| 1 | # Public routing, discovery, and relay identity persistence |
| 2 | PORTAL_URL=https://localhost |
| 3 | DISCOVERY=true |
| 4 | IDENTITY_PATH=/portal-certs |
| 5 | |
| 6 | # Public edge and internal listener ports. |
| 7 | # nginx owns HTTP_PORT/HTTPS_PORT and forwards to the internal relay/frontend services. |
| 8 | HTTP_PORT=80 |
| 9 | HTTPS_PORT=443 |
| 10 | WIREGUARD_PORT=51820 |
| 11 | # Relay API and SNI TCP ports are fixed inside the Compose network at 4017 and 443. |
| 12 | # nginx reads these paths inside its container. Defaults map to ./.portal-certs on the host. |
| 13 | NGINX_CERT_FILE=/etc/nginx/certs/fullchain.pem |
| 14 | NGINX_CERT_KEY=/etc/nginx/certs/privatekey.pem |
| 15 | # Set when enabling public UDP or raw TCP lease ports. |
| 16 | MIN_PORT=0 |
| 17 | MAX_PORT=0 |
| 18 | UDP_ENABLED=false |
| 19 | TCP_ENABLED=false |
| 20 | |
| 21 | # Supported managed values: cloudflare, gcloud, hetzner, njalla, route53, vultr. |
| 22 | # Reused for ACME DNS-01, managed A records, ECH HTTPS records, and optional ENS DNS automation. |
| 23 | ACME_DNS_PROVIDER= |
| 24 | |
| 25 | # Cloudflare API token (required when ACME_DNS_PROVIDER=cloudflare) |
| 26 | CLOUDFLARE_TOKEN= |
| 27 | |
| 28 | # Google Cloud DNS settings. (required when ACME_DNS_PROVIDER=gcloud) |
| 29 | GCP_PROJECT_ID= |
| 30 | GCP_MANAGED_ZONE= |
| 31 | GOOGLE_APPLICATION_CREDENTIALS= |
| 32 | |
| 33 | # Hetzner DNS settings (required when ACME_DNS_PROVIDER=hetzner) |
| 34 | HETZNER_API_TOKEN= |
| 35 | |
| 36 | # Route53 settings (required when ACME_DNS_PROVIDER=route53) |
| 37 | AWS_ACCESS_KEY_ID= |
| 38 | AWS_SECRET_ACCESS_KEY= |
| 39 | AWS_SESSION_TOKEN= |
| 40 | AWS_REGION= |
| 41 | AWS_DEFAULT_REGION= |
| 42 | AWS_HOSTED_ZONE_ID= |
| 43 | # Required only when ACME_DNS_PROVIDER=route53 and ENS_GASLESS_ENABLED=true and no ACTIVE KSK already exists. |
| 44 | AWS_DNSSEC_KMS_KEY_ARN= |
| 45 | |
| 46 | # Vultr DNS settings (required when ACME_DNS_PROVIDER=vultr) |
| 47 | VULTR_API_KEY= |
| 48 | |
| 49 | # Njalla DNS settings (required when ACME_DNS_PROVIDER=njalla) |
| 50 | NJALLA_TOKEN= |
| 51 | |
| 52 | # ENS gasless DNS import automation. When enabled, Portal uses ACME_DNS_PROVIDER |
| 53 | # for DNSSEC and ENS TXT automation, even when certificate files are managed manually. |
| 54 | ENS_GASLESS_ENABLED=false |
| 55 | |
| 56 | # Admin/auth configuration. Use a long random value for production relays. |
| 57 | ADMIN_TOKEN= |
| 58 | |
| 59 | # Optional embedded Sui x402 facilitator exposed under /api/x402. |
| 60 | X402_ENABLED=true |
| 61 | X402_TESTNET=true |
| 62 | X402_PAY_TO= |
| 63 | |
| 64 | # Enable when the relay is behind nginx/ingress/load balancers and should trust forwarded client IP headers. |
| 65 | # Optionally restrict which proxy source ranges may supply those headers; leave empty for default private/loopback proxy ranges. |
| 66 | TRUST_PROXY_HEADERS=true |
| 67 | TRUSTED_PROXY_CIDRS= |
| 68 | |
| 69 | # Frontend-owned presentation state. |
| 70 | # Bundled Compose stores the saved override under ./.portal-certs/frontend-state/state.json. |
| 71 | LANDING_PAGE_ENABLED=false |
| 72 | |
| 73 | # Optional: auto-generated thumbnail screenshots for tunnel apps without a thumbnail. |
| 74 | # Used by the portal-api service. Requires the headless-shell sidecar. |
| 75 | # Leave empty to keep generated screenshots disabled. See docs/src/routes/deployment/+page.md. |
| 76 | # HEADLESS_SHELL_URL=ws://headless-shell:9222 |