.env.example

#+#+#+#+---------------------------------------
# Runtime / Environment
# NOTE:
# - Einige Teile des Backends lesen NODE_ENV/DB_* direkt.
# - Andere Teile nutzen SCRAPE_DOJO_* Variablen.
# Daher sind beide Varianten hier dokumentiert.
#+#+#+#+---------------------------------------

# ============================================
# Docker User/Group ID and UMASK
# ============================================
# Set custom user/group IDs for the container process.
# Useful for NAS systems like Unraid (default 99:100) or Synology
# to match host file permissions on mounted volumes.
# Find your IDs: id $(whoami)
PUID=1000
PGID=1000
# File permission mask for newly created files.
# 022 = owner read/write, group/others read-only (default)
# 002 = owner+group read/write, others read-only (recommended for shared access)
UMASK=022

# Standard Node Env (wird u.a. für DB/Auth-Checks verwendet)
NODE_ENV=development

# Scrape Dojo Env (wird z.B. von Health/Puppeteer genutzt)
SCRAPE_DOJO_NODE_ENV=development

# Port for API server
SCRAPE_DOJO_PORT=3000

# Docker flag
SCRAPE_DOJO_DOCKER_ENV=false

# Browser proxy (HTTP or SOCKS)
# Examples: http://proxy:8080, socks5://proxy:1080, http://user:pass@proxy:8080
# SCRAPE_DOJO_PROXY_URL=

# If behind reverse proxy (prod), set this (typically 1)
SCRAPE_DOJO_TRUST_PROXY=1

# CORS allow-list (prod): comma-separated origins, e.g. "https://example.com,https://app.example.com"
# In dev CORS is permissive by default.
SCRAPE_DOJO_CORS_ORIGIN=

# Frontend URL for OIDC redirects (Docker: http://localhost:8080)
SCRAPE_DOJO_FRONTEND_URL=http://localhost:4200

# Export OpenAPI spec on startup (writes dist/apps/api/openapi.json)
EXPORT_OPENAPI=false

# ---------------------------------------
# Database Configuration
# Supported types: sqlite, mysql, postgres
# IMPORTANT: The API currently reads DB_* variables.
# ---------------------------------------

DB_TYPE=sqlite
DB_DATABASE=./data/scrape-dojo.db
DB_SYNCHRONIZE=true
DB_LOGGING=false

# MySQL/PostgreSQL Configuration (optional)
# DB_HOST=localhost
# DB_PORT=3306
# DB_USERNAME=scrape_dojo
# DB_PASSWORD=your_secure_password
# DB_DATABASE=scrape_dojo

# (Legacy/Doc alias) These are kept for convenience but DB_* is used by the API.
# SCRAPE_DOJO_DB_TYPE=sqlite
# SCRAPE_DOJO_DB_DATABASE=./data/scrape-dojo.db
# SCRAPE_DOJO_DB_SYNCHRONIZE=true
# SCRAPE_DOJO_DB_LOGGING=false
# SCRAPE_DOJO_DB_HOST=localhost
# SCRAPE_DOJO_DB_PORT=3306
# SCRAPE_DOJO_DB_USERNAME=scrape_dojo
# SCRAPE_DOJO_DB_PASSWORD=your_secure_password
# SCRAPE_DOJO_DB_DATABASE=scrape_dojo

# Secrets Encryption Key (REQUIRED)
# 256-bit key in hexadecimal format (64 characters)
# Generate a new key: node -e "console.log(require('crypto').randomBytes(32).toString('hex'))"
# IMPORTANT: Keep this key secret and never commit it to version control!
SCRAPE_DOJO_ENCRYPTION_KEY=your_encryption_key_here_64_hex_characters_required_change_me

# Optional: Max size for in-memory log buffer (bytes)
SCRAPE_DOJO_LOG_MAX_BYTES=5000000

# ============================================
# Authentication Settings
# ============================================

# Enable/disable authentication globally
# Set to 'false' to disable all auth (not recommended for production)
SCRAPE_DOJO_AUTH_ENABLED=true

# Require MFA (TOTP) for all users when auth is enabled
SCRAPE_DOJO_AUTH_REQUIRE_MFA=true

# JWT Configuration
# Generate secrets: node -e "console.log(require('crypto').randomBytes(32).toString('hex'))"
SCRAPE_DOJO_AUTH_JWT_SECRET=change-me-jwt-secret-at-least-32-chars
SCRAPE_DOJO_AUTH_REFRESH_TOKEN_SECRET=change-me-refresh-secret-at-least-32-chars
SCRAPE_DOJO_AUTH_ACCESS_TOKEN_EXPIRY=15m
SCRAPE_DOJO_AUTH_REFRESH_TOKEN_EXPIRY=7d

# Rate limit for sensitive auth endpoints
SCRAPE_DOJO_AUTH_RATE_LIMIT_WINDOW_MS=60000
SCRAPE_DOJO_AUTH_RATE_LIMIT_MAX=30

# Optional: API Key for headless/service access
# When set, clients can use X-API-Key header instead of JWT
# SCRAPE_DOJO_AUTH_API_KEY=your-api-key-here

# Trust device risk IP checking (disable behind shared proxies)
SCRAPE_DOJO_AUTH_TRUSTED_DEVICE_RISK_IP=true

# ============================================
# MFA (TOTP) Configuration
# ============================================

# Issuer shown in authenticator apps
SCRAPE_DOJO_AUTH_MFA_ISSUER=Scrape Dojo

# Challenge token signing secret (REQUIRED in production)
SCRAPE_DOJO_AUTH_MFA_CHALLENGE_SECRET=mfa-challenge-secret-change-me

# MFA secret encryption key (REQUIRED in production)
# You can use any strong random string; base64(32 bytes) is accepted too.
SCRAPE_DOJO_AUTH_MFA_ENCRYPTION_KEY=change-me-mfa-encryption-key

# ============================================
# OIDC / SSO Configuration (Optional)
# ============================================

# Enable OIDC authentication
SCRAPE_DOJO_AUTH_OIDC_ENABLED=false

# OIDC Provider URL (issuer)
# Examples:
# - Keycloak: https://keycloak.example.com/realms/your-realm
# - Auth0: https://your-tenant.auth0.com
# - Google: https://accounts.google.com
# - Azure AD: https://login.microsoftonline.com/{tenant}/v2.0
SCRAPE_DOJO_AUTH_OIDC_ISSUER_URL=

# OIDC Client credentials
SCRAPE_DOJO_AUTH_OIDC_CLIENT_ID=
SCRAPE_DOJO_AUTH_OIDC_CLIENT_SECRET=

# Callback URL (must be registered in your OIDC provider)
SCRAPE_DOJO_AUTH_OIDC_REDIRECT_URI=http://localhost:3000/auth/oidc/callback

# Scopes to request (space-separated)
SCRAPE_DOJO_AUTH_OIDC_SCOPES=openid profile email

# Display name for OIDC provider in UI
SCRAPE_DOJO_AUTH_OIDC_PROVIDER_NAME=SSO Login

# ============================================
# OIDC Provider Examples
# ============================================

# --- Keycloak ---
# SCRAPE_DOJO_AUTH_OIDC_ENABLED=true
# SCRAPE_DOJO_AUTH_OIDC_ISSUER_URL=https://keycloak.example.com/realms/scrape-dojo
# SCRAPE_DOJO_AUTH_OIDC_CLIENT_ID=scrape-dojo-client
# SCRAPE_DOJO_AUTH_OIDC_CLIENT_SECRET=your-client-secret
# SCRAPE_DOJO_AUTH_OIDC_PROVIDER_NAME=Keycloak

# --- Auth0 ---
# SCRAPE_DOJO_AUTH_OIDC_ENABLED=true
# SCRAPE_DOJO_AUTH_OIDC_ISSUER_URL=https://your-tenant.auth0.com
# SCRAPE_DOJO_AUTH_OIDC_CLIENT_ID=your-auth0-client-id
# SCRAPE_DOJO_AUTH_OIDC_CLIENT_SECRET=your-auth0-client-secret
# SCRAPE_DOJO_AUTH_OIDC_PROVIDER_NAME=Auth0

# --- Google ---
# SCRAPE_DOJO_AUTH_OIDC_ENABLED=true
# SCRAPE_DOJO_AUTH_OIDC_ISSUER_URL=https://accounts.google.com
# SCRAPE_DOJO_AUTH_OIDC_CLIENT_ID=your-google-client-id.apps.googleusercontent.com
# SCRAPE_DOJO_AUTH_OIDC_CLIENT_SECRET=your-google-client-secret
# SCRAPE_DOJO_AUTH_OIDC_PROVIDER_NAME=Google

# --- Azure AD ---
# SCRAPE_DOJO_AUTH_OIDC_ENABLED=true
# SCRAPE_DOJO_AUTH_OIDC_ISSUER_URL=https://login.microsoftonline.com/{tenant-id}/v2.0
# SCRAPE_DOJO_AUTH_OIDC_CLIENT_ID=your-azure-client-id
# SCRAPE_DOJO_AUTH_OIDC_CLIENT_SECRET=your-azure-client-secret
# SCRAPE_DOJO_AUTH_OIDC_PROVIDER_NAME=Azure AD