.env.prod.example

# =============================================================================
# Production environment template for the Docker self-hosting stack.
#
#   cp .env.prod.example .env
#   docker run --rm ghcr.io/deskhq/the-desk:latest php artisan key:generate --show
#   # paste the value into APP_KEY below, fill in the rest, then:
#   docker compose up -d
#
# Every setting below is documented at:
# https://docs.thedeskhq.app/reference/environment-variables/
# =============================================================================

# --- Docker Compose ----------------------------------------------------------
# Read by the `docker compose` CLI itself rather than the app. It is why every
# production command in the docs needs no `-f docker-compose.prod.yml`:
#
#   docker compose up -d
#   docker compose ps
#   docker compose logs -f app
#
# Building the image from source? List both files, separated by a colon, so the
# build overlay stacks on top and `docker compose up -d --build` stays bare:
#
#   COMPOSE_FILE=docker-compose.prod.yml:docker-compose.build.yml
#
# Caveat: with this set, a bare `docker compose down` in this directory targets
# the production stack. That is the intent on a production box, but there is no
# longer an `-f` to remind you what you are pointed at. Passing an explicit `-f`
# still overrides this for a one-off command.
COMPOSE_FILE=docker-compose.prod.yml

APP_VERSION=1.19.0 # x-release-please-version

# --- A note on quotes and references -----------------------------------------
# Every value below is deliberately unquoted and self-contained:
#
#   - A PaaS environment editor (Dokploy, Coolify, …) writes its textarea to
#     .env but normalises quotes away, so a quoted value with a space lands as
#     `APP_NAME=The Desk` and phpdotenv aborts the boot with `Encountered
#     unexpected whitespace`, behind a container restart loop that hides it.
#   - `${OTHER_VALUE}` is never expanded: these values reach the containers
#     through compose's `env_file:`, which passes them through literally.
#
# Editing .env directly on your own host? Then quoting works normally, and a
# display name with spaces (`APP_NAME="Acme Chat"`) is fine.
APP_NAME=TheDesk
APP_ENV=production
# Required. Generate with: docker run --rm ghcr.io/deskhq/the-desk:latest php artisan key:generate --show
APP_KEY=
APP_DEBUG=false
APP_URL=https://chat.example.com

APP_LOCALE=en
APP_FALLBACK_LOCALE=en
APP_FAKER_LOCALE=en_US

APP_MAINTENANCE_DRIVER=file

LOG_CHANNEL=stack
LOG_STACK=single
LOG_LEVEL=warning

# --- Feature toggles ---------------------------------------------------------
REGISTRATION_ENABLED=true
EMAIL_VERIFICATION_ENABLED=false
GRAVATAR_ENABLED=true
# GRAVATAR_URL=https://www.gravatar.com/avatar
# GRAVATAR_SIZE=200
# GRAVATAR_DEFAULT=404
UPDATE_CHECK_ENABLED=true
# UPDATE_CHECK_REPOSITORY=deskhq/the-desk
# UPDATE_CHECK_CACHE_TTL_HOURS=12
GIPHY_API_KEY=
GIPHY_CONTENT_RATING=g

# --- Branding ----------------------------------------------------------------
# APP_NAME above already renames every text surface, including the installed
# PWA. To replace the mark, favicons, Open Graph image and PWA icons, drop files
# into ./branding on the host (bind-mounted read-only into every app service by
# docker-compose.prod.yml). Each file is optional and falls back to the shipped
# default: https://docs.thedeskhq.app/self-hosting/branding/
#
# The "Powered by The Desk" line in the footer. On by default; set false to
# remove it. The licence does not require it, so this is an honest switch rather
# than something to patch out.
BRANDING_ATTRIBUTION=true
# Where the app looks for those overrides. Only change this if you mount them
# somewhere other than the path the compose file uses.
# BRANDING_PATH=/app/storage/branding

# --- Security headers --------------------------------------------------------
# Every web response carries a Content-Security-Policy: the browser-side
# allow-list that limits what injected markup could do. Leave it on. Set false
# only if you serve your own policy from the reverse proxy instead.
CSP_ENABLED=true
# Send the policy as Content-Security-Policy-Report-Only: violations are logged
# to the browser console but nothing is blocked. Use it for a dry run after
# adding scripts of your own, then turn it back off.
# CSP_REPORT_ONLY=false
# Who may embed the app in a frame, sent as the CSP frame-ancestors directive
# and as X-Frame-Options. Denying every framer (the default) closes the
# clickjacking path where an attacker overlays an invisible frame of the app and
# steers a signed-in member's clicks into real controls. Use `self`, or a
# comma-separated list of origins if you embed the app in your own portal.
# CSP_FRAME_ANCESTORS=none
# Comma-separated extra origins, appended to (never replacing) the defaults —
# for an analytics snippet, a corporate asset host, an embedded frame, or a web
# font of your own. Fonts take two keys: the host serving the stylesheet on
# CSP_EXTRA_STYLE_SRC, the host serving the @font-face files on
# CSP_EXTRA_FONT_SRC. The app's own fonts are self-hosted and need neither.
# CSP_EXTRA_SCRIPT_SRC=
# CSP_EXTRA_STYLE_SRC=
# CSP_EXTRA_IMG_SRC=
# CSP_EXTRA_CONNECT_SRC=
# CSP_EXTRA_FRAME_SRC=
# CSP_EXTRA_FONT_SRC=
# Strict-Transport-Security pins the host to HTTPS in every browser that has
# seen it, closing the window where an on-path attacker downgrades a first or
# typed navigation and reads the session cookie. Sent only on requests that
# arrived over HTTPS (your proxy's X-Forwarded-Proto is trusted), so a
# plain-HTTP deployment cannot lock itself out of its own hostname. Set false
# only if you send the header from your reverse proxy instead.
# HSTS_ENABLED=true
# How long a browser remembers the pin, in seconds. One year is what the
# hardening guides and the preload list ask for. Lower it while rolling HSTS out
# if you want a short escape hatch; 0 tells browsers to forget the host.
# HSTS_MAX_AGE=31536000
# Extend the pin to every subdomain. Turn off only if a subdomain of this host
# must stay reachable over plain HTTP.
# HSTS_INCLUDE_SUBDOMAINS=true
# Opt the domain into browsers' built-in preload list, so even a first-ever
# visit never touches HTTP. Off by default and deliberately so: submission is
# effectively irreversible and commits every subdomain of the registrable
# domain. Only for a domain you own outright, submitted at hstspreload.org.
# HSTS_PRELOAD=false

# --- Data retention ----------------------------------------------------------
# How long a per-user security event (sign-in, credential change, session
# revocation, data-export activity) is kept before the scheduler's daily sweep
# deletes it. One year by default, so an annual assessment period stays fully
# visible; the window also caps how far back anyone can evidence an event, so
# keep it at least as long as yours. Set 0 to keep events forever and enforce
# retention at the database or backup layer instead. Data-export archives and
# audit-evidence exports have a fixed 7-day window.
# SECURITY_EVENT_RETENTION_DAYS=365

# How long a workspace audit-log entry (rename, role change, member removal,
# ownership transfer, channel lifecycle, message deletion, invitation lifecycle)
# is kept before the scheduler's daily sweep deletes it. One year by default,
# matching the account-activity window above so both logs answer the retention
# question with the same number. Set 0 to keep entries forever and enforce
# retention at the database or backup layer instead.
# AUDIT_LOG_RETENTION_DAYS=365

# --- Single sign-on (OpenID Connect) -----------------------------------------
# SSO_OIDC_ISSUER=https://your-idp.example.com
# SSO_OIDC_CLIENT_ID=
# SSO_OIDC_CLIENT_SECRET=
# SSO_OIDC_REDIRECT_URI=https://chat.example.com/auth/oidc/callback
# SSO_OIDC_DISCOVERY_URL=
# The one setting here that cannot be written without quotes: it is split on
# spaces. Leave it commented out unless your provider needs different scopes,
# especially on a PaaS whose environment editor strips the quotes.
# SSO_OIDC_SCOPES="openid profile email"
# SSO_OIDC_VALIDATE_ID_TOKEN=true
# SSO_DEFAULT_TEAM_ID=

# --- Single sign-on (LDAP / Active Directory) --------------------------------
# LDAP_HOST=ldap.example.com
# LDAP_PORT=389
# LDAP_BASE_DN=dc=example,dc=com
# LDAP_USERNAME=cn=readonly,dc=example,dc=com
# LDAP_PASSWORD=
# LDAP_TLS=false
# LDAP_STARTTLS=false
# LDAP_ATTR_USERNAME=mail
# LDAP_ATTR_MAIL=mail
# LDAP_ATTR_NAME=cn
# LDAP_ATTR_GUID=objectguid
# AUTH_SSO_ONLY=false

# --- Directory provisioning (SCIM 2.0) ---------------------------------------
# SCIM_TOKEN=
# SCIM_BASE_PATH=/scim

# --- Database (pgsql service) ------------------------------------------------
DB_CONNECTION=pgsql
DB_HOST=pgsql
DB_PORT=5432
DB_DATABASE=laravel
DB_USERNAME=laravel
# Required. Used by both the app and the Postgres container.
DB_PASSWORD=

# --- Cache / session / queue (redis service) ---------------------------------
SESSION_DRIVER=redis
SESSION_LIFETIME=480
SESSION_ENCRYPT=false
SESSION_PATH=/
SESSION_DOMAIN=null
# Withhold the session cookie from plain-HTTP requests, so a downgraded request
# cannot carry it. Defaults to whether APP_URL is an https:// URL, which covers
# the normal HTTPS install with no edit here. Set it explicitly only to force
# the flag either way.
# SESSION_SECURE_COOKIE=true

BROADCAST_CONNECTION=reverb
FILESYSTEM_DISK=local
QUEUE_CONNECTION=redis
CACHE_STORE=redis

REDIS_CLIENT=phpredis
REDIS_HOST=redis
REDIS_PASSWORD=null
REDIS_PORT=6379

# Seconds a queue worker waits on Redis for work before looking again. A job
# arriving inside that window starts immediately, so this only sets how often a
# worker rechecks its secondary queues. Leave it alone unless you have a reason;
# anything below 1 is floored to 1, because Redis reads 0 as "wait forever".
# REDIS_QUEUE_BLOCK_FOR=1

# --- Mail (external SMTP, operator-provided) ---------------------------------
MAIL_MAILER=smtp
MAIL_SCHEME=null
MAIL_HOST=smtp.example.com
MAIL_PORT=587
MAIL_USERNAME=
MAIL_PASSWORD=
MAIL_FROM_ADDRESS=hello@example.com
MAIL_FROM_NAME=TheDesk

# --- Search (meilisearch service) --------------------------------------------
SCOUT_DRIVER=meilisearch
MEILISEARCH_HOST=http://meilisearch:7700
# Required. Long random string, shared with the Meilisearch container.
MEILISEARCH_KEY=
MEILISEARCH_NO_ANALYTICS=true

# --- Broadcasting (reverb service) -------------------------------------------
# Required. ./docker/gen-secrets.sh fills these in; by hand, one command each:
#   REVERB_APP_ID       openssl rand 4 | od -An -tu4 | tr -d ' '
#   REVERB_APP_KEY      openssl rand -hex 16
#   REVERB_APP_SECRET   openssl rand -hex 16
REVERB_APP_ID=
REVERB_APP_KEY=
REVERB_APP_SECRET=
REVERB_HOST=reverb
REVERB_PORT=8080
REVERB_SCHEME=http
REVERB_PORT_PUBLIC=443
REVERB_SCHEME_PUBLIC=https
# REVERB_HOST_PUBLIC=ws.example.com
# Comma-separated origins allowed to open a WebSocket connection. Defaults to *
# (any origin); recommended in production: lock to the host the browser loads
# the app from.
# REVERB_ALLOWED_ORIGINS=chat.example.com

# --- Web push notifications --------------------------------------------------
# Browser notifications for new messages, opt-in per member and per device. The
# VAPID keypair signs every push; gen-secrets.sh mints one on a fresh install,
# and an existing install generates its own with:
#   docker compose exec app php artisan webpush:vapid --show
# Never rotate the pair once devices have subscribed: the public key is baked
# into every subscription a browser has already granted, so replacing it stops
# delivery to all of them until each member turns the toggle off and on again.
VAPID_PUBLIC_KEY=
VAPID_PRIVATE_KEY=
# How you identify yourself to the push services, as a mailto: or https: URL
# they can reach you at. Falls back to APP_URL when left empty.
VAPID_SUBJECT=

# --- Container port mapping (host side) --------------------------------------
# APP_BIND=127.0.0.1
# APP_PORT=8000