# dragoman environment variables
# Copy to /etc/default/commonmeta and set chmod 640, chown root:dragoman
# (shared with the commonmeta importer service, which reads the same file).
# All variables are optional unless noted.
# ── Server ────────────────────────────────────────────────────────────────────
# TCP port to listen on (plain HTTP, or HTTP redirect when --domain is set).
PORT=3456
# ── Database ──────────────────────────────────────────────────────────────────
# Path to the local commonmeta SQLite3 database.
# Platform defaults:
# macOS → ~/Library/Application Support/commonmeta/commonmeta.sqlite3
# Linux → /var/lib/commonmeta/commonmeta.sqlite3
#COMMONMETA_DB=/var/lib/commonmeta/commonmeta.sqlite3
# Path to the dragoman cache database (stores API fallback results).
# NOTE: dragoman reads DRAGOMAN_CACHE_DB, not CACHE_DB.
# Platform defaults:
# macOS → ~/Library/Application Support/commonmeta/cache.sqlite3
# Linux → /var/lib/commonmeta/cache.sqlite3
#DRAGOMAN_CACHE_DB=/var/lib/commonmeta/cache.sqlite3
# ── TLS ───────────────────────────────────────────────────────────────────────
# Domain name for HTTPS.
# localhost → HTTPS via mkcert (local development)
# <public domain> → HTTPS via Let's Encrypt ACME (production)
# (unset) → plain HTTP on 127.0.0.1 (reverse proxy mode)
#DRAGOMAN_DOMAIN=commonmeta.org
# ACME contact email — required when DRAGOMAN_DOMAIN is a public hostname.
#DRAGOMAN_EMAIL=admin@example.org
# Directory to store ACME/mkcert certificates between restarts.
# The default (/var/lib/dragoman/acme on Linux) is outside the systemd unit's
# ReadWritePaths — set this under /var/lib/commonmeta when using built-in TLS.
# Platform defaults:
# macOS → ~/Library/Application Support/dragoman/acme
# Linux → /var/lib/dragoman/acme
#DRAGOMAN_ACME_CACHE=/var/lib/commonmeta/acme
# HTTPS port when DRAGOMAN_DOMAIN is set.
# Defaults: localhost → 3456, public domain → 443
#DRAGOMAN_TLS_PORT=443
# Set to any non-empty value to use the Let's Encrypt staging environment.
# Use while testing to avoid rate limits; remove for production.
#DRAGOMAN_ACME_STAGING=
# ── Process ───────────────────────────────────────────────────────────────────
# Path for the PID file written by `dragoman start` and read by `dragoman stop`.
#DRAGOMAN_PID_FILE=/var/run/dragoman.pid
# ── Telemetry ─────────────────────────────────────────────────────────────────
# VictoriaLogs OTLP/HTTP endpoint. When unset, logs go to stdout only.
#DRAGOMAN_VIKTORIALOGS_URL=http://localhost:9428/insert/opentelemetry/v1/logs
# Comma-separated IPs allowed to scrape /metrics (Prometheus format).
# When unset, the /metrics route is not registered.
#DRAGOMAN_METRICS_ALLOW=127.0.0.1
# ── Request limits ────────────────────────────────────────────────────────────
# Per-client limits as RATE/BURST (requests per second / at once); 0 turns a
# tier off. Behind a reverse proxy the client is the one X-Real-IP names.
#DRAGOMAN_RATE_PAGES=20/60
#DRAGOMAN_RATE_LISTS=5/20
#DRAGOMAN_RATE_EXPENSIVE=2/20
# Requests served at once across all clients, and seconds a response may take.
#DRAGOMAN_MAX_IN_FLIGHT=256
#DRAGOMAN_REQUEST_TIMEOUT=60
# HTTPS with a public domain only: seconds for the TLS handshake and request
# headers, and open connections per client (an IPv6 client is its /64).
#DRAGOMAN_HEADER_TIMEOUT=10
#DRAGOMAN_MAX_CONNS_PER_IP=32
# Proxies that may name the client — this machine always, plus these networks,
# e.g. a CDN's edges — and the header they name it in.
#DRAGOMAN_TRUSTED_PROXIES=173.245.48.0/20,2400:cb00::/32
#DRAGOMAN_CLIENT_IP_HEADER=CF-Connecting-IP
# A certificate to serve for DRAGOMAN_DOMAIN instead of one from Let's Encrypt,
# e.g. a CDN origin certificate: behind a proxying CDN, Let's Encrypt's
# TLS-ALPN-01 challenge cannot reach dragoman.
#DRAGOMAN_TLS_CERT=/etc/dragoman/origin.pem
#DRAGOMAN_TLS_KEY=/etc/dragoman/origin-key.pem
# ── Logging ───────────────────────────────────────────────────────────────────
# tracing-subscriber log filter. Use dragoman=debug for per-request cache hits.
RUST_LOG=dragoman=info