.env.example

SANDBOX__SERVER__API_TOKEN=replace-with-at-least-32-random-characters
SANDBOX__SERVER__NODE_TOKEN=replace-with-a-different-random-token
SANDBOX__STORE__DATABASE_URL=postgres://sandbox:sandbox@postgres:5432/sandbox
SANDBOX__NODE__CONTROL_PLANE_URL=http://sandboxd:8080
SANDBOX__NODE__TOKEN=replace-with-a-different-random-token

# Bind the optional host-side controller port to loopback when an outbound
# tunnel or local reverse proxy is the only supported ingress path.
SANDBOX_PORT=127.0.0.1:8080

# Public tunnels are opt-in. Point *.tunnel.example.com at the public edge first.
SANDBOX_TUNNEL_ENABLED=false
SANDBOX_TUNNEL_DOMAIN=tunnel.example.com
SANDBOX_TUNNEL_SCHEME=https
SANDBOX_TUNNEL_ENTRYPOINT=websecure
SANDBOX_TUNNEL_EDGE_TLS=true
SANDBOX_TUNNEL_CERT_RESOLVER=letsencrypt
SANDBOX_TUNNEL_MAX_PER_SANDBOX=8
SANDBOX_ACME_EMAIL=admin@example.com

# Optional Cloudflare Full (strict) origin TLS. Keep the private key in the
# gitignored deploy/compose/secrets directory or another root-readable path.
CLOUDFLARE_ORIGIN_CERT_FILE=./secrets/cloudflare-origin.crt
CLOUDFLARE_ORIGIN_KEY_FILE=./secrets/cloudflare-origin.key

# Optional Cloudflare Tunnel overlay. Store the connector token in this
# gitignored file with mode 0600; never put the token in this env file.
CLOUDFLARE_TUNNEL_TOKEN_FILE=./secrets/cloudflare-tunnel.token