.env.example

# baseplate / .env.example
# Copy to `.env`, fill in values, then bring the stack up. Never commit `.env`.

# ── Core ────────────────────────────────────────────────────────────────────
# Root domain managed by Cloudflare (the wildcard cert uses the CF DNS-01 ACME).
DOMAIN=example.com
TZ=UTC
PUID=1000
PGID=1000

# Cloudflare API token: Zone → Zone → Read, Zone → DNS → Edit (scoped to zone).
# Used by acme.sh to issue *.${DOMAIN}.
CF_DNS_API_TOKEN=

# ── Remote access (opt-in profiles) ──────────────────────────────────────────
# tunnel:    Zero Trust → Networks → Tunnels → your tunnel → connector token.
CLOUDFLARED_TUNNEL_TOKEN=
# wireguard: public hostname/IP clients dial; PEERS = how many client configs.
WG_SERVER_HOSTNAME=vpn.example.com
WG_PEERS=3
# ddns:      direct-IP A-record updates instead of the tunnel.
#            Scoped API token (Edit zone DNS template), not the global API key.
DDNS_API_TOKEN=
DDNS_SUBDOMAIN=

# ── Cloud apps ───────────────────────────────────────────────────────────────
NEXTCLOUD_DB_PASSWORD=
NEXTCLOUD_DB_ROOT_PASSWORD=
# Argon2-hash this (see README → Vaultwarden). Empty disables the admin page.
VAULTWARDEN_ADMIN_TOKEN=
HOMARR_SECRET_KEY=
PAPERLESS_DB_PASSWORD=
PAPERLESS_SECRET_KEY=
PAPERLESS_ADMIN_USER=admin
PAPERLESS_ADMIN_PASSWORD=

# ── Monitoring ───────────────────────────────────────────────────────────────
# Beszel hub public key — read it from the hub UI/API after first start.
BESZEL_KEY=
# vuln-scanner emails findings via Resend. Leave the key blank to log only.
RESEND_API_KEY=
ALERT_EMAIL=you@example.com
VULN_SCAN_INTERVAL=604800

# ── Media VPN (vpn profile, gluetun) ─────────────────────────────────────────
VPN_SERVICE_PROVIDER=
VPN_TYPE=openvpn
VPN_USER=
VPN_PASSWORD=
VPN_COUNTRIES=Netherlands

# ── Paths ────────────────────────────────────────────────────────────────────
# Home Assistant config dir (configuration.yaml, .storage, …).
HASS_CONFIG_DIR=./hassio/config