# ⚠️  INSECURE DEFAULTS — for local development only.
# Before exposing this stack to a network, change ZITADEL_MASTERKEY,
# POSTGRES_ADMIN_PASSWORD, and POSTGRES_ZITADEL_PASSWORD.
# See: https://zitadel.com/docs/self-hosting/deploy/compose#homelab

# -----------------------------
# Domain and external URL
# -----------------------------
ZITADEL_DOMAIN=localhost
# Used by the base (non-TLS) compose; TLS overlays also publish 80/443 and may still expose
# this port unless their ports are adjusted.
PROXY_HTTP_PUBLISHED_PORT=8080
ZITADEL_EXTERNALPORT=8080
ZITADEL_EXTERNALSECURE=false
# Overridden by TLS overlays (they hardcode X-Forwarded-Proto: https).
ZITADEL_PUBLIC_SCHEME=http

# -----------------------------
# Security/bootstrap
# -----------------------------
# Must be exactly 32 chars for new deployments.
ZITADEL_MASTERKEY=MasterkeyNeedsToHave32Characters
LOGIN_CLIENT_PAT_EXPIRATION=2099-01-01T00:00:00Z

# -----------------------------
# Pinned image tags
# To upgrade ZITADEL, bump ZITADEL_VERSION and run:
#   docker compose --env-file .env -f docker-compose.yml pull
#   docker compose --env-file .env -f docker-compose.yml up -d --wait
# -----------------------------
ZITADEL_VERSION=v4.13.0
TRAEFIK_IMAGE=traefik:v3.6.8
POSTGRES_IMAGE=postgres:17.2-alpine
REDIS_IMAGE=redis:7.4.2-alpine
OTEL_COLLECTOR_IMAGE=otel/opentelemetry-collector-contrib:0.114.0

# -----------------------------
# Proxy settings
# -----------------------------
TRAEFIK_DASHBOARD_ENABLED=false
TRAEFIK_LOG_LEVEL=INFO
TRAEFIK_ACCESSLOG_ENABLED=true
# Trusted proxy IPs for X-Forwarded-* headers (external-tls mode).
# Comma-separated CIDR ranges of your upstream load balancer / reverse proxy.
TRAEFIK_TRUSTED_IPS=10.0.0.0/8,172.16.0.0/12,192.168.0.0/16

# Let's Encrypt mode
LETSENCRYPT_EMAIL=ops@example.com

# -----------------------------
# Postgres settings
# -----------------------------
POSTGRES_DB=zitadel
POSTGRES_ADMIN_USER=postgres
POSTGRES_ADMIN_PASSWORD=postgres
# DSN used by ZITADEL to connect to PostgreSQL.
# The start-from-init command uses this DSN to create the database schema and for
# normal operation. When a DSN is configured, ZITADEL does not create or switch
# to a separate unprivileged database user; the user in this DSN is used directly
# and must already exist. For production, configure this DSN to use a non-superuser
# role with only the permissions ZITADEL needs.
# See https://www.postgresql.org/docs/current/libpq-connect.html#LIBPQ-CONNSTRING
ZITADEL_DATABASE_POSTGRES_DSN=postgresql://postgres:postgres@postgres:5432/zitadel?sslmode=disable

# -----------------------------
# Access logs
# -----------------------------
ZITADEL_ACCESS_LOG_STDOUT_ENABLED=true

# -----------------------------
# Optional Redis cache settings
# Default is disabled.
# Enable with --profile cache and switch connectors to redis.
# -----------------------------
ZITADEL_CACHES_CONNECTORS_REDIS_ENABLED=false
# DSN used by ZITADEL to connect to Redis.
# See https://redis.io/docs/latest/develop/tools/cli/#host-port-password-and-database
ZITADEL_CACHES_CONNECTORS_REDIS_URL=redis://redis:6379/0
ZITADEL_CACHES_INSTANCE_CONNECTOR=
ZITADEL_CACHES_MILESTONES_CONNECTOR=
ZITADEL_CACHES_ORGANIZATION_CONNECTOR=

# -----------------------------
# Optional API tracing (OTEL)
# Default is disabled. Enable with --profile observability.
# The collector receives traces from ZITADEL on port 4317 (gRPC) and 4318 (HTTP)
# and logs them to stdout by default.
# To forward traces to your own backend (Grafana Tempo, Jaeger, OpenObserve, etc.),
# uncomment the otlp exporter in otel-collector-config.yaml and set:
# OTEL_BACKEND_ENDPOINT=http://your-backend:4317
# -----------------------------
ZITADEL_INSTRUMENTATION_SERVICENAME=zitadel-api
ZITADEL_INSTRUMENTATION_TRACE_EXPORTER_TYPE=none
ZITADEL_INSTRUMENTATION_TRACE_EXPORTER_ENDPOINT=otel-collector:4317
ZITADEL_INSTRUMENTATION_TRACE_EXPORTER_INSECURE=true

# -----------------------------
# Future Login OTEL placeholders
# Current login image may ignore these.
# -----------------------------
LOGIN_OTEL_SERVICE_NAME=zitadel-login
LOGIN_OTEL_EXPORTER_OTLP_ENDPOINT=
LOGIN_OTEL_EXPORTER_OTLP_PROTOCOL=grpc