.env.example

# Meshtastic Node Configuration
# IP address of your Meshtastic node
MESHTASTIC_NODE_IP=192.168.1.100

# TCP port for Meshtastic node connection (default: 4403)
MESHTASTIC_TCP_PORT=4403

# TCP Connection Timing (OPTIONAL - for advanced troubleshooting)
# Initial TCP connection timeout in milliseconds (default: 10000 = 10 seconds)
# MESHTASTIC_CONNECT_TIMEOUT_MS=10000

# Reconnect backoff: initial delay and maximum delay in milliseconds
# Reconnects use exponential backoff: initial * 2^(attempt-1), capped at max
# Set initial = max for a fixed delay between reconnects
# MESHTASTIC_RECONNECT_INITIAL_DELAY_MS=1000
# MESHTASTIC_RECONNECT_MAX_DELAY_MS=60000

# Delay between consecutive module config requests in milliseconds (default: 100)
# Increase if your node shows queue overflow during config loading
# MESHTASTIC_MODULE_CONFIG_DELAY_MS=100

# Number of traceroute history rows to keep per node pair (default: 50)
# Increase for longer-term route trend analysis.
# TRACEROUTE_HISTORY_LIMIT=50

# MeshCore sources are configured through the UI (Sources sidebar). The legacy
# 3.x `MESHCORE_*` environment-variable bootstrap was removed in 4.6 — add a
# MeshCore source from the dashboard's Sources panel instead.

# Virtual Node Server Configuration (OPTIONAL)
# Enable virtual node server that acts as a proxy for mobile apps
# When enabled, multiple Meshtastic mobile apps can connect to this server
# instead of directly to the physical node, reducing load on the physical node
# ENABLE_VIRTUAL_NODE=false

# Virtual Node TCP port (default: 4404)
# The port where mobile apps can connect using Meshtastic TCP protocol
# VIRTUAL_NODE_PORT=4404

# Allow admin commands through virtual node (default: false)
# WARNING: Enabling this reduces security by allowing clients to send admin commands
# Only enable if you need multiple services (e.g., MeshMonitor + Home Assistant) accessing the same node
# When disabled (default), only self-addressed admin commands are allowed for device info queries
# VIRTUAL_NODE_ALLOW_ADMIN_COMMANDS=false

# Security Notes:
# - Admin commands (ADMIN_APP, NODEINFO_APP) are blocked by default for security
# - Set VIRTUAL_NODE_ALLOW_ADMIN_COMMANDS=true to allow admin commands (use with caution)
# - Messages are queued and serialized to prevent overwhelming the physical node
# - All connected clients receive broadcasts from the physical node
# - Text messages, positions, telemetry, and traceroutes are proxied bidirectionally

# Base URL for serving the application (optional)
# Set this if you're serving MeshMonitor from a subfolder (e.g., /meshmonitor)
# Leave empty or comment out to serve from root (/)
# BASE_URL=/meshmonitor

# Authentication & Session Configuration
# Session secret for cookie encryption (REQUIRED for production)
# Generate a secure random string: openssl rand -base64 32
# SESSION_SECRET=your-secure-random-string-here

# Session cookie lifetime in milliseconds (default: 86400000 = 24 hours)
# SESSION_MAX_AGE=86400000

# Reset session expiry on each request (default: true)
# When true, active users stay logged in indefinitely. When false, sessions expire at original login time + SESSION_MAX_AGE
# SESSION_ROLLING=true

# Cookie security settings
# COOKIE_SECURE: Require HTTPS for cookies (default: true in production, false in development)
# Set to false if accessing over HTTP in production (not recommended)
# COOKIE_SECURE=false

# COOKIE_SAMESITE: SameSite cookie policy (strict, lax, or none)
# Default: lax (recommended for production with reverse proxies)
# Use 'lax' for most cases - it's secure and works with reverse proxies
# Use 'strict' only if you need extra security and don't use reverse proxies
# COOKIE_SAMESITE=lax

# Reverse Proxy Configuration
# TRUST_PROXY: Trust reverse proxy headers (X-Forwarded-Proto, X-Forwarded-For, etc.)
# Required when using HTTPS reverse proxy (nginx, Traefik, Caddy, etc.)
# Values: true, false, 1 (number of hops), IP address, or CIDR range
# Default: 1 in production, unset in development
# TRUST_PROXY=true

# CORS Configuration
# ALLOWED_ORIGINS: Comma-separated list of allowed origins for CORS
# Default: http://localhost:8080,http://localhost:3001 (if not specified)
#
# For localhost access (most common for Docker deployments):
#   ALLOWED_ORIGINS=http://localhost:8080
#
# For access via server IP address:
#   ALLOWED_ORIGINS=http://192.168.1.50:8080
#
# For multiple access methods (localhost AND server IP):
#   ALLOWED_ORIGINS=http://localhost:8080,http://192.168.1.50:8080
#
# For production with HTTPS:
#   ALLOWED_ORIGINS=https://meshmonitor.example.com
#
# Multiple HTTPS domains:
#   ALLOWED_ORIGINS=https://meshmonitor.example.com,https://mesh.example.com
#
# Wildcard (NOT recommended for production, testing only):
#   ALLOWED_ORIGINS=*
#
# For production deployments, it's best practice to explicitly set this value
ALLOWED_ORIGINS=http://localhost:8080

# Iframe Embedding Configuration
# IFRAME_ALLOWED_ORIGINS: Comma-separated list of origins allowed to embed
# MeshMonitor in an <iframe>. By default MeshMonitor sends X-Frame-Options: DENY,
# which blocks all iframe embedding.
#
# Set this to allow embedding in e.g. a Node-RED dashboard, Home Assistant panel,
# or internal portal. When set, X-Frame-Options is dropped and CSP frame-ancestors
# is used instead.
#
# Single origin (Node-RED dashboard):
#   IFRAME_ALLOWED_ORIGINS=http://192.168.1.50:1880
#
# Multiple origins:
#   IFRAME_ALLOWED_ORIGINS=http://192.168.1.50:1880,https://portal.example.com
#
# Any origin (NOT recommended for production):
#   IFRAME_ALLOWED_ORIGINS=*
#
# IFRAME_ALLOWED_ORIGINS=

# Web Push Notification Configuration (VAPID keys)
# Generate keys by running: node generate-vapid-keys.js
# VAPID_PUBLIC_KEY=your-public-key-here
# VAPID_PRIVATE_KEY=your-private-key-here
# VAPID_SUBJECT=mailto:your-email@example.com

# Push Notification Expiration (TTL - Time To Live)
# How long (in seconds) push services should attempt to deliver notifications before giving up
# Default: 3600 (1 hour) - prevents notification flooding when device comes back online
# Recommended range: 300-86400 seconds (5 minutes to 24 hours)
# Common values: 300 (5min), 3600 (1hr), 7200 (2hr), 86400 (24hr)
# ⚠️ Values below 300 seconds may cause notifications to expire too quickly
# PUSH_NOTIFICATION_TTL=3600

# Authentication Configuration
# DISABLE_ANONYMOUS: When set to 'true', disables anonymous access entirely
# Users will be presented with a login page and must authenticate before accessing any features
# Default: false (anonymous access allowed)
# DISABLE_ANONYMOUS=true

# Branding Configuration (login page)
# CUSTOM_TITLE: Overrides the "MeshMonitor" heading shown on the login page.
# Useful when deploying as a dashboard for a specific community or organization.
# Default: "MeshMonitor"
# CUSTOM_TITLE=My Organization Base
#
# CUSTOM_LOGO_URL: Overrides the default logo on the login page with your own image.
# Accepts an http(s) URL, a raster data:image URI (png/jpeg/gif/webp/avif), or a
# same-origin relative path. data:image/svg+xml is rejected (SVG can embed scripts).
# Falls back to the built-in logo when unset or invalid.
# CUSTOM_LOGO_URL=https://example.com/logo.png

# Logging Configuration
# LOG_LEVEL: Controls the verbosity of log output
# Valid values: debug, info, warn, error
# Default: "debug" when NODE_ENV=development, "info" otherwise
# Use this to enable debug logging in production without changing NODE_ENV
# LOG_LEVEL=info