.env.example

# Copy to .env and fill in. The .env file is gitignored.

# Which compose overlays this host runs; every `just` recipe acts on the same
# set. Unset = the core stack only.
#   production:  COMPOSE_FILE=compose.yml:compose.tunnel.yml
#   local demo:  COMPOSE_FILE=compose.yml:compose.demo.yml
#COMPOSE_FILE=

GRAFANA_ADMIN_PASSWORD=change-me

# Set to the public URL Cloudflare Tunnel exposes Grafana on, e.g.:
#   GRAFANA_ROOT_URL=https://grafana.example.com
GRAFANA_ROOT_URL=http://localhost:3000

# Set to true whenever GRAFANA_ROOT_URL is https; `just up` with the tunnel
# overlay refuses to run without it. Keep false for plain-http localhost use,
# or logins break.
GRAFANA_COOKIE_SECURE=false

# Bearer token every telemetry sender must present (Authorization: Bearer <token>).
# The default only suits local use. Generate a real one for production:
# openssl rand -hex 32
OTLP_AUTH_TOKEN=local-dev-token

# Where Grafana delivers alert notifications (any webhook: ntfy, Slack, …).
# Not optional: an empty value drops every alert silently while the heartbeat
# below keeps reporting healthy. With the tunnel overlay active, `just up`
# refuses to start without it.
ALERT_WEBHOOK_URL=

# Dead man's switch ping target (e.g. https://hc-ping.com/<uuid>). The Watchdog
# alert posts here every 5m; alert externally when pings stop.
HEARTBEAT_URL=

# Optional. Lets `./bootstrap.sh` create a project's healthchecks.io checks.
# Must be the project's READ-WRITE API key (Project Settings -> API keys).
HEALTHCHECKS_API_KEY=

# Only needed with the tunnel overlay: cd infra && tofu output -raw tunnel_token
CLOUDFLARE_TUNNEL_TOKEN=

# Set to true to let Cloudflare Access sign users into Grafana individually.
# Needs both values below; `just up` with the tunnel overlay enforces that.
GRAFANA_JWT_AUTH=false
# Your Zero Trust team name, the <team> in https://<team>.cloudflareaccess.com:
# cd infra && tofu output -raw grafana_access_team_domain
CF_ACCESS_TEAM_DOMAIN=
# The Grafana Access application's aud tag: cd infra && tofu output -raw grafana_access_aud
CF_ACCESS_AUD=