# defter configuration, e.g. /etc/defter/env for defter.service. Every setting
# is also a `defter start` flag (see `defter start --help`); environment
# variables are read when the flag is not given. Keep secrets in files that
# only root and the defter group can read (root:defter, mode 0640).
# ── Server ───────────────────────────────────────────────────────────────────
DEFTER_HOST=127.0.0.1
DEFTER_PORT=8189
# The address clients reach the server at (your reverse proxy or CDN), no
# trailing slash. Login, upload and download links are built on it.
DEFTER_PUBLIC_URL=https://defter.example.org
# HTTPS instead of plain HTTP, for a TLS pass-through in front (e.g.
# dragoman's --sni-route with DEFTER_PORT=8443), with a certificate the CDN
# trusts, such as a Cloudflare origin certificate.
# DEFTER_TLS_CERT=/etc/defter/origin.pem
# DEFTER_TLS_KEY=/etc/defter/origin-key.pem
# Or, with no CDN in front, a certificate from Let's Encrypt. Connections for the
# hostname on port 443 must reach defter, such as through dragoman's --sni-route.
# DEFTER_DOMAIN=defter.example.org
# DEFTER_EMAIL=you@example.org
# DEFTER_ACME_STAGING=true
# Database, generated API key and (without S3) attachment files. Under
# defter.service this is /var/lib/defter (StateDirectory) without setting it.
# DEFTER_DATA_DIR=/var/lib/defter
# DEFTER_DB=/var/lib/defter/defter.sqlite3
# ── Library ──────────────────────────────────────────────────────────────────
DEFTER_USER_ID=1
DEFTER_USERNAME=defter
# Publish a profile at /<orcid> with your ORCID record and every work in My
# Publications.
# DEFTER_ORCID=0000-0003-1419-2405
# ── API keys ─────────────────────────────────────────────────────────────────
# One read/write key; Zotero logins are approved by entering it on the login
# page. Generate it: openssl rand -hex 32
DEFTER_API_KEY=<64 hex characters>
# Or several keys as files, read/write (rw) or read-only (ro), comma-separated:
# DEFTER_KEYS=rw:/etc/defter/app-key,ro:/etc/defter/cli-key
# Without any key setting, a read/write key is generated in
# $DEFTER_DATA_DIR/api-key (print it with `defter key`).
# With SSO in front of /login, also require this identity to approve logins.
# DEFTER_LOGIN_AUTHORIZED_USER=you@example.org
# ── Attachment storage (S3-compatible) ───────────────────────────────────────
# Hetzner Object Storage: the bucket's location is both the endpoint and the
# region (fsn1, nbg1 or hel1); buckets are always addressed by host name.
DEFTER_S3_BUCKET=<your-bucket>
DEFTER_S3_ENDPOINT=https://fsn1.your-objectstorage.com
DEFTER_S3_REGION=fsn1
# Cloudflare R2: https://<account>.r2.cloudflarestorage.com, region auto.
# RustFS for development: http://127.0.0.1:9000, region us-east-1.
DEFTER_S3_ACCESS_KEY_ID_FILE=/etc/defter/s3-access-key-id
DEFTER_S3_SECRET_ACCESS_KEY_FILE=/etc/defter/s3-secret-access-key
# DEFTER_S3_PREFIX=defter
# DEFTER_S3_VIRTUAL_HOSTED_STYLE=true
# Lifetime of pre-signed download URLs, in seconds.
# DEFTER_PRESIGN_TTL=300
# Stream downloads through defter when clients cannot reach the bucket.
# DEFTER_PROXY_DOWNLOADS=true
# DEFTER_MAX_UPLOAD_MB=1024
# Log filter (tracing EnvFilter syntax).
# RUST_LOG=defter=info