Repository navigation
Expand file tree
/
Copy pathdeploy.env.example
More file actions
85 lines (76 loc) · 4.14 KB
/
Copy pathdeploy.env.example
File metadata and controls
85 lines (76 loc) · 4.14 KB
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
# Deployment configuration for ShellySmartEnergy.
#
# Copy to deploy.env next to this file and edit. deploy.env is gitignored —
# never commit a real one. Both docker-prod.sh and podman-prod.sh read it, and
# refuse to start if it's missing or empty — even a local-only run (APP_DOMAIN
# left blank) needs the file to exist.
#
# cp deploy.env.example deploy.env
# ---------------------------------------------------------------------------
# Public hostname
#
# Set this to the hostname Cloudflare Tunnel serves. Setting it switches the app
# into production TLS mode: secure cookies, HSTS, HTTPS redirects, and an
# ALLOWED_HOSTS entry so Django accepts the tunnel's Host header.
#
# Leave it EMPTY for a purely local run (plain HTTP on 127.0.0.1:8000).
# ---------------------------------------------------------------------------
APP_DOMAIN=energypilot.domain.com
# ---------------------------------------------------------------------------
# Where the container listens on the host.
#
# Keep this on loopback. cloudflared connects from the same machine, so nothing
# else needs reach. Binding to 0.0.0.0 would expose the app to your whole LAN
# AND let anything there forge the X-Forwarded-Proto header that Django trusts
# to decide a request arrived over HTTPS.
# ---------------------------------------------------------------------------
BIND_ADDRESS=127.0.0.1
BIND_PORT=8000
# ---------------------------------------------------------------------------
# How long "remember me" keeps a session alive. A stolen session cookie stays
# valid this long, so shorter is safer. 30 days is a reasonable middle ground.
# ---------------------------------------------------------------------------
DJANGO_SESSION_DAYS=30
# ---------------------------------------------------------------------------
# HSTS max-age in seconds. Browsers cache this and will REFUSE plain HTTP to the
# host until it expires, so start small while verifying the deployment
# (3600 = 1 hour) and raise once you are happy. 31536000 = 1 year.
# ---------------------------------------------------------------------------
DJANGO_HSTS_SECONDS=3600
# Only enable these once the domain is definitely HTTPS-only, forever.
# Preload in particular is very hard to undo.
DJANGO_HSTS_INCLUDE_SUBDOMAINS=false
DJANGO_HSTS_PRELOAD=false
# ---------------------------------------------------------------------------
# NEVER set these to true on an internet-facing deployment.
#
# DJANGO_DEBUG renders full tracebacks — including settings, the secret key and
# stored Shelly/Tuya credentials — to whoever triggered the error.
#
# password if one does not already exist.
# ---------------------------------------------------------------------------
DJANGO_DEBUG=false
# ---------------------------------------------------------------------------
# Brute-force lockout (django-axes). Lock a username+IP after this many failed
# logins, releasing after AXES_COOLOFF_HOURS. AXES_PROXY_COUNT=1 tells it the
# real client IP is one hop back (the Cloudflare Tunnel).
# ---------------------------------------------------------------------------
AXES_FAILURE_LIMIT=8
AXES_COOLOFF_HOURS=1
AXES_PROXY_COUNT=1
# ---------------------------------------------------------------------------
# Cloudflare Access SSO (optional). When both are set, a valid Access token
# logs the user straight in (matched to a Django account by email) — no second
# password prompt. Leave blank to keep the normal login form.
# Team domain: your <name>.cloudflareaccess.com
# AUD tag: Access app → Overview → "Application Audience (AUD) Tag"
# ---------------------------------------------------------------------------
CF_ACCESS_TEAM_DOMAIN=energypilot-team.cloudflareaccess.com
CF_ACCESS_AUD=
# ---------------------------------------------------------------------------
# Disk cleanup after deploy. Old app images (beyond the newest 5) and this
# project's untagged leftovers are always pruned. Docker's build cache is
# shared by every project on the host, so clearing it is opt-in: set true only
# if this host is dedicated to this app (or you're fine losing other cache).
# ---------------------------------------------------------------------------
PRUNE_BUILD_CACHE=false