.env.example

# =============================================================================
# Stirling PDF - Environment Configuration
# =============================================================================
# Documentation: https://docs.stirlingpdf.com
#
# This file contains all configuration options for Stirling PDF deployment.
# Copy this file to .env and adjust values as needed.
#
# NOTE: Features marked with [ENTERPRISE] require an Enterprise license.
#       This deployment only configures features available in the free version.
# =============================================================================

# -- Stack Identification --
STACK_NAME=pdf_app_bauer-group_com

# -- Version Configuration --
# Available: latest, latest-fat, latest-ultra-lite
# - latest-fat: All tools including OCR (Tesseract) and LibreOffice (Recommended)
# - latest: Standard tools without OCR/LibreOffice
# - latest-ultra-lite: Minimal installation
STIRLING_VERSION=latest-fat

# -- Timezone --
TIME_ZONE=Etc/UTC

# -- Port Settings (Development/Standalone) --
EXPOSED_APP_PORT=8080

# -- Traefik Specific --
# DNS must resolve to ${SERVICE_HOSTNAME}
SERVICE_HOSTNAME=pdf.app.bauer-group.com
PROXY_NETWORK=EDGEPROXY

# =============================================================================
# SYSTEM SETTINGS
# =============================================================================

# -- Locale & Language --
# Comma-separated list of enabled languages (all enabled by default)
# Full list: en_GB, de_DE, fr_FR, es_ES, it_IT, pt_BR, zh_CN, ja_JP, ko_KR,
#            ar_AR, bg_BG, ca_CA, cs_CZ, da_DK, el_GR, eu_ES, fa_IR, fi_FI,
#            ga_IE, hi_IN, hr_HR, hu_HU, id_ID, nl_NL, no_NB, pl_PL, pt_PT,
#            ro_RO, ru_RU, sk_SK, sl_SI, sr_LATN_RS, sv_SE, th_TH, tr_TR,
#            uk_UA, vi_VN, zh_TW
LANGS=en_GB,de_DE,fr_FR,es_ES,it_IT,pt_BR,zh_CN,ja_JP,ko_KR,ar_AR,bg_BG,ca_CA,cs_CZ,da_DK,el_GR,eu_ES,fa_IR,fi_FI,ga_IE,hi_IN,hr_HR,hu_HU,id_ID,nl_NL,no_NB,pl_PL,pt_PT,ro_RO,ru_RU,sk_SK,sl_SI,sr_LATN_RS,sv_SE,th_TH,tr_TR,uk_UA,vi_VN,zh_TW

# Default system locale
SYSTEM_DEFAULT_LOCALE=en-GB

# -- File Limits --
# Maximum file upload size in MB (default: 2000 = 2GB)
SYSTEM_MAX_FILE_SIZE=2000

# -- URL Configuration --
# Root path for the application (use / for root, /pdf for subdirectory)
SYSTEM_ROOT_URI_PATH=/

# -- Connection Settings --
# Connection timeout in minutes
SYSTEM_CONNECTION_TIMEOUT_MINUTES=5

# =============================================================================
# UI BRANDING (V2)
# =============================================================================
# Note: In Stirling PDF V2, appName and homeDescription are configured via
# the admin UI (Settings → UI Settings), not environment variables.
# UI_APPNAMENAVBAR still works for navbar branding.

# Custom application name shown in navbar
UI_APPNAMENAVBAR=PDF Toolbox [BAUER GROUP]

# Logo style: classic or modern (determines which logo directory is used)
# Logos are placed in /customFiles/static/{modern-logo|classic-logo}/
UI_LOGOSTYLE=modern

# =============================================================================
# VISIBILITY & UPDATES
# =============================================================================

# Hide from search engines (robots.txt noindex)
SYSTEM_GOOGLE_VISIBILITY=false

# Show update notifications
SYSTEM_SHOW_UPDATE=false
SYSTEM_SHOW_UPDATE_ONLY_ADMIN=true

# =============================================================================
# SECURITY SETTINGS
# =============================================================================

# -- Authentication --
# Enable login requirement (recommended for production)
SECURITY_ENABLE_LOGIN=true

# Initial admin credentials (first startup only)
# IMPORTANT: Run ./scripts/generate-secrets.sh to generate a secure password!
# Password will be auto-generated and written to .env
SECURITY_INITIAL_LOGIN_USERNAME=admin
SECURITY_INITIAL_LOGIN_PASSWORD=

# -- Login Method (defaults to "all" in image) --
# - all: Username/password + OAuth
# - normal: Username/password only
# - oauth2: OAuth only (after initial setup)
# SECURITY_LOGIN_METHOD=all

# -- CSRF Protection (enabled by default in image, NEVER disable in production!) --
# SECURITY_CSRF_DISABLED=false

# -- Rate Limiting --
# Maximum login attempts before lockout (-1 = disable, use fail2ban)
# SECURITY_LOGIN_ATTEMPT_COUNT=5

# Lockout duration in minutes
# SECURITY_LOGIN_RESET_TIME_MINUTES=120

# -- Global API Key (alternative to user-specific keys) --
# SECURITY_CUSTOM_GLOBAL_API_KEY=your-secure-api-key

# =============================================================================
# PDF SIGNING CERTIFICATE
# =============================================================================
# For digital PDF signatures. Generate with: ./scripts/generate-cert.sh
#
# The script writes both KEYSTORE_PASSWORD and KEYSTORE_P12_BASE64 to .env
#
# Option A: Environment Variables (recommended for Coolify/CI)
#   - Set KEYSTORE_P12_BASE64 (Base64 encoded P12 certificate)
#   - Set KEYSTORE_PASSWORD (certificate passphrase)
#   - The container entrypoint decodes and writes to /configs/keystore.p12
#   - Enable SYSTEM_SERVERCERTIFICATE_ENABLED=true
#
# Option B: Direct Volume Mount (local development)
#   - Mount: ./certs/cert.p12:/configs/keystore.p12:ro
#   - Set KEYSTORE_PASSWORD
#   - Enable SYSTEM_SERVERCERTIFICATE_ENABLED=true
#
# Option C: User-specific certificates
#   - Mount to: /customFiles/signatures/ALL_USERS/ (all users)
#   - Or: /customFiles/signatures/{username}/ (specific user)
#   - Users select certificate and enter passphrase in signing UI

# Enable server certificate
# SYSTEM_SERVERCERTIFICATE_ENABLED=false

# Organization name shown in signing UI
SYSTEM_SERVERCERTIFICATE_ORGANIZATIONNAME=BAUER GROUP

# Password for keystore.p12 (written by generate-cert.sh)
# KEYSTORE_PASSWORD=

# Base64 encoded P12 certificate (written by generate-cert.sh)
# The container entrypoint decodes this to /configs/keystore.p12 at startup
# KEYSTORE_P12_BASE64=

# =============================================================================
# OAUTH 2.0 SSO (Optional)
# =============================================================================
# Requires SECURITY_ENABLE_LOGIN=true

# Enable OAuth
# SECURITY_OAUTH2_ENABLED=false

# Provider: google, github, keycloak, authentik
# SECURITY_OAUTH2_PROVIDER=keycloak

# -- Generic OIDC Settings --
# SECURITY_OAUTH2_ISSUER=https://your-idp.com/realms/your-realm
# SECURITY_OAUTH2_CLIENT_ID=stirling-pdf
# SECURITY_OAUTH2_CLIENT_SECRET=your-client-secret
# SECURITY_OAUTH2_SCOPES=openid, profile, email
# SECURITY_OAUTH2_USE_AS_USERNAME=preferred_username

# Auto-create users on first OAuth login
# SECURITY_OAUTH2_AUTO_CREATE_USER=false

# =============================================================================
# LEGAL LINKS (Footer)
# =============================================================================
# These URLs appear in the application footer when set.
# Leave empty or commented to hide the link.

# Terms and Conditions URL
LEGAL_TERMSANDCONDITIONS=https://go.bauer-group.com/pdf-terms

# Privacy Policy URL
LEGAL_PRIVACYPOLICY=https://go.bauer-group.com/pdf-privacy

# Impressum (required in Germany/Austria/Switzerland)
# LEGAL_IMPRESSUM=

# Accessibility Statement
# LEGAL_ACCESSIBILITYSTATEMENT=

# Cookie Policy
# LEGAL_COOKIEPOLICY=

# =============================================================================
# OCR SETTINGS
# =============================================================================
# NOTE: Our custom image includes ALL Tesseract language packs.
#       No additional .traineddata files need to be mounted.

# Default OCR language (ISO 639-3: eng, deu, fra, spa, etc.)
OCR_DEFAULT_LANGUAGE=eng

# =============================================================================
# PIPELINE / AUTOMATION
# =============================================================================

# Watched folder for automatic processing
# PIPELINE_WATCHED_FOLDERS_DIR=/pipeline/watchedFolders

# Output folder for processed files
# PIPELINE_FINISHED_FOLDERS_DIR=/pipeline/finishedFolders

# =============================================================================
# ENDPOINT CUSTOMIZATION
# =============================================================================

# Disable specific tools (comma-separated tool IDs)
# Example: sign,watermark,addStamp,certSign
ENDPOINTS_TO_REMOVE=

# Disable entire tool groups (comma-separated)
# Groups: LibreOffice, Python, OpenCV, OCRmyPDF, Weasyprint, Calibre, QPDF, Ghostscript
ENDPOINTS_GROUPS_TO_REMOVE=

# =============================================================================
# SMTP SETTINGS (Optional)
# =============================================================================

MAIL_ENABLED=false
MAIL_ENABLEINVITES=false
MAIL_HOST=mx1.simply-send.com
MAIL_PORT=587
MAIL_USERNAME=no-reply@message.bauer-group.com
MAIL_PASSWORD=CHANGE_ME_SMTP_PASSWORD
MAIL_TLS_ENABLED=true
MAIL_FROM=no-reply@message.bauer-group.com

# =============================================================================
# LOGGING
# =============================================================================

# Log level: TRACE, DEBUG, INFO, WARN, ERROR
LOGGING_LEVEL=INFO

# Debug OAuth issues:
# LOGGING_LEVEL_ORG_SPRINGFRAMEWORK_SECURITY_OAUTH2=DEBUG

# =============================================================================
# ADVANCED SERVER SETTINGS
# =============================================================================

# Session timeout (e.g., 30m, 1h)
# SERVER_SESSION_TIMEOUT=30m

# Jetty thread pool
# SERVER_JETTY_THREADS_MAX=200
# SERVER_JETTY_THREADS_MIN=8

# Custom JVM options
# JAVA_CUSTOM_OPTS=-Xmx4g -Xms1g

# =============================================================================
# RESOURCE LIMITS (Set in docker-compose.yml)
# =============================================================================
# Small (5-20 users):    memory: 4G, cpus: '2.0'
# Medium (20-100 users): memory: 8G, cpus: '4.0'
# Large (100+ users):    memory: 16G, cpus: '8.0'

# =============================================================================
# ACCESS POINTS
# =============================================================================
#
# Development:  http://localhost:8080
# Production:   https://pdf.app.bauer-group.com
# API Docs:     https://pdf.app.bauer-group.com/swagger-ui/index.html
# Health:       https://pdf.app.bauer-group.com/api/v1/info/status
#