env.example

# Reference schema for the runtime .env. Two ways to produce the real file:
#   - run  scripts/configure.sh  (generates the secrets for you), or
#   - copy this to .env and fill in the blanks by hand.
# The real .env holds secrets and is gitignored — never commit it.

# ---- Plausible --------------------------------------------------------------
DOMAIN=stats.yourdomain.example

# Generate each secret with openssl:
#   SECRET_KEY_BASE   → openssl rand -base64 48
#   TOTP_VAULT_KEY    → openssl rand -base64 32
#   POSTGRES_PASSWORD → openssl rand -hex 32
# POSTGRES_PASSWORD must be hex: it lands raw in DATABASE_URL, and base64's
# '/ + =' break the URL parser. The other two are base64 (plain env vars).
SECRET_KEY_BASE=
TOTP_VAULT_KEY=
POSTGRES_PASSWORD=
DISABLE_REGISTRATION=true

# ---- Optional: MaxMind city-level geolocation -------------------------------
# Off by default. Plausible has country-level geo built in; set these ONLY to
# add city-level data. Get a free key at https://www.maxmind.com/en/geolite2/signup
# then generate a license key in the account dashboard. Also uncomment the two
# MAXMIND_* lines in compose.yml (plausible service). Upstream warns GeoLite2-City
# wants ~1 GB more RAM, but in practice it has run fine on this 2 GB box (swap-backed). Docs:
#   https://github.com/plausible/community-edition/wiki/Maxmind-Integration
# MAXMIND_LICENSE_KEY=
# MAXMIND_EDITION=GeoLite2-City

# ---- Caddy (HTTP-01) --------------------------------------------------------
# Let's Encrypt expiry-notice address. No Cloudflare token: single public host,
# HTTP-01, no DNS-01.
CADDY_EMAIL=you@example.com