# Service dependencies # You may set REDIS_URL instead for more advanced options REDIS_HOST=$DATA_REDIS_HOST REDIS_PORT=6379 # REDIS_DB=0 # You may set DATABASE_URL instead for more advanced options DB_HOST=$DATA_DB_HOST DB_USER=$DATA_DB_USER DB_NAME=gonano DB_PASS=$DATA_DB_PASS DB_PORT=5432 DATABASE_URL=postgresql://$DATA_DB_USER:$DATA_DB_PASS@$DATA_DB_HOST/gonano # Optional ElasticSearch configuration ES_ENABLED=true ES_HOST=$DATA_ELASTIC_HOST ES_PORT=9200 # Optimizations LD_PRELOAD=/data/lib/libjemalloc.so # ImageMagick optimizations MAGICK_TEMPORARY_PATH=/app/tmp MAGICK_MEMORY_LIMIT=128MiB MAGICK_MAP_LIMIT=64MiB MAGICK_TIME_LIMIT=15 MAGICK_AREA_LIMIT=16MP MAGICK_WIDTH_LIMIT=8KP MAGICK_HEIGHT_LIMIT=8KP # Federation # Note: Changing LOCAL_DOMAIN at a later time will cause unwanted side effects, including breaking all existing federation. # LOCAL_DOMAIN should *NOT* contain the protocol part of the domain e.g https://example.com. LOCAL_DOMAIN=${APP_NAME}.nanoapp.io # Changing LOCAL_HTTPS in production is no longer supported. (Mastodon will always serve https:// links) # Use this only if you need to run mastodon on a different domain than the one used for federation. # You can read more about this option on https://github.com/tootsuite/documentation/blob/master/Running-Mastodon/Serving_a_different_domain.md # DO *NOT* USE THIS UNLESS YOU KNOW *EXACTLY* WHAT YOU ARE DOING. # WEB_DOMAIN=mastodon.example.com # Use this if you want to have several aliases handler@example1.com # handler@example2.com etc. for the same user. LOCAL_DOMAIN should not # be added. Comma separated values # ALTERNATE_DOMAINS=example1.com,example2.com # Application secrets # Generate each with the `rake secret` task (`nanobox run bundle exec rake secret`) SECRET_KEY_BASE=$SECRET_KEY_BASE OTP_SECRET=$OTP_SECRET # VAPID keys (used for push notifications) # You can generate the keys using the following command (first is the private key, second is the public one) # You should only generate this once per instance. If you later decide to change it, all push subscription will # be invalidated, requiring the users to access the website again to resubscribe. # # Generate with `rake mastodon:webpush:generate_vapid_key` task (`nanobox run bundle exec rake mastodon:webpush:generate_vapid_key`) # # For more information visit https://rossta.net/blog/using-the-web-push-api-with-vapid.html VAPID_PRIVATE_KEY=$VAPID_PRIVATE_KEY VAPID_PUBLIC_KEY=$VAPID_PUBLIC_KEY # Registrations # Single user mode will disable registrations and redirect frontpage to the first profile # SINGLE_USER_MODE=true # Prevent registrations with following e-mail domains # EMAIL_DOMAIN_BLACKLIST=example1.com|example2.de|etc # Only allow registrations with the following e-mail domains # EMAIL_DOMAIN_WHITELIST=example1.com|example2.de|etc # Optionally change default language # DEFAULT_LOCALE=de # E-mail configuration # Note: Mailgun and SparkPost (https://sparkpo.st/smtp) each have good free tiers # If you want to use an SMTP server without authentication (e.g local Postfix relay) # then set SMTP_AUTH_METHOD and SMTP_OPENSSL_VERIFY_MODE to 'none' and # *comment* SMTP_LOGIN and SMTP_PASSWORD (leaving them blank is not enough). SMTP_SERVER=$SMTP_SERVER SMTP_PORT=587 SMTP_LOGIN=$SMTP_LOGIN SMTP_PASSWORD=$SMTP_PASSWORD SMTP_FROM_ADDRESS=notifications@${APP_NAME}.nanoapp.io #SMTP_DOMAIN= # defaults to LOCAL_DOMAIN #SMTP_DELIVERY_METHOD=smtp # delivery method can also be sendmail #SMTP_AUTH_METHOD=plain #SMTP_CA_FILE=/etc/ssl/certs/ca-certificates.crt #SMTP_OPENSSL_VERIFY_MODE=peer #SMTP_ENABLE_STARTTLS_AUTO=true #SMTP_TLS=true # Optional user upload path and URL (images, avatars). Default is :rails_root/public/system. If you set this variable, you are responsible for making your HTTP server (eg. nginx) serve these files. # PAPERCLIP_ROOT_PATH=/var/lib/mastodon/public-system # PAPERCLIP_ROOT_URL=/system # Optional asset host for multi-server setups # CDN_HOST=https://assets.example.com # S3 (optional) # S3_ENABLED=true # S3_BUCKET= # AWS_ACCESS_KEY_ID= # AWS_SECRET_ACCESS_KEY= # S3_REGION= # S3_PROTOCOL=http # S3_HOSTNAME=192.168.1.123:9000 # S3 (Minio Config (optional) Please check Minio instance for details) # S3_ENABLED=true # S3_BUCKET= # AWS_ACCESS_KEY_ID= # AWS_SECRET_ACCESS_KEY= # S3_REGION= # S3_PROTOCOL=https # S3_HOSTNAME= # S3_ENDPOINT= # S3_SIGNATURE_VERSION= # Swift (optional) # SWIFT_ENABLED=true # SWIFT_USERNAME= # For Keystone V3, the value for SWIFT_TENANT should be the project name # SWIFT_TENANT= # SWIFT_PASSWORD= # Keystone V2 and V3 URLs are supported. Use a V3 URL if possible to avoid # issues with token rate-limiting during high load. # SWIFT_AUTH_URL= # SWIFT_CONTAINER= # SWIFT_OBJECT_URL= # SWIFT_REGION= # Defaults to 'default' # SWIFT_DOMAIN_NAME= # Defaults to 60 seconds. Set to 0 to disable # SWIFT_CACHE_TTL= # Optional alias for S3 if you want to use Cloudfront or Cloudflare in front # S3_CLOUDFRONT_HOST= # Streaming API integration # STREAMING_API_BASE_URL= # Advanced settings # If you need to use pgBouncer, you need to disable prepared statements: # PREPARED_STATEMENTS=false # Cluster number setting for streaming API server. # If you comment out following line, cluster number will be `numOfCpuCores - 1`. # STREAMING_CLUSTER_NUM=1 # Docker mastodon user # If you use Docker, you may want to assign UID/GID manually. # UID=1000 # GID=1000 # LDAP authentication (optional) # LDAP_ENABLED=true # LDAP_HOST=localhost # LDAP_PORT=389 # LDAP_METHOD=simple_tls # LDAP_BASE= # LDAP_BIND_DN= # LDAP_PASSWORD= # LDAP_UID=cn # PAM authentication (optional) # PAM authentication uses for the email generation the "email" pam variable # and optional as fallback PAM_DEFAULT_SUFFIX # The pam environment variable "email" is provided by: # https://github.com/devkral/pam_email_extractor # PAM_ENABLED=true # Fallback Suffix for email address generation (nil by default) # PAM_DEFAULT_SUFFIX=pam # Name of the pam service (pam "auth" section is evaluated) # PAM_DEFAULT_SERVICE=rpam # Name of the pam service used for checking if an user can register (pam "account" section is evaluated) (nil (disabled) by default) # PAM_CONTROLLED_SERVICE=rpam # Global OAuth settings (optional) : # If you have only one strategy, you may want to enable this # OAUTH_REDIRECT_AT_SIGN_IN=true # Optional CAS authentication (cf. omniauth-cas) : # CAS_ENABLED=true # CAS_URL=https://sso.myserver.com/ # CAS_HOST=sso.myserver.com/ # CAS_PORT=443 # CAS_SSL=true # CAS_VALIDATE_URL= # CAS_CALLBACK_URL= # CAS_LOGOUT_URL= # CAS_LOGIN_URL= # CAS_UID_FIELD='user' # CAS_CA_PATH= # CAS_DISABLE_SSL_VERIFICATION=false # CAS_UID_KEY='user' # CAS_NAME_KEY='name' # CAS_EMAIL_KEY='email' # CAS_NICKNAME_KEY='nickname' # CAS_FIRST_NAME_KEY='firstname' # CAS_LAST_NAME_KEY='lastname' # CAS_LOCATION_KEY='location' # CAS_IMAGE_KEY='image' # CAS_PHONE_KEY='phone' # Optional SAML authentication (cf. omniauth-saml) # SAML_ENABLED=true # SAML_ACS_URL= # SAML_ISSUER=http://localhost:3000/auth/auth/saml/callback # SAML_IDP_SSO_TARGET_URL=https://idp.testshib.org/idp/profile/SAML2/Redirect/SSO # SAML_IDP_CERT= # SAML_IDP_CERT_FINGERPRINT= # SAML_NAME_IDENTIFIER_FORMAT= # SAML_CERT= # SAML_PRIVATE_KEY= # SAML_SECURITY_WANT_ASSERTION_SIGNED=true # SAML_SECURITY_WANT_ASSERTION_ENCRYPTED=true # SAML_SECURITY_ASSUME_EMAIL_IS_VERIFIED=true # SAML_ATTRIBUTES_STATEMENTS_UID="urn:oid:0.9.2342.19200300.100.1.1" # SAML_ATTRIBUTES_STATEMENTS_EMAIL="urn:oid:1.3.6.1.4.1.5923.1.1.1.6" # SAML_ATTRIBUTES_STATEMENTS_FULL_NAME="urn:oid:2.5.4.42" # SAML_UID_ATTRIBUTE="urn:oid:0.9.2342.19200300.100.1.1" # SAML_ATTRIBUTES_STATEMENTS_VERIFIED= # SAML_ATTRIBUTES_STATEMENTS_VERIFIED_EMAIL=