example.env

###
### Base configuration defaults
###
BACKUP_PATH=${BACKUP_PATH:-./backup}
CONFIG_PATH=${CONFIG_PATH:-./config}
DATA_PATH=${DATA_PATH:-./data}

# Docker image tag for prebuilt images from GHCR
# Use 'latest' for development, or a specific git SHA/tag for production
# Example: IMAGE_TAG=abc1234 or IMAGE_TAG=v1.2.3
IMAGE_TAG=${IMAGE_TAG:-latest}
# Root domain for services. E.g. homy.local
DOMAIN=${DOMAIN-local}
LOCAL_SUBNET=${LOCAL_SUBNET:-172.1.1.0/24}
PUID=${PUID:-1000}
PGID=${PGID:-1000}
SECRETS_PATH=${SECRETS_PATH:-./secrets}
TZ=${TZ:-Europe/Sofia}

###
### VPN conviguration
###
VPN_CONFIG_PATH=${CONFIG_PATH}/wireguard
VPN_DATA_PATH=./data/wireguard
VPN_TEMPLATE_PEER_FILE=${VPN_CONFIG_PATH}/templates/peer.conf
VPN_TEMPLATE_SERVER_FILE=${VPN_CONFIG_PATH}/templates/server.conf
# Publicly accessible address to the vpn
VPN_PUBLIC_URL=vpn.${DOMAIN}
# Publicly accessible port of the vpn
VPN_PUBLIC_PORT=51820
# Number of vpn peers or comma-separated list of peer names to generate configuration for
# configuration is available in data/wireguard/peer_${peer-name} after first run
VPN_PEERS=node1,node2
# Subnet for the vpn - change if it clashes with something
VPN_SUBNET=10.13.13.0

###
### Ingress configuration
###
INGRESS_DATA_PATH=./data/ingress
INGRESSGEN_TEMPLATE_NGINX_FILE=${CONFIG_PATH}/ingressgen/templates/nginx.tmpl
# Subnet for the *dmz* network - nginx <-> vpn/broker - and, separately, the
# range VPN clients route over the tunnel (the vpn service's ALLOWEDIPS).
# Despite the name this is NOT the `ingress` network; see PROXY_BACKEND_SUBNET.
# Change if it clashes with something.
INGRESS_SUBNET=10.28.28.0/24
# nginx's address on the dmz network - must be inside INGRESS_SUBNET
INGRESS_ADDRESS=10.28.28.11
# Subnet for the `ingress` network - nginx <-> the services it proxies
# (ha, grafana, z2m, mongo-express). Pinned so Docker cannot renumber it: HA
# checks the proxy's address against trusted_proxies and answers 400 to every
# request if it does not match (#1555). Change if it clashes with something.
# All three PROXY_BACKEND_* vars are REQUIRED - compose aborts without them,
# deliberately, because an empty value here fails silently and recreates #1555.
PROXY_BACKEND_SUBNET=10.28.29.0/24
# Range Docker may hand out dynamically. Must be inside PROXY_BACKEND_SUBNET and
# must NOT contain PROXY_BACKEND_ADDRESS, so nginx's fixed address can never be
# given to another container first.
PROXY_BACKEND_DYNAMIC_RANGE=10.28.29.128/25
# nginx's address on the ingress network - must be inside PROXY_BACKEND_SUBNET
# and outside PROXY_BACKEND_DYNAMIC_RANGE. This is the single source for HA's
# TRUSTED_PROXIES, so the two cannot drift.
PROXY_BACKEND_ADDRESS=10.28.29.11
# Container name for the ingress - must be unique across the docker host
INGRESS_NAME=ingress

###
### Power configuration
###
POWER_CONFIG_PATH=${CONFIG_PATH}/modbus-serial
MAIN_POWER_CONFIG_FILE=${POWER_CONFIG_PATH}/main.config.js
SECONDARY_POWER_CONFIG_FILE=${POWER_CONFIG_PATH}/secondary.config.js
TETRIARY_POWER_CONFIG_FILE=${POWER_CONFIG_PATH}/tetriary.config.js

###
### Grafana configuration
###
GRAFANA_CONFIG_PATH=${CONFIG_PATH}/grafana
GRAFANA_CONFIG_FILE=${GRAFANA_CONFIG_PATH}/config.ini
GRAFANA_CONFIG_DATASOURCE_INFLUXDB_FILE=${GRAFANA_CONFIG_PATH}/datasources/influxdb.yaml
GRAFANA_DATA_PATH=${DATA_PATH}/grafana

###
### Home assistant configuration
###
HOMEASSISTANT_CONFIG=${CONFIG_PATH}/home-assistant
HOMEASSISTANT_CONFIG_CONFIGURATION_FILE=${HOMEASSISTANT_CONFIG}/configuration.yaml
HOMEASSISTANT_CONFIG_AUTOMATIONS_FILE=${HOMEASSISTANT_CONFIG}/configuration/automations.yaml
HOMEASSISTANT_CONFIG_CUSTOMIZE_FILE=${HOMEASSISTANT_CONFIG}/configuration/customize.yaml
HOMEASSISTANT_CONFIG_GROUPS_FILE=${HOMEASSISTANT_CONFIG}/configuration/groups.yaml
HOMEASSISTANT_CONFIG_SCENES_FILE=${HOMEASSISTANT_CONFIG}/configuration/scenes.yaml
HOMEASSISTANT_CONFIG_SCRIPTS_FILE=${HOMEASSISTANT_CONFIG}/configuration/scripts.yaml
HOMEASSISTANT_DOMAIN=ha.${DOMAIN}
HOMEASSISTANT_DATA_PATH=./data/home-assistant

###
### Influx configuration
###
INFLUXDB_CONFIG_FILE=${CONFIG_PATH}/influxdb/influxdb.conf
INFLUXDB_DATABASE=homy
INFLUXDB_SECRET_ADMIN_USER_FILE=${SECRETS_PATH}/influxdb_admin_user
INFLUXDB_SECRET_ADMIN_PASSWORD_FILE=${SECRETS_PATH}/influxdb_admin_password
INFLUXDB_SECRET_USER_FILE=${SECRETS_PATH}/influxdb_user
INFLUXDB_SECRET_USER_PASSWORD_FILE=${SECRETS_PATH}/influxdb_user_password
INFLUXDB_SECRET_READ_USER_FILE=${SECRETS_PATH}/influxdb_read_user
INFLUXDB_SECRET_READ_USER_PASSWORD_FILE=${SECRETS_PATH}/influxdb_read_user_password
INFLUXDB_SECRET_WRITE_USER_FILE=${SECRETS_PATH}/influxdb_write_user
INFLUXDB_SECRET_WRITE_USER_PASSWORD_FILE=${SECRETS_PATH}/influxdb_write_user_password

###
### Mongo configuration
###
MONGO_DATA_PATH=./data/mongo
MONGO_DATABASE=power
MONGO_SECRET_ROOT_PASSWORD_FILE=${SECRETS_PATH}/mongo_root_password
MONGO_SECRET_ROOT_USERNAME_FILE=${SECRETS_PATH}/mongo_root_username

###
### Mongo express configuration
###
MONGO_EXPRESS_DOMAIN=me.${DOMAIN}
MONGO_EXPRESS_SECRET_PASSWORD_FILE=${SECRETS_PATH}/mongo_express_password
MONGO_EXPRESS_SECRET_USERNAME_FILE=${SECRETS_PATH}/mongo_express_username

###
### Zigbee2MQTT configuration
###
# Zigbee2MQTT home1 instance - First floor Zigbee network
# Web UI URL for accessing Zigbee device management interface
Z2M_HOME1_DOMAIN=home1.z2m.${DOMAIN}

# Data directory for device database and logs (must be writable by PUID:PGID)
Z2M_HOME1_DATA_PATH=./data/zigbee2mqtt/home1

# Required secrets (create files in secrets/ directory):
# - z2m_home1_network_key: 16-byte array like [1,3,5,7,9,11,13,15,0,2,4,6,8,10,12,14]
#   Generate: node -e "console.log(JSON.stringify(Array.from({length: 16}, () => Math.floor(Math.random() * 256))))"
# - z2m_home1_serial_port: tcp://192.168.1.100:6638 (network coordinator) or /dev/serial/by-id/usb-... (USB)
# - z2m_home1_adapter: zstack, deconz, ezsp, ember, or auto
# - z2m_home1_frontend_auth_token: Random token for web UI authentication
#   Generate: openssl rand -base64 32

INFLUXDB_ADMIN_PASSWORD=secret
INFLUXDB_USER_PASSWORD=secret
INFLUXDB_READ_USER_PASSWORD=secret
INFLUXDB_WRITE_USER_PASSWORD=secret

###
### Sunseeker Lawn Mower configuration
###
# Device ID for the Sunseeker lawn mower
SUNSEEKER_DEVICE_ID=example-device-123456789
# App ID for MQTT communication
SUNSEEKER_APP_ID=example-app-987654321