelevant when CF_PROVIDER_SEARCH=meilisearch.
CF_SEASEARCH_TOKEN=
CF_MEILISEARCH_URL=http://meilisearch:7700
# Set to the same value as MEILI_MASTER_KEY (under "optional profiles" below).
# Not a $-reference to it: .env files are not guaranteed to expand variables
# defined earlier in the same file across every supported Compose version, so
# this is a second copy of the one secret rather than a reference that might
# silently resolve to nothing.
CF_MEILISEARCH_API_KEY=
# How often cf-worker's Meilisearch indexer looks for new commits, in seconds.
CF_SEARCH_INDEX_INTERVAL=60
# Files at or under this size (bytes) get their plain-text content indexed
# alongside filename/path/metadata; larger or non-text files are metadata-only.
# Binary formats (docx/pdf/xlsx...) are not extracted -- that is what
# SeaSearch already does through seafevents. See docs/search.md.
CF_SEARCH_INDEX_TEXT_MAX_BYTES=1048576

# --- External sources (CF_ENABLE_EXTERNAL_SOURCES) -------------------------
# Browse an existing SMB/NFS share (a NAS, a department drive) from CloudFile
# without copying its contents into Seafile's object store.
#
# CloudFile does not mount anything: mount the share on the *host* and
# bind-mount it in, which is why one backend covers both SMB and NFS and why no
# privileged container is needed. On the host:
#
#   mount -t cifs //nas/finance /mnt/nas/finance -o ro,credentials=/etc/cifs.cred
#
# then add to docker-compose.yml under the seafile service:
#
#   volumes:
#     - /mnt/nas/finance:/shared/external/finance:ro
#
# An administrator then registers /shared/external/finance as a source through
# api/v2.1/admin/cloudfile/external-sources/. Mount lifecycle stays with ops --
# a new NAS cannot be added from the web UI.
#
# Colon-separated list of prefixes a source root may live under. This is the
# security boundary between "a share ops chose to expose" and "any path in the
# container", so keep it pointed at directories that hold nothing but mounts.
# Empty or "/" is refused at startup rather than accepted. See
# docs/external-sources.md.
CF_EXTERNAL_SOURCES_ROOTS=/shared/external
# When CF_PROVIDER_SEARCH=meilisearch, cf-worker incrementally indexes each
# source without holding the worker loop for a whole NAS tree.
CF_EXTERNAL_SCAN_INTERVAL=60
CF_EXTERNAL_SCAN_MAX_DIRS=20
CF_EXTERNAL_SCAN_MAX_FILES=2000
#
# Structurally unavailable for external sources, by design and not pending:
# desktop sync, WebDAV, zip download, history/trash, file locking and encrypted
# libraries -- all of those are expressed in commits and blocks that an external
# file does not have. Browse, single-file download and preview do work.

# --- Copy/move unified precheck (CF_ENABLE_FILEOPS) ------------------------
# Turns the native fileops/copy and fileops/move endpoints into the
# "precheck -> confirm -> async -> report" flow from the review checklist:
# permission denial, permission-inheritance warning on move, idempotent task id
# and a per-item failure list. Every limit is "0 = unlimited", so enabling the
# switch without tuning these still behaves like native CE. The single-file and
# folder-depth limits are per item (over-limit items land in the failure list);
# the item-count and batch-size limits reject the whole request.
CF_FILEOP_MAX_FILE_SIZE=0
CF_FILEOP_MAX_FOLDER_DEPTH=0
CF_FILEOP_MAX_ITEM_COUNT=0
CF_FILEOP_MAX_BATCH_SIZE=0

# --- SSO (CF_ENABLE_SSO) ---------------------------------------------------
#
# CloudFile's default enterprise identity entry is Authentik (current stable
# reference: 2026.5.6), connected through Seafile CE's generic OAuth2/OIDC
# Authorization Code support. These variables fill that CE support instead of
# hand-editing seahub_settings.py; there is no Authentik-specific protocol
# implementation or currently verified Authentik E2E in this repository.
#
# Two halves. Login is the reused CE path.
# Group mapping is CloudFile's, and is what makes an IdP's org chart show up as
# Seafile groups. The current providers are static and external-service, not a
# direct Authentik directory adapter. See docs/features/sso-authentik.md.
#
# Leave CF_SSO_OAUTH_CLIENT_ID empty to skip the login half entirely -- useful
# when logins already come from LDAP or SAML and only group mapping is wanted.

CF_SSO_OAUTH_CLIENT_ID=
CF_SSO_OAUTH_CLIENT_SECRET=
CF_SSO_OAUTH_AUTHORIZATION_URL=
CF_SSO_OAUTH_TOKEN_URL=
CF_SSO_OAUTH_USER_INFO_URL=
# Optional RP-initiated logout endpoint. For Authentik this is
# https://<host>/application/o/<application_slug>/end-session/.
CF_SSO_OAUTH_LOGOUT_URL=
CF_SSO_OAUTH_SCOPE=openid email profile
# Names this IdP in stored account links. Changing it later orphans them, so
# pick something durable (the IdP's hostname is a good default).
CF_SSO_OAUTH_PROVIDER=
# Which claims carry identity. Defaults suit a standards-compliant OIDC
# provider; change them for one that does not.
CF_SSO_OAUTH_UID_CLAIM=sub
CF_SSO_OAUTH_EMAIL_CLAIM=email
CF_SSO_OAUTH_NAME_CLAIM=name
# true permits the CE OAuth backend to provision a first user; set false when
# accounts must be pre-created. Keep a local administrator either way.
CF_SSO_OAUTH_CREATE_UNKNOWN_USER=true
# Allow http:// to the IdP. For a lab only -- it disables the transport check
# that stops tokens crossing the network in the clear.
CF_SSO_OAUTH_INSECURE=false

# Where group membership comes from: empty (no mapping), "static" (declared
# below) or "external-service" (fetched from your own endpoint).
CF_PROVIDER_SSO_DIRECTORY=
# Account owning the groups the sync creates. Required once a directory is
# selected; the sync refuses to run without it rather than guessing.
CF_SSO_GROUP_OWNER=
CF_SSO_SYNC_INTERVAL=600
# Refuse a sync that would drop more than this share of managed memberships at
# once -- a truncated feed looks exactly like a mass departure. Empty lifts the
# ceiling; do that for one real reorganisation, not as a standing setting.
CF_SSO_MAX_REMOVAL_RATIO=0.5
# For CF_PROVIDER_SSO_DIRECTORY=static: JSON, since compose has no lists.
# [{"external_id":"eng","name":"Engineering","members":["alice@example.com"]}]
CF_SSO_DIRECTORY_STATIC=
# For CF_PROVIDER_SSO_DIRECTORY=external-service. The secret signs both
# directions: our calls out, and the directory's pushes to
# /api/v2.1/cloudfile/sso/directory-webhook/. Without it the webhook does not
# exist, because there would be no way to tell the directory from anyone else.
CF_SERVICE_SSO_DIRECTORY_URL=
CF_SERVICE_SSO_DIRECTORY_SECRET=

# --- Packaged upstream CE capabilities ------------------------------------
#
# These are Seahub's own CE settings, exposed here so they survive container
# recreation.  They are deliberately separate from CF_ENABLE_* extension
# switches: CloudFile adds no code to these features.

# LDAP / Active Directory. All five connection values are required once this
# is enabled. Keep the password in a secret manager-backed .env in production.
CF_LDAP_ENABLED=false
CF_LDAP_SERVER_URL=
CF_LDAP_BASE_DN=
CF_LDAP_ADMIN_DN=
CF_LDAP_ADMIN_PASSWORD=
CF_LDAP_LOGIN_ATTR=uid
CF_LDAP_PROVIDER=ldap
CF_LDAP_FILTER=
CF_LDAP_CONTACT_EMAIL_ATTR=mail

# AI: reuse the existing Seafile AI extension for on-demand tagging, summary,
# image caption and OCR; see docs/features/seafile-ai.md. CE already ships the
# integration without a Pro gate -- ENABLE_SEAFILE_AI
# and friends are read straight from the process environment by
# seahub/settings.py, so unlike LDAP/ADFS above there is no seahub_settings.py
# translation step; these variables are the entire interface. Deployment shape
# per https://manual.seafile.com/14.0/extension/seafile-ai/. `docker compose
# --profile ai up -d` starts the official seafile-ai component, which needs
# CF_ENABLE_METADATA=true (it is a documented prerequisite) and its own LLM
# backend configured separately (an OpenAI-compatible API or a local model,
# using seafile_ai_config.example.yaml as a template) -- the runtime copy is
# an operator task, not generated here. CloudFile does not build a parallel AI
# backend or automatic ingest pipeline; the packaged Seafile capability is the
# default and is extended only after a verified requirement appears.
CF_AI_ENABLED=false
CF_AI_SERVER_URL=http://seafile-ai:8888
CF_AI_SECRET_KEY=
CF_AI_LOG_LEVEL=info
# Requires CF_ENABLE_METADATA=true too (upstream ANDs both flags): results
# land in file metadata, so there is nowhere to store them without it.
CF_AI_FACE_RECOGNITION_ENABLED=false
CF_AI_IMAGE=seafileltd/seafile-ai:14.0-latest

# ADFS / SAML. Put sp.key and sp.crt in data/seafile/seahub-data/certs before
# enabling it. The mapping is JSON, e.g. {"uid":["uid"],"email":["mail"]}.
CF_ADFS_ENABLED=false
CF_ADFS_REMOTE_METADATA_URL=
CF_ADFS_ATTRIBUTE_MAPPING_JSON=
CF_ADFS_PROVIDER_IDENTIFIER=saml
CF_ADFS_XMLSEC_BINARY_PATH=/usr/bin/xmlsec1
CF_ADFS_CERTS_DIR=/opt/seafile/seahub-data/certs

# Shibboleth. This needs an authenticated Shibboleth SP reverse proxy in front
# of CloudFile; the stock Caddy proxy is not such a proxy. It must strip
# untrusted client headers and set CF_SHIBBOLETH_REMOTE_USER_HEADER only after
# authentication. JSON settings are optional maps.
CF_SHIBBOLETH_ENABLED=false
CF_SHIBBOLETH_REMOTE_USER_HEADER=HTTP_REMOTE_USER
CF_SHIBBOLETH_ATTRIBUTE_MAP_JSON=
CF_SHIBBOLETH_AFFILIATION_ROLE_MAP_JSON=
CF_SHIBBOLETH_LOGOUT_URL=
CF_SHIBBOLETH_LOGOUT_RETURN=

# Override CE's built-in user/admin role policies. Values are JSON objects and
# merge with upstream defaults; omit both variables to leave CE unchanged.
CF_ROLE_PERMISSIONS_JSON=
CF_ADMIN_ROLE_PERMISSIONS_JSON=

# Users can enroll 2FA once enabled. Set remember days to 0 to disable device
# remembering while retaining 2FA.
CF_TWO_FACTOR_ENABLED=false
CF_TWO_FACTOR_DEVICE_REMEMBER_DAYS=90

# --- write lifecycle gate (test only) --------------------------------------
# Registers a provider that journals every write and refuses any operation on a
# path containing the token as one of its components. It exists so the write
# lifecycle seam can be gated before the file lock is implemented; it can
# refuse writes and it appends to a file on every one, so leave it false.
# Used by tests/e2e/fileop_matrix.py and verify-local.sh cap fileop.
CF_FILEOP_TEST_PROVIDER=false
CF_FILEOP_TEST_REFUSE_TOKEN=cf-refuse
CF_FILEOP_TEST_JOURNAL=/shared/cf-fileop-journal.log

# --- optional profiles -----------------------------------------------------
# Only needed when starting the matching profile.

# docker compose --profile search up -d
# Copy the same value into CF_MEILISEARCH_API_KEY above if CF_PROVIDER_SEARCH=meilisearch.
MEILI_MASTER_KEY=
# SeaSearch 1.0 credentials are used only for its first initialization. Keep
# them safe: CF_SEASEARCH_TOKEN is the base64 encoding of this exact pair.
CF_SEASEARCH_IMAGE=seafileltd/seasearch:1.0-latest
INIT_SS_ADMIN_USER=
INIT_SS_ADMIN_PASSWORD=
SS_MAX_OBJ_CACHE_SIZE=10GB
SS_STORAGE_TYPE=disk
SS_LOG_LEVEL=info

# docker compose --profile office up -d
# Same-source JWT shared by the Hub, the worker and the Document Server.
# CF_ENABLE_ONLYOFFICE=true refuses to start unless this is non-empty, and
# the callback view rejects unsigned tokens under this secret. Generate once:
#   openssl rand -hex 32
ONLYOFFICE_JWT_SECRET=
# Document Server endpoint the renderer loads. The Hub derives its converter
# URL and the callback download's trusted origin from this value, so it must
# point at the same Document Server the office profile starts.
# Default below matches the in-compose onlyoffice service on the internal
# network; override when you terminate TLS at a different host.
ONLYOFFICE_APIJS_URL=http://onlyoffice:80/web-apps/apps/api/documents/api.js