# NetTact self-hosting configuration.
# Copy this file to `.env` (which is gitignored) and edit the values below.
#
#   cp .env.example .env

# ── Image version ───────────────────────────────────────────────────────────
# Pin a released tag for reproducible upgrades, or leave 'latest'. Agents are
# versioned independently and deployed by their own installer — nothing here
# affects them.
NETTACT_SERVER_VERSION=latest

# Optional: override the image location, e.g. to run a locally-built image for testing:
#   NETTACT_SERVER_IMAGE=nettact-server       (then NETTACT_SERVER_VERSION=test)
# NETTACT_SERVER_IMAGE=ghcr.io/nettact/nettact-server

# ── Server ──────────────────────────────────────────────────────────────────
# Host port to publish the web console / API on (the container always listens on 12450).
# This is the host side of the port mapping, so an address works here too, and
# restricts the console to that interface:
#   NETTACT_HTTP_PORT=10.0.0.5:12450
NETTACT_HTTP_PORT=12450

# The admin account is created automatically on first run and a one-time password is
# printed to the server log — read it with `docker compose logs server`, log in, then
# change it in the console (Settings) or via
# `docker compose exec server nettact-server passwd -db /data/nettact.db`.

# Timezone used for the timestamps PEOPLE read: notification bodies ("last seen
# 01:42"), the email footer, log lines. Everything stored and transmitted stays UTC,
# so changing this never rewrites history — it only changes how times are printed.
# Any IANA zone name (the server image needs no tzdata package). Unset means UTC,
# which will read hours off from your wall clock unless you actually are on UTC.
# NETTACT_TZ=Asia/Shanghai

# Session cookie Secure attribute: auto | true | false.
#   auto  (default) — Secure only when the server itself serves TLS; plain-HTTP
#                     deployments keep working out of the box.
#   true            — always Secure; set this when a TLS-terminating reverse proxy
#                     (Caddy/Nginx/Traefik) sits in front of the plain-HTTP server.
#   false           — never Secure (not recommended).
# NETTACT_SECURE_COOKIE=auto

# ── Auto-update ──────────────────────────────────────────────────────────────
# Automatic updates: install.sh enables a host systemd timer by default and
# chooses a random NETTACT_UPDATE_CRON on first install. The timer uses the
# host's Docker CLI and Compose plugin to pull the image and recreate the server.
#
# NETTACT_AUTO_UPDATE reports the timer state to the server so the console's
# software-update panel picks the right wording. Re-run install.sh with
# --auto-update or --no-auto-update to install or remove the timer; editing this
# value alone does not change the host timer.
NETTACT_AUTO_UPDATE=false

# 6-field cron reported to the console. install.sh bakes a random minute/hour in
# the host-local 02:00–05:00 window and converts it to systemd OnCalendar.
# NETTACT_UPDATE_CRON=0 30 3 * * *