.env.example

# ─────────────────────────────────────────────────────
# Mintlayer Web GUI — Environment Variables
# Copy this file to .env and fill in your values.
# ─────────────────────────────────────────────────────

# Docker user/group IDs (match your host user to avoid permission issues)
ML_USER_ID=1000
ML_GROUP_ID=1000

# ── Node RPC ─────────────────────────────────────────
# Credentials for the node-daemon RPC server.
NODE_RPC_USERNAME=node_user
NODE_RPC_PASSWORD=node_password_change_me

# ── Wallet RPC ────────────────────────────────────────
# Credentials for the wallet-rpc-daemon.
# IMPORTANT: Change these before running in any exposed environment.
WALLET_RPC_USERNAME=wallet_user
WALLET_RPC_PASSWORD=wallet_password_change_me

# wallet-rpc-daemon command (network only — wallet files are managed via the web UI).
# init.sh writes this automatically. Edit only to change the network.
WALLET_RPC_CMD=wallet-rpc-daemon mainnet

# Network: mainnet or testnet. Must match WALLET_RPC_CMD above.
# Controls explorer links, address prefixes, and other network-specific behaviour.
NETWORK=mainnet

# ── Web GUI ───────────────────────────────────────────
# Port the Astro web interface listens on (host port).
WEB_GUI_PORT=4321

# Public hostname used to access this GUI (set by init.sh).
# Used to display the correct URL in the summary and to derive the Passkeys RP ID.
WEB_GUI_HOST=localhost

# ── Passkeys (WebAuthn) ───────────────────────────────
# Set by init.sh from WEB_GUI_HOST. Override only if behind a reverse proxy
# that rewrites the hostname (e.g. your Node process sees a different URL
# than the browser does).
#
# PASSKEY_RP_ID:  The hostname browsers bind passkeys to. Must be a DNS name
#                 (not a raw IP). 'localhost' works for local access.
# PASSKEY_ORIGIN: Full origin the browser connects to (scheme + host + optional port).
#
# If left empty, both are auto-derived from each request's URL.
PASSKEY_RP_ID=localhost
PASSKEY_ORIGIN=http://localhost:4321

# ── Web UI Authentication ─────────────────────────────
# SESSION_SECRET: 32+ byte hex key used to sign session cookies. Generated by init.sh.
# Password and 2FA secret are stored in mintlayer-data/prefs/mintlayer_prefs.sqlite
# and managed via the web UI Settings page.
SESSION_SECRET=<64-hex-chars-random>

# ── Indexer (optional, profile: indexer) ─────────────
# Only needed when running: docker compose --profile indexer up
POSTGRES_USER=mintlayer
POSTGRES_PASSWORD=postgres_password_change_me
POSTGRES_DB=mintlayer

# Port exposed by the api-web-server (blockchain REST API).
API_WEB_SERVER_PORT=3000

# ── IPFS Storage (optional) ──────────────────────────────
# Provider for token/NFT image uploads. Choose one:
#   filebase — 5 GB free, always public — https://filebase.com
#   pinata   — requires paid plan for public files — https://app.pinata.cloud
# Leave empty to disable uploads (URLs can still be entered manually).
IPFS_PROVIDER=

# Bucket-specific IPFS API key for Filebase (required when IPFS_PROVIDER=filebase)
# Found at https://console.filebase.com/keys — scroll to the bottom of the page
# (these are different from the S3 access keys shown at the top).
FILEBASE_TOKEN=

# JWT for Pinata (required when IPFS_PROVIDER=pinata)
# Also accepted when IPFS_PROVIDER is unset, for backward compatibility.
PINATA_JWT=

# Pinata dedicated gateway hostname (no https://, no trailing slash).
# Only needed for the make-nft-images-public backfill script (Pinata users only).
# Found in Pinata dashboard → Gateways. Looks like: yourname.mypinata.cloud
PINATA_GATEWAY_URL=

# ── Watchtower (optional, profile: watchtower) ───────
# Auto-updates Mintlayer Docker images daily at 04:00.
# Start with: docker compose --profile watchtower up -d
#
# Optional Telegram notification when an image is updated.
# Format: telegram://BOT_TOKEN@telegram?channels=CHAT_ID
# Leave empty to disable notifications.
WATCHTOWER_NOTIFICATION_URL=

# ── Misc ─────────────────────────────────────────────
# Log level for Rust-based services (error, warn, info, debug, trace)
RUST_LOG=info