.env.example

# Required
JWT_SECRET=

# Data directory (default: /var/lib/hypeman)
DATA_DIR=/var/lib/hypeman

# Server configuration
# PORT=8080

# Network configuration
# BRIDGE_NAME=vmbr0
# SUBNET_CIDR=10.100.0.0/16
# SUBNET_GATEWAY=         # empty = derived from SUBNET_CIDR
# UPLINK_INTERFACE=       # empty = auto-detect from default route
# DNS_SERVER=1.1.1.1

# Logging
# LOG_LEVEL=info          # debug, info, warn, error

# Caddy / Ingress configuration
# CADDY_LISTEN_ADDRESS=0.0.0.0
# CADDY_ADMIN_ADDRESS=127.0.0.1
# CADDY_ADMIN_PORT=0               # 0 = random (for dev); install script sets to 2019 for production
# INTERNAL_DNS_PORT=0             # 0 = random (for dev); install script sets to 5353 for production
# CADDY_STOP_ON_SHUTDOWN=false   # Set to true if you want Caddy to stop when hypeman stops

# =============================================================================
# TLS / ACME Configuration (for HTTPS ingresses)
# =============================================================================
# Required for TLS ingresses:
# ACME_EMAIL=admin@example.com
# ACME_DNS_PROVIDER=cloudflare

# IMPORTANT: You must specify which domains are allowed for TLS certificates.
# This prevents typos and ensures you only request certificates for domains you control.
# TLS_ALLOWED_DOMAINS=*.example.com,api.other.com
# Supports:
#   - Exact matches: api.example.com
#   - Wildcard subdomains: *.example.com (matches foo.example.com, NOT foo.bar.example.com)
# If not set, no TLS ingresses are allowed.

# Optional ACME settings:
# ACME_CA=                       # empty = Let's Encrypt production
                                 # Use https://acme-staging-v02.api.letsencrypt.org/directory for testing

# DNS propagation settings (applies to all providers):
# DNS_PROPAGATION_TIMEOUT=2m     # Max time to wait for DNS propagation
# DNS_RESOLVERS=1.1.1.1,8.8.8.8  # Custom DNS resolvers for propagation checking

# -----------------------------------------------------------------------------
# Cloudflare DNS Provider (ACME_DNS_PROVIDER=cloudflare)
# -----------------------------------------------------------------------------
# CLOUDFLARE_API_TOKEN=your-api-token
# Token needs Zone:DNS:Edit permissions for the domains you want certificates for
# =============================================================================
# OpenTelemetry Configuration
# =============================================================================
# OTEL_ENABLED=false
# OTEL_ENDPOINT=127.0.0.1:4317
# OTEL_SERVICE_NAME=hypeman
# OTEL_SERVICE_INSTANCE_ID=          # default: hostname
# OTEL_INSECURE=true
# OTEL__METRIC_EXPORT_INTERVAL=60s   # OTLP push cadence (when OTEL_ENABLED=true)
# METRICS__LISTEN_ADDRESS=127.0.0.1
# METRICS__PORT=9464
# METRICS__VM_LABEL_BUDGET=200        # warn when observed per-VM metric labels exceed budget
# ENV=dev                             # deployment environment

# =============================================================================
# Resource Limits
# =============================================================================
# Per-instance limits
# MAX_VCPUS_PER_INSTANCE=16
# MAX_MEMORY_PER_INSTANCE=32GB

# Aggregate limits (0 or empty = unlimited)
# MAX_TOTAL_VCPUS=0
# MAX_TOTAL_MEMORY=
# MAX_TOTAL_VOLUME_STORAGE=

# Other limits
# MAX_CONCURRENT_BUILDS=1
# MAX_OVERLAY_SIZE=100GB