.env.example

# Copy to .env and fill in. Loaded by docker compose.

# GitHub OAuth App (https://github.com/settings/developers)
# The OAuth callback URL on the app must match OAUTH_REDIRECT_URL below.
GITHUB_CLIENT_ID=
GITHUB_CLIENT_SECRET=

# 32+ random bytes. The server signs session JWTs with this secret.
# Rotating this invalidates every existing login.
# NOTE: JWT_SECRET=dev disables ALL auth/RBAC/MFA/CSRF and is local-dev only.
# It now also requires SHELLFLEET_DEV=1, so a stray 'dev' value in production
# is fatal at startup instead of silently disabling every protection.
JWT_SECRET=
# SHELLFLEET_DEV=1

# Secure flag on auth + CSRF cookies. On by default; set to 0/false/no/off
# only for plain-HTTP local development.
# COOKIE_SECURE=

# Public URLs the server hands back during OAuth. Override per environment.
OAUTH_REDIRECT_URL=https://dashboard.example.com/auth/callback
UI_URL=https://dashboard.example.com/

# Comma-separated list of GitHub logins allowed to sign in.
# The first allowlisted login that signs in becomes admin; everyone
# else defaults to viewer (read-only). To bootstrap a specific login
# as admin regardless of sign-in order, set BOOTSTRAP_ADMIN below.
#
# Note: Community Edition is capped at 3 active seats. An allowlisted
# login that hasn't signed in yet still consumes a seat the moment it
# does — past the cap, new sign-ins are rejected at the OAuth
# callback. An admin can free seats at /admin.
ALLOWED_GITHUB_USERS=

# Optional: pin a specific GitHub login as the bootstrap admin. Useful
# when the allowlist contains multiple users and you need a particular
# one to land in the admin role on first contact.
# BOOTSTRAP_ADMIN=sppidy

# Exact CIDR(s) of the reverse proxy peer as seen by the server container.
# Forwarded client-IP headers are ignored from every other peer. Do not use
# 0.0.0.0/0; inspect the Docker/ingress network and list only its gateway CIDR.
TRUSTED_PROXY_CIDRS=

# Public WebSocket URL the Next.js client connects to.
NEXT_PUBLIC_WS_URL=wss://dashboard.example.com/ui/ws

# Optional legacy shared agent token. Leave empty to disable; the server
# rejects an empty AGENT_SECRET so a default value cannot become a
# universal backdoor. Per-agent tokens issued through /device/approve are
# the supported path.
AGENT_SECRET=

# ─── Outbound notifications on update_window.result ─────────────────
# Each sink below is independent. Set the ones you want, leave the
# rest blank/unset. All configured sinks fire in parallel; each
# delivery is audit-logged separately so a Discord outage doesn't
# hide a Telegram success.

# Generic webhook (Mattermost / n8n / custom receivers).
# These are the BARE names docker-compose.yml actually forwards into the
# container. (Per-event-type routing via UPDATE_/HEALTH_/BACKUP_/CONNECT_/
# DISCONNECT_ prefixes also works in the code, but those need matching
# passthroughs added to the compose `environment:` list — the bare names
# below are the default sink for every event type.)
#
# WEBHOOK_FORMAT chooses the body shape:
#   "json"  — structured event {event, agent_id, status, log, error, at}
#   "slack" — Slack-attachment text
# WEBHOOK_URL=
# WEBHOOK_FORMAT=json
# Agent identifiers and command/probe output are omitted from outbound
# webhook payloads by default. Opt in only for trusted destinations.
# WEBHOOK_EXPOSE_AGENT_ID=false
# WEBHOOK_INCLUDE_OUTPUT=false

# Slack-only convenience. Equivalent to setting WEBHOOK_URL +
# WEBHOOK_FORMAT=slack. Either works; this just makes a
# multi-sink config (Slack + Discord + Telegram) read more clearly.
# SLACK_WEBHOOK_URL=

# Discord webhook URL. Posts native Markdown via the `content` field
# (renders cleaner than Slack-format at the /slack endpoint). Get it
# from a channel: Edit Channel → Integrations → Webhooks → New.
# DISCORD_WEBHOOK_URL=

# Telegram bot. Create the bot with @BotFather, add it to your group
# or channel, and grab the chat id (numeric for private/group, or
# "@channelname" for a public channel). The chat id of a private
# group can be found by sending a message and then GET-ing
# https://api.telegram.org/bot<TOKEN>/getUpdates.
# TELEGRAM_BOT_TOKEN=
# TELEGRAM_CHAT_ID=

# ─── Anonymous usage telemetry ─────────────────────────────
# Default ON. Reports only counts (users, agents), version, CE/EE
# edition, and enabled-feature names — never logins, hostnames, IPs, or
# agent ids. A one-line notice is logged on first send. Disable entirely
# with SHELLFLEET_TELEMETRY=off (or toggle at runtime on the admin page).
# The collector endpoint is hardcoded; there is no URL override.
# SHELLFLEET_TELEMETRY=on
# Required for telemetry reports. Generate a distinct high-entropy value and
# configure the same value as the TELEMETRY_INGEST_HMAC_KEY Worker secret.
# SHELLFLEET_TELEMETRY_HMAC_KEY=

# EE license signing-key rotation. Add the next Ed25519 public key here before
# the license service starts signing with that key id; retain prior entries
# until all licenses issued under them have expired or been replaced.
# EE_LICENSE_PUBLIC_KEYS_JSON={}

# CE↔EE request authentication. Required only when EE_SIDECAR_URL is enabled.
# Generate two independent values with `openssl rand -base64 32`; never reuse
# either key for JWTs, recordings, licensing, or the opposite direction.
# CE_TO_EE_HMAC_KEYS_JSON={"2026-07":"BASE64_32_BYTE_KEY"}
# CE_TO_EE_HMAC_ACTIVE_KEY_ID=2026-07
# EE_TO_CE_HMAC_KEYS_JSON={"2026-07":"DIFFERENT_BASE64_32_BYTE_KEY"}
# EE_TO_CE_HMAC_ACTIVE_KEY_ID=2026-07

# EE recording encryption has a separate rotatable keyring. EE writes SFR2
# envelopes with the active id and retains old entries for playback.
# EE_RECORDING_ENCRYPTION_KEYS_JSON={"2026-07":"THIRD_BASE64_32_BYTE_KEY"}
# EE_RECORDING_ENCRYPTION_ACTIVE_KEY_ID=2026-07