# ARGUS — Environment Configuration
# Copy this file to .env and modify as needed. install.sh does this for you
# automatically, including generating a secure DB_PASSWORD.

# ===========================================
# Required Settings
# ===========================================

# Database password — install.sh generates this for you.
# Manual value: openssl rand -base64 24
DB_PASSWORD=change-me-in-production

# ===========================================
# Optional Settings
# ===========================================

TZ=UTC
DB_USER=postgres
DB_NAME=argus

# ===========================================
# ANIS — Threat Intelligence Integration
# ===========================================
# ANIS is a separate product, deployed independently (self-hosted or via a
# community instance). These vars configure how THIS ARGUS instance talks to
# an already-running ANIS service — they do not start one.
#
# Set ANIS_ENABLED=true and ANIS_URL to turn on reporting WAF auto-bans to
# ANIS and pulling its community threat-intelligence feed.

ANIS_ENABLED=false
# ANIS_URL=https://anis.example.com:8090
ANIS_LICENSE_KEY=
# Must match the ANIS instance's own ANIS_ADMIN_KEY. Generate: openssl rand -hex 32
ANIS_ADMIN_KEY=
ANIS_SHARE_ATTACKERS=false

# ===========================================
# Docker Compatibility (Synology DSM, etc.)
# ===========================================

# Leave empty for auto-detection. Only set if auto-detection fails.
# Synology DSM typically needs: 1.41 or 1.43
# DOCKER_API_VERSION=1.41

# ===========================================
# Network & Port Settings
# ===========================================

# Admin panel port (default: 81)
# UI_PORT=81

# Nginx listen ports — change if 80/443 are already in use
# (e.g. Synology Web Station)
# NGINX_HTTP_PORT=8080
# NGINX_HTTPS_PORT=8443

# API host port — exposed for nginx-to-API communication.
# MUST NOT conflict with NGINX_HTTP_PORT.
# API_HOST_PORT=9080

# DNS Security Engine listen address — host-only (127.0.0.1) by default.
# Set to an internal interface IP to route real client DNS traffic through
# it. Never 0.0.0.0 unless this host is on a fully trusted network.
# DNS_LISTEN_HOST=127.0.0.1