.env.example

PLEX_BASEURL=http://localhost:32400
PLEX_TOKEN=YOUR_PLEX_TOKEN
TRAKT_CLIENT_ID=YOUR_TRAKT_CLIENT_ID
TRAKT_CLIENT_SECRET=YOUR_TRAKT_CLIENT_SECRET
SIMKL_CLIENT_ID=YOUR_SIMKL_CLIENT_ID
SIMKL_CLIENT_SECRET=YOUR_SIMKL_CLIENT_SECRET
# Optional custom redirect URIs
# TRAKT_REDIRECT_URI=http://localhost:5030/oauth/trakt
# SIMKL_REDIRECT_URI=http://localhost:5030/oauth/simkl
PLEXYTRACK_CONFIG_DIR=/config
PLEXYTRACK_STATE_DIR=/state

# --- Security hardening (optional) ---
# Keeps sessions valid across restarts and required for a stable login. If
# unset, a random key is generated each start (all sessions invalidated on
# restart). Set to a long random string for internet-exposed deployments.
# FLASK_SECRET_KEY=change-me-to-a-long-random-string
# Number of trusted reverse proxies in front of PlexyTrack. Set to 1 (or the
# exact count) when running behind Nginx/Traefik/Caddy so login rate limiting
# sees the real client IP. Leave at 0 when exposed directly (prevents
# X-Forwarded-For spoofing).
# PLEXYTRACK_TRUSTED_PROXY_COUNT=0
# Set to true when serving over HTTPS so session/CSRF cookies are Secure.
# PLEXYTRACK_SECURE_COOKIES=false
# Minimum length enforced for new/changed passwords.
# PLEXYTRACK_MIN_PASSWORD_LENGTH=8
# Optional shared secret required on the /webhook endpoint. When set, Plex must
# call e.g. http://host:5030/webhook?token=YOUR_SECRET
# PLEXYTRACK_WEBHOOK_TOKEN=
# Comma-separated Host allowlist. When set, requests whose Host header is not in
# the list are rejected (blocks Host-header spoofing). Set to your domain(s).
# PLEXYTRACK_ALLOWED_HOSTS=plexytrack.example.com
# Max request body size in MB (protects /backup/restore from oversized uploads).
# PLEXYTRACK_MAX_UPLOAD_MB=32
# HSTS is sent on HTTPS responses by default; set to false to disable.
# PLEXYTRACK_HSTS=true
# Log verbosity: DEBUG, INFO (default), WARNING or ERROR.
# PLEXYTRACK_LOG_LEVEL=INFO
# Number of recent log lines kept in memory for the live Logs page (default 2000).
# PLEXYTRACK_LOG_BUFFER=2000