.env.example

# Copy this file to .env and fill in real values. Never commit your real .env.

# Port the server listens on inside the container.
PORT=5000

# Directory containing your docker-compose stacks. MUST be mounted at this
# exact same path on the host and inside the dockpull container (see the
# comment in docker-compose.yml for why).
STACKS_DIR=/opt/stacks

# Path to the host Docker socket, bind-mounted into the container.
DOCKER_SOCKET=/var/run/docker.sock

# Optional: directory holding a Docker config.json with registry credentials
# (what `docker login` writes). Lets DockPull check PRIVATE images and avoid
# Docker Hub's anonymous rate limit. Mount your config and point this at its
# directory, e.g. mount ~/.docker/config.json -> /root/.docker/config.json:ro
# and leave this unset (the default /root/.docker is used), or set a custom dir.
# Only static base64 `auths` are supported (not credential-helper stores).
# DOCKER_CONFIG=/root/.docker

# Directory where the SQLite database is stored (should be a persistent
# volume).
DATA_DIR=/data

# Password for the single admin login. Choose something strong.
ADMIN_PASSWORD=change-me

# Secret used to sign the session cookie.
# Generate one with: openssl rand -hex 32
SESSION_SECRET=

# Session cookie lifetime, in seconds. Default is 7 days.
SESSION_TTL=604800

# Public base URL of this app (used in logs / any absolute links).
# If this starts with https, the login cookie is marked Secure.
BASE_URL=http://localhost:5000

# Set this ONLY when running behind a reverse proxy (nginx, Traefik, Cloudflare)
# so login rate-limiting sees the real client IP and the Secure cookie is
# detected. Use the number of proxy hops in front of the app (usually 1), or
# true. Leave unset when exposed directly, so X-Forwarded-For can't be spoofed.
# TRUST_PROXY=1

# Serve under a subpath (e.g. behind a reverse proxy at https://host/dockpull/)
# when the proxy does NOT strip the prefix. Build the client with the same
# value: BASE_PATH=/dockpull docker compose build. Leave unset for root.
# BASE_PATH=/dockpull

# Timezone for the daily scan's clock. The container runs in UTC by default, so
# a "09:00" scheduled scan would fire at 09:00 UTC. Set your zone so it fires at
# your local time. Find yours at https://en.wikipedia.org/wiki/List_of_tz_database_time_zones
# TZ=Europe/London

# --- Background checks & notifications (all optional; also editable in the UI) ---
# Whether the server checks for updates on a schedule. Default: true.
# BACKGROUND_CHECK_ENABLED=true
# Daily local time (HH:MM, 24h) for the scheduled scan. Default: 09:00.
# SCHEDULED_CHECK_TIME=09:00
# Notifications (all also editable in the UI). NOTIFY_TYPE is one of:
# discord | ntfy | gotify | webhook. DISCORD_WEBHOOK_URL is the target URL for
# whichever type you pick (a self-hosted ntfy/Gotify on your LAN is fine).
# NOTIFY_TYPE=discord
# DISCORD_WEBHOOK_URL=

# Optional GitHub token (read-only, no scopes needed) used for changelog and
# version lookups. Raises GitHub's anonymous 60/hr API limit to 5000/hr — handy
# if you watch many images. Leave unset to use the anonymous limit.
# GITHUB_TOKEN=

# Name of this app's OWN container. It is excluded from the dashboard so it
# can't be told to update (and thereby restart) itself mid-update. Defaults to
# "dockpull" (the container_name in the shipped docker-compose.yml); change
# it only if you rename the service.
SELF_CONTAINER_NAME=dockpull