AutoNAS/.env.sample at main · SimonTvnt/AutoNAS · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
# =============================================================================
# AutoNAS Environment Configuration
# =============================================================================
# Copy this file to .env and fill in all required values:
#   cp .env.sample .env
#
# SECURITY: Change ALL default passwords before deploying!
#           Default credentials (adminadmin) MUST be replaced.
# =============================================================================

# Media directory path (root for downloads/, shows/, movies/)
MEDIA_DIR=/path/to/your/media

# Timezone (https://en.wikipedia.org/wiki/List_of_tz_database_time_zones)
TZ=Europe/Paris

# User and Group IDs for file ownership (run: id $(whoami) to find yours)
PUID=1000
PGID=1000

# =============================================================================
# Gluetun VPN Configuration (ProtonVPN WireGuard)
# Get these values from ProtonVPN: Account > Downloads > WireGuard configuration
# =============================================================================
VPN_SERVICE_PROVIDER=protonvpn
VPN_TYPE=wireguard
WIREGUARD_PRIVATE_KEY=your_private_key
WIREGUARD_ADDRESSES=10.2.0.2/32
WIREGUARD_PUBLIC_KEY=your_public_key
SERVER_COUNTRIES=France

# Gluetun HTTP control server credentials — CHANGE THESE
GLUETUN_USER=admin
GLUETUN_PASSWORD=change_me_gluetun

# =============================================================================
# qBittorrent Configuration
# =============================================================================
# CHANGE THESE — default credentials are a security risk
QBIT_USER=admin
QBIT_PASSWORD=change_me_qbit

# =============================================================================
# Arr Application API Keys
# Required by Unpackerr for automated archive extraction
# Find these in each app: Settings > General > Security > API Key
# =============================================================================
SONARR_API_KEY=
RADARR_API_KEY=

# =============================================================================
# Service Ports
# =============================================================================
QBIT_PORT=8080
JELLYFIN_PORT=8096
PROWLARR_PORT=9696
RADARR_PORT=7878
SONARR_PORT=8989
FLARESOLVERR_PORT=8191
BAZARR_PORT=6767
NETDATA_PORT=19999
GLUETUN_HEALTHCHECK_PORT=9999

# =============================================================================
# Notifications (ntfy)
# Self-hosted push notifications via ntfy container
# Subscribe via ntfy app (iOS/Android) or https://ntfy.sh
# =============================================================================
NTFY_PORT=2586

# Topic name for Docker image update notifications (DIUN)
# Use a random string to avoid conflicts on ntfy.sh public server
# Example: autonas-updates-a3f7k2
NTFY_TOPIC=

# Endpoint for DIUN notifications — use local ntfy or public ntfy.sh
# Local (recommended): http://ntfy:80
# Public ntfy.sh:      https://ntfy.sh
NTFY_ENDPOINT=https://ntfy.sh

# URL for VPN alert notifications from check_vpn.sh
# Local ntfy: http://localhost:${NTFY_PORT}
# Leave empty to disable ntfy alerts
NTFY_URL=

# =============================================================================
# Tailscale Remote Access
# Get auth key from: https://login.tailscale.com/admin/settings/keys
# =============================================================================
TS_AUTHKEY=your_auth_key

# =============================================================================
# Backup Configuration
# =============================================================================
BACKUP_DIR=./backups
RETENTION_DAYS=7

# Optional: GPG recipient key for encrypting backups (key ID or email)
# Example: BACKUP_ENCRYPT_KEY=your@email.com
# Leave empty to skip encryption (backups will contain plaintext credentials!)
BACKUP_ENCRYPT_KEY=